HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC analyst is reviewing HTTP logs and finds a POST request to '/upload.php' with a Content-Type of 'multipart/form-data'. The body contains a file named 'profile.jpg' with a Content-Type of 'image/jpeg'. However, the file content begins with '<?php echo system($_GET['cmd']); ?>'. The server responds with a 200 OK and a link to the uploaded file. Which attack is most likely being attempted?

   • ASQL injection, where the attacker is trying to inject SQL code into the file name
   • BMalicious file upload, where the attacker is trying to upload a PHP web shell disguised as an image
   • CHTTP response splitting, where the attacker is trying to inject headers into the response
   • DXSS, where the attacker is trying to upload a malicious script that will execute in other users' browsers
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC analyst is baselining HTTP traffic for a corporate web server. The baseline shows an average of 100 requests per minute, with a standard deviation of 20. The analyst observes a 10-minute window where the request rate spikes to 500 requests per minute, and the requests are all GET requests to /login.php with varying username parameters. The responses are a mix of 200 OK and 302 Redirect. Which HTTP anomaly detection heuristic would be most effective in flagging this behavior as a potential brute-force attack?

   • AA threshold-based alert on the request rate exceeding the baseline by more than 3 standard deviations
   • BAn alert on the varying username parameters in the requests
   • CAn alert on the mix of 200 OK and 302 Redirect responses
   • DAn alert on the use of the GET method to /login.php
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC analyst is monitoring a web application that allows users to upload profile pictures. The analyst captures a POST request to /upload with a multipart/form-data body. The request includes a filename="avatar.php" and the Content-Type of the uploaded part is application/x-php. The server responds with a 201 Created status and a link to /uploads/avatar.php. Which HTTP request and response characteristics indicate the most likely attack?

   • AThe filename parameter is present in the Content-Disposition header and the response is a 200 OK
   • BThe uploaded file has a .php extension and the server returns a 201 Created with a direct link to the uploaded file
   • CThe POST method is used for the upload and the response includes a 201 Created status code
   • DThe multipart/form-data content type is used and the response includes a link to the uploaded file
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How do HTTP sessions typically maintain state between requests?

   • AUsing the client's IP address only
   • BUsing cookies that carry a session identifier
   • CUsing the User-Agent header
   • DUsing the Referer header
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst is reviewing the web server logs for an e-commerce application and notices a series of requests to /products.php?id=1, /products.php?id=2, /products.php?id=3, followed by /products.php?id=1' OR '1'='1. The responses for the last request include a 200 OK with an unusually large body size compared to the previous requests. Which HTTP status code pattern and request characteristic should the analyst flag as the highest priority for further investigation?

   • AA 200 OK response to a request containing SQL syntax in a parameter, combined with an anomalous response size
   • BA 404 Not Found response to a request with a non-numeric parameter value
   • CA 302 Redirect response following the request with the encoded payload
   • DA 500 Internal Server Error response to the request with the SQL syntax
   Reveal Solution Discussion Select an answer first