Web Application Forensics DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company's WAF log shows a rule triggered for the request `POST /login.php` with body `username=admin' OR '1'='1' --&password=x`. The WAF blocked the request. However, the web server log shows the same request reached the application and returned HTTP 200. What is the most likely explanation?

   • AThe WAF rule was misconfigured to block only GET requests, not POST requests.
   • BThe WAF blocked the request but the web server still logged it because the connection was already established.
   • CThe WAF was in monitoring mode, logging the attack but not blocking it.
   • DThe web server log is from a different server that is not behind the WAF.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is correlating logs from a web attack. The web server log shows a request to `GET /admin` from IP 198.51.100.3 at 14:00:00. The WAF log shows the same request was blocked at 14:00:01. The database log shows a query to the `admin` table at 14:00:02. The analyst also finds a request to `GET /admin` from IP 198.51.100.3 at 14:00:03 that was not blocked. What is the most likely sequence?

   • AThe WAF log is incorrect because the database query shows the first request reached the database.
   • BThe first request was blocked, but the attacker sent a second, unblocked request that reached the database.
   • CThe attacker used a different IP address to bypass the WAF.
   • DThe database query is unrelated to the web requests.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A WAF log shows a request to /submit.php with a POST body containing 'comment=<script>document.cookie</script>'. The WAF returned a 403. What type of attack was attempted, and what was the outcome?

   • ACross-site request forgery (CSRF); the request was blocked, but the user's session was still compromised.
   • BFile inclusion; the request was blocked, but the server file was still read.
   • CSQL injection; the request was blocked and did not reach the database.
   • DCross-site scripting (XSS); the request was blocked and did not reach the application.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic analyst examines database logs and finds a series of queries: `SELECT * FROM users WHERE username='admin' AND password='' OR '1'='1'` followed by `SELECT * FROM credit_cards`. The queries originated from the web application's database user, not from an admin console. What attack vector is most likely?

   • AA session hijacking attack where the attacker took over an admin's session.
   • BA CSRF attack that tricked an admin into performing database queries.
   • CA file inclusion vulnerability that allowed the attacker to read database configuration files.
   • DSQL injection through a vulnerable login form, allowing the attacker to bypass authentication and then query other tables.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In a standard web server log entry, which field typically records the IP address of the client that made the request?

   • ARemote host
   • BStatus code
   • CRequest line
   • DUser agent
   Reveal Solution Discussion Select an answer first