Investigating Web Attacks ECSS Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A network capture from a web server shows an HTTP request with a URL-encoded payload in the 'User-Agent' header. The decoded payload is '<script>alert(1)</script>'. The web server responded with a 200 OK and the script appeared in the response body. Which conclusion is most supported by this evidence?

   • AThe attacker performed a SQL injection attack
   • BThe web application is vulnerable to reflected XSS because the User-Agent is echoed without sanitization
   • CThe web server is compromised and executing arbitrary commands
   • DThe attack was a denial-of-service attempt
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An investigator is correlating evidence from a web attack. The web server access log shows a request to /admin at 10:00:00 from IP 192.168.1.10. The WAF log shows a SQL injection attempt from the same IP at 10:00:01. The database log shows a query that returned all rows from the 'users' table at 10:00:02. Which conclusion is best supported by this evidence?

   • AThe WAF blocked the SQL injection, so the database query was unrelated
   • BThe database query was a routine backup process
   • CThe attacker accessed the admin page and then performed a SQL injection that successfully extracted user data
   • DThe attacker used a cross-site scripting attack to steal user data
   Reveal Solution Discussion Select an answer first
4. 43application · easy

   You are analyzing web server logs and notice a high number of requests to /login.php with different usernames and passwords from the same IP address. What attack pattern does this indicate?

   • ABrute-force attack against the login page
   • BDirectory traversal attack
   • CSQL injection attack
   • DCross-site scripting attack
   Reveal Solution Discussion Select an answer first
5. 44application · medium · select all that apply

   A web application was attacked via a cross-site scripting (XSS) vulnerability. Which of the following are potential sources of evidence for this attack? (Select all that apply.)

   • AMemory dump of the victim's browser
   • BNetwork traffic capture showing the malicious request and response
   • CWeb server access logs showing the request containing the XSS payload
   • DBrowser history of the victim user
   • EThe attacker's email account
   Check answers Discussion Select an answer first
6. 45application · medium

   You have completed the forensic analysis of a web attack and need to present your findings to a non-technical executive board. Which approach is most appropriate for the final report?

   • AStart with an executive summary that states the attack vector, impact, and recommended remediation in plain language
   • BUse only visual diagrams and omit written explanations
   • CLead with raw log excerpts and packet captures to show the evidence
   • DInclude every technical detail in the main body to ensure completeness
   Reveal Solution Discussion Select an answer first