Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A security analyst is reviewing web server access logs collected by a Security Information and Event Management (SIEM) system. The log stream displays the following entry:

`192.168.1.45 - - [27/Jul/2026:14:22:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452`

Which of the following attack types is directly indicated by this log entry?

  1. SQL injectionAnswer
  2. B
    Cross-site scripting (XSS)
  3. C
    Broken authentication
  4. D
    SIEM correlation rule misconfiguration

Answer

SQL injection
The correct answer is SQL injection because the HTTP GET query string contains explicit database command syntax (`UNION SELECT username,password FROM users--`). This indicates an attacker attempting to bypass application input controls to exfiltrate database records.

Step-by-Step Solution

1
Examine the HTTP GET request parameter in the log snippet.
The string contains `id=1%20UNION%20SELECT%20username,password%20FROM%20users--`.
URL encoding (`%20` for space) conceals SQL keyword syntax used to append database query results.
2
Identify the target component and intent of the injected string.
The `UNION SELECT` construct attempts to query database user tables via an unvalidated web application input field.
Injecting database commands into application parameters to interact directly with backend data is the core characteristic of SQL injection.

Key Concept

Log Identification of Web Application Attacks
Estimated Time:45s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic