Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A security analyst reviews the following web server access log entry:

192.168.1.45 - - [27/Jul/2026:14:32:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 4523

Which of the following attack types is indicated by this log entry?

  1. SQL Injection (SQLi)Answer
  2. B
    Cross-Site Scripting (XSS)
  3. C
    Broken Authorization
  4. D
    Rule Misconfiguration

Answer

SQL Injection (SQLi)
The option identifying SQL Injection (SQLi) is correct because the URL parameter contains explicit SQL command structures ('UNION SELECT') designed to query backend database tables.

Step-by-Step Solution

1
Inspect the requested URL parameters in the log entry
The parameter id contains '%20UNION%20SELECT%20username,password%20FROM%20users--'
URL decoding reveals SQL query syntax appended to the input parameter.
2
Identify the underlying attack mechanism
SQL keywords like UNION SELECT attempt to extract data directly from backend database tables
Manipulating backend database SQL queries via unsanitized parameter inputs defines a SQL Injection attack.

Key Concept

Identifying SQL Injection attack signatures in web access logs
Estimated Time:45s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic