Web Application Forensics DFE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A forensic analyst is investigating a data breach. The database log shows a query: `SELECT * FROM users WHERE username='admin' AND password='' OR '1'='1'`. The web server log shows a request to `POST /login` with body `username=admin' OR '1'='1' --&password=x`. The WAF log shows the request was blocked. However, the database log shows the query executed. What is the most likely explanation?

   • AThe WAF was in monitoring mode, allowing the request to pass while logging it.
   • BThe web server log is forged by the attacker.
   • CThe WAF blocked the request, but the database query was from a legitimate user.
   • DThe database log is from a different database that was not protected by the WAF.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A web server log shows the following sequence from the same IP address: `GET /index.php?page=home` `GET /index.php?page=../../../../etc/passwd` `GET /index.php?page=home` The first and third requests returned HTTP 200, the second returned HTTP 403. What does this pattern indicate?

   • AAn attempted path traversal attack that was blocked by the server or application.
   • BA successful SQL injection attack that retrieved the password file.
   • CA cross-site scripting (XSS) attack that attempted to load external scripts.
   • DA normal user navigating the site, with the 403 caused by a broken link.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A WAF log shows a request to /login.php with a POST parameter 'username' containing 'admin' OR '1'='1' --. The WAF returned a 403. What should the analyst do next to confirm the attack was blocked?

   • ACheck the web server log for the same request to see if it reached the application.
   • BCheck the firewall log for outbound connections from the attacker's IP.
   • CCheck the application log for a successful login by the attacker.
   • DCheck the database log for a query that returned all users.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A WAF log shows a request to /search.php?q=<script>alert('xss')</script> that returned HTTP 200. The web server log shows the same request also returned 200. What should the analyst do next?

   • ACheck the database log for a query that returned all users.
   • BTreat the request as a false positive and ignore it.
   • CInvestigate whether the application sanitized the input and whether the script was reflected in the response.
   • DBlock the attacker's IP address in the WAF.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which HTTP status code class indicates that the server encountered an error while processing the request?

   • A5xx
   • B2xx
   • C4xx
   • D3xx
   Reveal Solution Discussion Select an answer first