HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 12)

Questions 56–60

1. 56foundation · easy

   Which HTTP authentication mechanism sends credentials in Base64-encoded form without encryption?

   • ADigest authentication
   • BOAuth 2.0
   • CBasic authentication
   • DNTLM authentication
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   Which HTTP request characteristic might indicate a covert data exfiltration channel?

   • ARequests with a standard User-Agent
   • BResponses with a 200 status code
   • CStandard GET requests for images
   • DData encoded in the URL query string or cookie values
   Reveal Solution Discussion Select an answer first
4. 58expert · hard

   A SOC analyst is investigating a web server that has been compromised. The analyst notices a series of POST requests to '/uploads/photo.php' with a Content-Type of 'application/x-www-form-urlencoded'. The request bodies are small (200-400 bytes) and contain strings like 'cmd=whoami', 'cmd=ls', and 'cmd=cat%20/etc/passwd'. The responses are 200 OK and contain the output of the commands. The analyst also notes that the User-Agent is 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' but the Accept-Language header is 'en-US,en;q=0.9' which is consistent with a browser. Which conclusion is most consistent with this traffic?

   • AThe traffic is a false positive caused by a misconfigured monitoring tool
   • BThe attacker is using HTTP tunneling to hide SSH traffic
   • CThe traffic is a botnet C2 channel using HTTP for command and control
   • DA web shell is present, and the attacker is using it to execute system commands
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A SOC analyst is reviewing HTTP logs and finds a request to '/login.php' with the following query string: '?username=admin&password=1234&username=administrator'. The application is known to use a framework that, when multiple parameters with the same name are present, concatenates them with a comma. The analyst suspects an attack. Which attack is most likely being attempted?

   • ACSRF, where the attacker is trying to forge a login request
   • BHTTP parameter pollution, where the attacker is trying to bypass input validation by providing multiple values for the 'username' parameter
   • CXSS, where the attacker is trying to inject a script into the 'username' parameter
   • DSQL injection, where the attacker is trying to inject SQL code into the 'username' parameter
   Reveal Solution Discussion Select an answer first
6. 60foundation · easy

   What is a web shell?

   • AA script uploaded to a server that allows remote command execution
   • BA firewall rule that blocks web traffic
   • CA type of SQL injection payload
   • DA tool for scanning web directories
   Reveal Solution Discussion Select an answer first