HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC analyst needs to capture HTTP traffic on a Linux server to investigate a potential web attack. The analyst wants to capture only HTTP traffic (port 80) and save the capture to a file for later analysis. Which command should the analyst use?

   • Atcpdump -i eth0 -w capture.pcap 'port 443'
   • Btcpdump -i eth0 -s 0 -w capture.pcap 'tcp port 80'
   • Ctcpdump -i eth0 -n -w capture.pcap 'udp port 80'
   • Dtcpdump -i eth0 -c 100 -w capture.pcap 'tcp port 80'
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In HTTPS, what role does a digital certificate play?

   • AIt authenticates the server's identity to the client
   • BIt encrypts the HTTP request body
   • CIt prevents SQL injection attacks
   • DIt stores the user's session token
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC analyst is reviewing HTTP traffic to a legacy web application. The analyst captures a request to /admin with an Authorization header that contains the base64-encoded string 'YWRtaW46cGFzc3dvcmQ='. The server responds with a 401 Unauthorized status and a WWW-Authenticate: Basic realm="Admin" header. Which HTTP authentication mechanism is being used, and what is its primary vulnerability?

   • ADigest authentication, which uses a hash of the credentials and a nonce to protect them
   • BBasic authentication, which transmits credentials in base64-encoded plaintext that can be easily decoded
   • CBearer token authentication, which uses a token in the Authorization header
   • DNTLM authentication, which uses a challenge-response mechanism
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC analyst is investigating a cache poisoning incident. The analyst finds that a request to '/search?q=test%0d%0aContent-Length:%200' resulted in a response that was cached by the CDN. Subsequent requests to '/search?q=test' returned the cached response, which included an injected 'Content-Length: 0' header. The original response from the origin server did not include this header. Which attack best explains this incident?

   • AHTTP request smuggling, where the attacker smuggled a request to the CDN
   • BHTTP parameter pollution, where the attacker added an extra parameter to the request
   • CHTTP response splitting, where the attacker injected a header into the response that was cached by the CDN
   • DHTTP header injection, where the attacker injected a header into the request
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What does HTTP response splitting allow an attacker to do?

   • ABypass TLS certificate validation
   • BEncrypt the response to hide it from the client
   • CChange the HTTP method of the request
   • DInject additional headers or content into the response
   Reveal Solution Discussion Select an answer first