HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 14)

Questions 66–70

1. 66foundation · easy

   What is a common attack that targets session tokens carried in cookies?

   • ADirectory traversal
   • BSession hijacking
   • CHTTP response splitting
   • DSQL injection
   Reveal Solution Discussion Select an answer first
2. 67foundation · easy

   Which tool is commonly used for interactive HTTP request manipulation and replay?

   • ANmap
   • Btcpdump
   • CWireshark
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
4. 68foundation · easy

   What is a primary vulnerability of HTTP Basic authentication?

   • AIt is vulnerable to replay attacks because it uses a nonce
   • BIt requires a valid certificate
   • CIt uses a shared secret that is hard to manage
   • DCredentials are transmitted in a form that can be easily decoded
   Reveal Solution Discussion Select an answer first
5. 69expert · hard

   A SOC analyst is investigating an anomaly where a front-end proxy and a back-end application server are interpreting HTTP requests differently. The analyst captures a request with both a Content-Length: 0 header and a Transfer-Encoding: chunked header. The front-end server uses the Content-Length header, while the back-end server uses the Transfer-Encoding header. Which attack technique is the analyst most likely observing, and what is the primary indicator in the request?

   • AHTTP Header Injection, indicated by the presence of a Transfer-Encoding header in a GET request
   • BHTTP Response Splitting, indicated by the presence of both Content-Length and Transfer-Encoding headers
   • CHTTP Parameter Pollution, indicated by the use of both Content-Length and Transfer-Encoding headers
   • DHTTP Request Smuggling, indicated by conflicting Content-Length and Transfer-Encoding headers
   Reveal Solution Discussion Select an answer first
6. 70application · medium

   A SOC analyst is examining a web server log and finds the following request: 'GET /products.php?id=1%20OR%201%3D1'. The response status is 200 OK and the response body is significantly larger than a normal product page. Which attack is most likely being attempted, and what is the best immediate action?

   • ASQL injection; block the source IP and alert the web application team to review the query parameter handling
   • BHTTP parameter pollution; the attacker is sending multiple 'id' parameters to bypass validation
   • CXSS; sanitize the input and re-issue the request to confirm the payload executes
   • DDirectory traversal; the 'id' parameter is being used to read files outside the web root
   Reveal Solution Discussion Select an answer first