Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A SOC analyst reviews the following web server access log entry presented in a Security Information and Event Management (SIEM) console:

10.0.0.15 - - [27/Jul/2026:11:05:14 +0000] "GET /products.php?id=1%20OR%201=1 HTTP/1.1" 200 452

Which type of attack vector is indicated by this log entry?

  1. SQL injectionAnswer
  2. B
    Cross-Site Scripting (XSS)
  3. C
    Broken authorization control
  4. D
    Deterrent control failure

Answer

SQL injection
The payload `1 OR 1=1` appended to the parameter string in the HTTP GET request is designed to manipulate SQL statements executed by the database backend, making SQL injection the correct attack vector.

Step-by-Step Solution

1
Inspect the URL query parameters within the HTTP GET request in the web log entry.
The query string contains `id=1%20OR%201=1`, where `%20` represents URL-encoded space characters.
Log parsing requires analyzing user-supplied parameters for unexpected syntax or command injection characters.
2
Evaluate the intent of the injected parameters.
The syntax `1 OR 1=1` forces a SQL conditional clause to evaluate to true regardless of original query conditions.
This is a fundamental signature of an inline SQL injection attack against a web application database.

Key Concept

Identifying SQL Injection Indicators in SIEM Web Server Logs
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic