HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 15)

Questions 71–75

1. 71application · medium

   A SOC analyst is reviewing web server logs and finds a series of requests to a file download endpoint. The requests include /download?file=../../../../etc/passwd, /download?file=..%2F..%2F..%2Fetc%2Fpasswd, and /download?file=....//....//etc/passwd. The server responds with a 200 OK and the contents of the system password file for the last request. Which HTTP request component is being manipulated, and what is the most effective immediate mitigation?

   • AThe URI parameter 'file' is being manipulated with path traversal sequences; implement strict input validation to canonicalize and reject traversal patterns
   • BThe Host header is being altered to access virtual hosts; validate the Host header against an allowlist
   • CThe HTTP method is being changed from GET to POST to bypass access controls; enforce method-based access control
   • DThe User-Agent header is being modified to trick the server; block requests with non-standard User-Agent strings
   Reveal Solution Discussion Select an answer first
2. 72application · medium

   An analyst is reviewing HTTP traffic and finds a request to '/redirect.php' with the following header: 'X-Forwarded-For: 127.0.0.1%0d%0aX-Custom-Header: injected'. The server responds with a 302 redirect. The analyst notices that the response includes an 'X-Custom-Header' that was not set by the application. Which attack is most likely being attempted?

   • AHTTP parameter pollution, where the attacker is trying to add an extra parameter
   • BHTTP header injection via CRLF, where the attacker is trying to inject additional headers into the response
   • CHTTP request smuggling, where the attacker is trying to smuggle a second request
   • DDirectory traversal, where the attacker is trying to access a restricted file
   Reveal Solution Discussion Select an answer first
4. 73application · medium

   A SOC analyst is reviewing web server logs and finds a request to '/search.php?q=%3Cscript%3Ealert(1)%3C%2Fscript%3E'. The response from the server includes the query parameter value unencoded in the HTML body. The application does not appear to store the search term. Which type of XSS is this, and what is the most immediate risk?

   • AStored XSS; the payload is saved in the server's search history and executes for all users
   • BReflected XSS; the payload executes in the victim's browser when they click a crafted link
   • CDOM-based XSS; the payload is executed by JavaScript in the page without being sent to the server
   • DBlind XSS; the payload executes in an admin's browser when they review logs
   Reveal Solution Discussion Select an answer first
5. 74foundation · easy

   What is HTTP tunneling?

   • AEncrypting HTTP traffic with TLS
   • BEncapsulating non-HTTP protocols inside HTTP requests or responses
   • CCompressing HTTP data
   • DRedirecting HTTP requests to another server
   Reveal Solution Discussion Select an answer first
6. 75foundation · easy

   In an HTTP request, which component typically contains the data submitted by a form using the POST method?

   • ARequest URI
   • BRequest method
   • CRequest headers
   • DRequest body
   Reveal Solution Discussion Select an answer first