Examkin

Soru

Zorluk: KolayLog Analysis and SIEM Management

A security analyst reviews the following web server access log entry:

192.168.1.45 - - [27/Jul/2026:14:32:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 4523

Which of the following attack types is indicated by this log entry?

  1. SQL Injection (SQLi)Cevap
  2. B
    Cross-Site Scripting (XSS)
  3. C
    Broken Authorization
  4. D
    Rule Misconfiguration

Cevap

SQL Injection (SQLi)
The option identifying SQL Injection (SQLi) is correct because the URL parameter contains explicit SQL command structures ('UNION SELECT') designed to query backend database tables.

Adım Adım Çözüm

1
Inspect the requested URL parameters in the log entry
The parameter id contains '%20UNION%20SELECT%20username,password%20FROM%20users--'
URL decoding reveals SQL query syntax appended to the input parameter.
2
Identify the underlying attack mechanism
SQL keywords like UNION SELECT attempt to extract data directly from backend database tables
Manipulating backend database SQL queries via unsanitized parameter inputs defines a SQL Injection attack.

Anahtar Kavram

Identifying SQL Injection attack signatures in web access logs
Tahmini Süre:45s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru