Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A SOC analyst is reviewing web server access logs within a SIEM platform after an automated alert was generated. The analyst identifies the following log entries:

192.168.10.45 - - [27/Jul/2026:10:15:32 +0000] "GET /item.php?id=12%27%20UNION%20SELECT%20username,%20password_hash%20FROM%20users-- HTTP/1.1" 200 4812
192.168.10.45 - - [27/Jul/2026:10:15:40 +0000] "GET /item.php?id=12%27%20OR%201=1-- HTTP/1.1" 200 9520

Based on the log analysis, which security event has occurred?

  1. A SQL injection (SQLi) attack targeting the backend database through URL parameter manipulation.Answer
  2. B
    A Cross-Site Scripting (XSS) attack attempting to execute malicious scripts within a client's web browser.
  3. C
    An authentication bypass resulting from improper authorization checking during user identity verification.
  4. D
    A failure of a detective security control to prevent unauthorized file system path traversal.

Answer

A SQL injection (SQLi) attack targeting the backend database through URL parameter manipulation.
The log entries show URL-encoded payloads containing standard SQL statements such as `UNION SELECT username, password_hash FROM users--` and `' OR 1=1--`. These syntax patterns confirm that an attacker is attempting to execute arbitrary SQL commands against the database through vulnerable parameter inputs.

Step-by-Step Solution

1
Examine the HTTP request methods and URI paths in the log entries.
The client requested `/item.php?id=...` using GET requests.
Log analysis begins with identifying the target resource and parameter inputs.
2
Decode and analyze the parameter payloads (`%20UNION%20SELECT%20...` and `%20OR%201=1--`).
Decoded strings reveal `UNION SELECT username, password_hash FROM users--` and `' OR 1=1--`.
URL-decoded strings show clear relational database query statements designed to append commands or bypass login checks.
3
Correlate the payload type with standard application attack classifications.
The injection of relational database queries via input parameters defines SQL Injection (SQLi).
Distinguishing SQL syntax from script syntax or directory markers allows accurate event classification.

Key Concept

Log Analysis and SQL Injection Detection in SIEM
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic