A security analyst reviews an alert from a Network Intrusion Detection System (NIDS). The alert log captures an incoming HTTP request containing the payload: `http://example.com/login?user=admin' OR '1'='1'--`. Which of the following statements correctly identify the type of attack detected and an effective mitigation? (Select TWO.)
- The log entry captures a SQL injection attack targeting the backend database to bypass authentication.Answer
- Implementing parameterized queries (prepared statements) within the web application prevents this attack type.Answer
- CThe log entry captures a Cross-Site Scripting (XSS) attack attempting to run malicious JavaScript in client browsers.
- DDeploying a perimeter firewall to block all inbound HTTP traffic mitigates the web application vulnerability.
Answer
The alert indicates a SQL injection attack, and the proper mitigation is implementing parameterized queries in the web application code.
The payload `' OR '1'='1'--` is a classic SQL injection signature aimed at evaluating database queries to true to bypass authentication. Using parameterized queries in the application code ensures database drivers handle user inputs as parameter data rather than executable commands, rendering SQL injection ineffective.
Step-by-Step Solution
Key Concept
Network Intrusion Detection and Web Attack Analysis
Estimated Time:1m 0s