Examkin

Soru

Zorluk: KolayLog Analysis and SIEM Management

A SOC analyst reviews the following web server access log entry presented in a Security Information and Event Management (SIEM) console:

10.0.0.15 - - [27/Jul/2026:11:05:14 +0000] "GET /products.php?id=1%20OR%201=1 HTTP/1.1" 200 452

Which type of attack vector is indicated by this log entry?

  1. SQL injectionCevap
  2. B
    Cross-Site Scripting (XSS)
  3. C
    Broken authorization control
  4. D
    Deterrent control failure

Cevap

SQL injection
The payload `1 OR 1=1` appended to the parameter string in the HTTP GET request is designed to manipulate SQL statements executed by the database backend, making SQL injection the correct attack vector.

Adım Adım Çözüm

1
Inspect the URL query parameters within the HTTP GET request in the web log entry.
The query string contains `id=1%20OR%201=1`, where `%20` represents URL-encoded space characters.
Log parsing requires analyzing user-supplied parameters for unexpected syntax or command injection characters.
2
Evaluate the intent of the injected parameters.
The syntax `1 OR 1=1` forces a SQL conditional clause to evaluate to true regardless of original query conditions.
This is a fundamental signature of an inline SQL injection attack against a web application database.

Anahtar Kavram

Identifying SQL Injection Indicators in SIEM Web Server Logs
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru