Investigating Web Attacks ECSS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a common web attack vector that exploits user-supplied input to execute arbitrary commands on the server?

   • ACross-site scripting (XSS)
   • BSQL injection
   • CCommand injection
   • DCross-site request forgery (CSRF)
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A web server was compromised. You have a packet capture that shows an HTTP POST to /upload.php with a multipart form containing a file named 'shell.php'. The server responded with 200 OK. Immediately after, there is an outbound TCP connection from the server to IP 192.0.2.10 on port 4444. Which conclusion is best supported by this network evidence?

   • AThe attacker uploaded a web shell and initiated a reverse connection to a command-and-control server
   • BThe server is making a legitimate outbound update check
   • CThe attacker is exfiltrating data via DNS tunneling
   • DThe attacker performed a SQL injection attack against the upload form
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   A web application allows users to upload profile pictures. An attacker uploads a file named 'photo.php' that contains PHP code. The server executes the file when accessed. Which web attack vector does this scenario describe?

   • ASQL injection
   • BCross-site request forgery (CSRF)
   • CMalicious file upload
   • DDenial of service (DoS)
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A forensic investigator is writing a report on a web attack. The report must be used in court. Which practice is most important for the report to be admissible?

   • AFocus only on the attacker's identity
   • BInclude raw log excerpts without interpretation
   • CUse technical jargon to demonstrate expertise
   • DDocument the chain of custody for all evidence and the tools used
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is reviewing logs from a web application that was compromised. The access log shows a request to /search?q=<script>alert(1)</script>. The application log shows that the search term was stored in a database. The database log shows the stored term was later retrieved and rendered in a page. Which type of XSS attack is indicated by this evidence?

   • AReflected XSS
   • BStored XSS
   • CBlind XSS
   • DDOM-based XSS
   Reveal Solution Discussion Select an answer first