HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 13)

Questions 61–65

1. 61foundation · easy

   Why can HTTP Parameter Pollution be dangerous?

   • AIt causes the server to crash
   • BIt can bypass security controls that only check the first parameter
   • CIt changes the HTTP method
   • DIt encrypts the session token
   Reveal Solution Discussion Select an answer first
2. 62application · medium

   A user reports that their account was used to transfer funds without their knowledge. The SOC analyst reviews the proxy logs and finds a request to '/transfer.php' with a POST body containing 'amount=1000&toAccount=12345'. The request includes a 'Referer' header pointing to 'https://evil.example.com/phish'. The user's session cookie was not present in the request. Which attack best explains this incident?

   • AXSS, because the attacker injected a script into the transfer page
   • BSession fixation, because the attacker set the session cookie to a known value
   • CCSRF, because the user's browser automatically included the session cookie, but the Referer header indicates a cross-origin request
   • DHTTP parameter pollution, because the attacker added an extra 'amount' parameter
   Reveal Solution Discussion Select an answer first
4. 63application · medium

   A SOC analyst is analyzing web server logs and finds the following entries: 'GET /products.php?id=1' followed by 'GET /products.php?id=2', 'GET /products.php?id=3', and so on, up to 'GET /products.php?id=1000'. The requests come from a single IP address and occur within a 5-second window. The responses are all 200 OK. Which conclusion is most consistent with this observation?

   • AThe traffic is a DDoS attack, and the analyst should alert the incident response team
   • BThe traffic is likely a web scraper or bot enumerating product IDs, and the analyst should consider blocking the IP if it violates the terms of service
   • CThe traffic is a false positive caused by a misconfigured monitoring tool
   • DThe traffic is a SQL injection attack, and the analyst should block the IP immediately
   Reveal Solution Discussion Select an answer first
5. 64application · medium

   An analyst is reviewing HTTP logs and finds a request to '/download.php?file=..%2F..%2Fetc%2Fpasswd'. The server responds with a 200 OK and the response body contains 'root:x:0:0:root:/root:/bin/bash'. What is the most likely vulnerability, and what is the best immediate mitigation?

   • ADirectory traversal; implement input validation to reject path traversal sequences and use a whitelist of allowed files
   • BMalicious file upload; the attacker uploaded a file named 'passwd' to the server
   • CHTTP response splitting; the attacker is injecting a newline to add headers to the response
   • DSQL injection; parameterize the 'file' parameter to prevent database queries
   Reveal Solution Discussion Select an answer first
6. 65application · medium

   A SOC analyst is reviewing HTTP logs and finds a request to '/profile' with the following headers: 'Cookie: session=abc123' and 'Referer: https://evil.example.com/steal'. The response is a 200 OK with the user's profile page. The analyst notices that the application does not set the 'SameSite' attribute on the session cookie. Which attack is most likely to succeed?

   • AHTTP request smuggling, because the attacker is trying to smuggle a request
   • BCSRF, because the browser will include the session cookie in cross-site requests due to the missing SameSite attribute
   • CXSS, because the attacker can inject a script into the profile page
   • DSession fixation, because the attacker can set the session cookie to a known value
   Reveal Solution Discussion Select an answer first