Investigating Web Attacks ECSS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A network capture from a web server shows a series of HTTP requests with varying 'Host' headers, each requesting the same URL. The responses vary in content. Which attack is most likely being performed?

   • ASQL injection
   • BCross-site scripting
   • CDirectory traversal
   • DHost header injection
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic investigator is examining a pcap file from a web server that was defaced. The capture shows an HTTP request with a GET /admin?debug=true&cmd=whoami request followed by a response containing the output of the 'whoami' command. Which finding best characterizes the attack based on this network traffic?

   • AThe attacker performed a directory traversal attack to read the /admin directory
   • BThe attacker used a cross-site scripting (XSS) payload to execute JavaScript in the administrator's browser
   • CThe attacker exploited a command injection vulnerability in the application's debug functionality
   • DThe attacker launched a brute-force attack against the admin login page
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web application allows users to upload profile pictures. An attacker uploads a file named 'photo.php' disguised as a JPEG. When the file is accessed, it executes PHP code. Which web attack vector is being exploited?

   • ASQL injection
   • BCross-site scripting
   • CDenial of service
   • DFile upload vulnerability
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an investigation, an analyst notices that an attacker first performed a port scan, then exploited a known vulnerability in the web server, and finally installed a backdoor. Which phase of the attack methodology does the backdoor installation represent?

   • AReconnaissance
   • BExploitation
   • CMaintaining access
   • DCovering tracks
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are reconstructing a web attack timeline. Evidence sources include: (1) web server logs showing a successful login from a new IP at 10:00; (2) a memory dump showing a process injected with a reverse shell at 10:05; (3) network captures showing outbound traffic to a known C2 server at 10:10; (4) database logs showing a large data export at 10:15. Which timeline is most consistent with this evidence?

   • AThe attacker used a zero-day exploit to gain access at 10:00, then used a second exploit at 10:15
   • BAttacker exfiltrated data at 10:00, connected to C2 at 10:05, established persistence at 10:10, and gained access at 10:15
   • CAttacker gained access at 10:00, established persistence at 10:05, connected to C2 at 10:10, and exfiltrated data at 10:15
   • DThe evidence is inconclusive because the times are too close together
   Reveal Solution Discussion Select an answer first