Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst inspecting a SIEM alert reviews the following web server access log entries:

text
192.168.45.10 - - [27/Jul/2026:14:20:01 +0000] "GET /profile.php?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20users-- HTTP/1.1" 200 4512
192.168.45.10 - - [27/Jul/2026:14:20:05 +0000] "POST /login.php HTTP/1.1" 200 1250
192.168.45.10 - - [27/Jul/2026:14:20:12 +0000] "GET /admin/config.php HTTP/1.1" 403 280

Which of the following best describes the attack progression shown in the log snippet and the security mechanism reflected by the final entry?

  1. The attacker executed a SQL injection attack to retrieve credentials, successfully authenticated to the application, and was subsequently denied access due to an authorization restriction.Answer
  2. B
    The attacker executed a Cross-Site Scripting (XSS) script to harvest session tokens, which failed during initial application authentication.
  3. C
    The attacker executed a SQL injection attack, but the final log entry indicates an authentication failure during identity verification.
  4. D
    The attacker attempted a SQL injection attack that was immediately blocked by a preventive network firewall control as indicated by HTTP 403.

Answer

The attacker executed a SQL injection attack to retrieve credentials, successfully authenticated to the application, and was subsequently denied access due to an authorization restriction.
The first log entry shows a URL-encoded SQL injection payload (`UNION SELECT username,password_hash FROM users`) that returned HTTP status code 200 OK, indicating successful execution and data extraction. The second entry shows a POST request to the login endpoint returning HTTP status code 200 OK, confirming successful authentication using the compromised credentials. The final entry targeting `/admin/config.php` returned HTTP status code 403 Forbidden, which signifies an authorization control enforcing access boundaries against an authenticated user.

Step-by-Step Solution

1
Analyze the first log entry for attack indicators
The URL parameters contain `%20UNION%20SELECT%20username,password_hash%20FROM%20users--`, which is a classic SQL injection payload designed to extract credentials from the backend database.
Identifying the initial exploit vector determines how the attacker gained information or access.
2
Examine subsequent requests to trace event sequence
The second request demonstrates a POST request to `/login.php` resulting in HTTP status code 200 OK, indicating successful authentication.
Correlating timestamped log entries establishes the progression from database compromise to active user session.
3
Interpret the HTTP status code of the final request
The third request targets `/admin/config.php` and receives an HTTP 403 Forbidden response.
HTTP 403 Forbidden indicates that while the user's identity is authenticated, they lack the required access permissions (authorization) to view the requested resource.

Key Concept

Log Analysis and SIEM Correlation across Application Attack Vectors and AAA Controls
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic