Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A security administrator is reviewing the following web server access log entry captured by a SIEM collector:

`192.168.1.45 - - [27/Jul/2026:14:15:30 +0000] "GET /products.php?id=1%27%20OR%20%271%27=%271 HTTP/1.1" 200 4520`

Which type of attack vector does this log entry indicate?

  1. SQL InjectionAnswer
  2. B
    Cross-Site Scripting (XSS)
  3. C
    Broken Authorization Control
  4. D
    SIEM Parsing Rule Failure

Answer

SQL Injection
The HTTP GET log entry includes `%27%20OR%20%271%27=%271`, which decodes to `' OR '1'='1`. This syntax attempts to force an SQL database query to evaluate to true, signifying a classic SQL injection attack.

Step-by-Step Solution

1
Examine the requested URI parameter in the web server log entry.
Identified URL-encoded string `%27%20OR%20%271%27=%271` in the `id` parameter.
URL decoding reveals SQL syntax: `' OR '1'='1`.
2
Determine the operational mechanism of the attack payload.
The payload forces a boolean TRUE condition (`'1'='1'`) within an SQL query filter.
This is a characteristic pattern of SQL injection aimed at bypassing query logic or extracting database records.

Key Concept

Identifying SQL Injection attack signatures in HTTP web server access logs
Estimated Time:45s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic