This is the first paper on web application attack forensics published. This paper will give you a basic understanding of what web application attacks look like, and how they are used in real life examples.

Fingerprinting Port 80 Attacks (ENG)
Russian (Local Copy) (Russian)
(Chinese)
Japanese translation

"The paper provides a nice no-frills overview of the subject."

-incidents.org Date 11/05/01

"Great analysis of Web server attacks, including log data."
-counterpane.com