Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A security analyst inspecting a Security Information and Event Management (SIEM) console reviews the following web server log snippet:

`10.0.4.15 - - [27/Jul/2026:14:15:33 +0000] "GET /cgi-bin/status.sh?cmd=cat%20/etc/passwd HTTP/1.1" 200 1420`

Which of the following cyber attack vectors is directly indicated by this log entry?

  1. Command injectionAnswer
  2. B
    Cross-site scripting (XSS)
  3. C
    SQL injection
  4. D
    Broken authentication

Answer

The command injection option is the correct answer.
The correct answer is Command injection because the log entry shows the parameter `cmd=cat%20/etc/passwd`, where `%20` represents a space. This attempts to invoke an operating system command (`cat /etc/passwd`) on the backend web server via a CGI script.

Step-by-Step Solution

1
Analyze the request URI parameters within the log entry.
Identified URL-encoded shell syntax `cat%20/etc/passwd` passed to parameter `cmd`.
Log analysis requires inspecting user input passed to CGI endpoints to determine intent.
2
Determine the target system and impact of the parameter payload.
The payload attempts to execute the system binary `cat` on the Linux file `/etc/passwd` directly on the web host.
Executing arbitrary operating system commands through web application inputs defines command injection.

Key Concept

Identifying web application attack indicators in SIEM access logs
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic