Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is investigating a alert generated by a SIEM correlation engine. The console displays the following sequential log entries collected from an enterprise web server and host database:

2026-07-27 11:05:12 | Host: WEB-01 | Apache: 192.168.1.105 - - "POST /login.php HTTP/1.1" 200 4512 "username=admin' OR '1'='1"
2026-07-27 11:05:13 | Host: WEB-01 | Auth: Successful authentication for user 'admin' from 192.168.1.105
2026-07-27 11:05:18 | Host: DB-01 | MySQL: Query executed: SELECT * FROM users WHERE username='admin' OR '1'='1'

Based on these correlated log entries, which of the following best describes the attack vector being executed and its immediate impact?

  1. A
    Cross-Site Scripting (XSS) executing malicious client-side scripts to hijack the active admin session.
  2. SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.Answer
  3. C
    A SIEM correlation rule misinterpretation that incorrectly combined unrelated legitimate administrative logins.
  4. D
    An authorization control failure where database access permissions were incorrectly assigned to an unauthenticated identity.

Answer

SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.
The HTTP POST request contains the classic SQL injection payload 'OR '1'='1, which forces the database conditional check to evaluate as true. As a result, the backend application authenticates the request as the 'admin' user without verifying credentials, leading to an authentication bypass.

Step-by-Step Solution

1
Analyze the web server request payload in the Apache HTTP log.
The input string "username=admin' OR '1'='1" contains SQL syntax markers intended to alter database query logic.
Web logs reveal initial attack vectors and payload delivery.
2
Correlate web server authentication events with host database query logs.
The database executed `SELECT * FROM users WHERE username='admin' OR '1'='1'`, which evaluates to true for all rows, returning a valid admin record.
Evaluating downstream database behavior confirms if an input payload successfully altered application backend processing.
3
Determine the impact of the successful payload execution.
The web application granted a successful authentication session for 'admin' without requiring a valid password.
Connecting payload execution to log authentication outcomes identifies the threat type as SQL injection leading to authentication bypass.

Key Concept

SQL Injection (SQLi) Log Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic