Examkin

Question

Difficulty: EasyNetwork Security Monitoring and Alerting

A network security analyst is reviewing real-time alert logs from a Network Intrusion Detection System (NIDS). The analyst spots an alert flagging an HTTP GET request containing the following parameter string: GET /products.php?id=1%20UNION%20SELECT%20username,%20password%20FROM%20users--. Which of the following attack types has been detected by this monitoring alert?

  1. SQL injectionAnswer
  2. B
    Cross-site scripting (XSS)
  3. C
    Honeypot misconfiguration
  4. D
    Compensating control failure

Answer

SQL injection
The network monitoring alert log contains standard database query keywords (`UNION SELECT`), which indicates an attempt to extract data directly from a backend database engine via SQL injection.

Step-by-Step Solution

1
Analyze the payload string reported in the NIDS alert log.
Identified database query keywords `UNION SELECT username, password FROM users--` within the HTTP GET request.
Network monitoring alerts provide packet or URI details that indicate the nature of the payload.
2
Match the payload features to known web application exploit vectors.
Recognized SQL query syntax designed to append unauthorized queries to existing database commands.
SQL syntax injected via input parameters characterizes a SQL injection attempt.

Key Concept

Identifying attack signatures in network intrusion detection logs
Estimated Time:45s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic