Examkin

Soru

Zorluk: OrtaNetwork Security Monitoring and Alerting

A network security monitoring sensor positioned at a cloud perimeter captures the following HTTP payload in a triggered NIDS alert log:

http
POST /api/v1/auth/login HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

user=admin%27%20OR%20%271%27%3D%271&pass=secret

The NIDS rule signature incorrectly labeled the alert as a generic client-side scripting event. Which of the following correctly identifies the actual threat vector represented by this payload and its primary objective?

  1. A
    Cross-Site Scripting (XSS) attempting to execute malicious client-side scripts inside the administrative user browser session.
  2. SQL Injection attempting to alter backend database query logic to bypass authentication controls.Cevap
  3. C
    A network-level buffer overflow attempting to corrupt web server process memory to execute arbitrary shellcode.
  4. D
    A deception honeypot interaction attempting to capture credentials for threat intelligence collection.

Cevap

SQL Injection attempting to alter backend database query logic to bypass authentication controls.
The correct option accurately identifies the payload `admin' OR '1'='1` as a SQL injection attack. URL decoding `%27` reveals single quotation marks used to break out of the SQL data field context and force the query statement to evaluate as true, thereby bypassing authentication logic at the database layer.

Adım Adım Çözüm

1
Decode the HTTP POST body payload from URL encoding.
The decoded string reads `user=admin' OR '1'='1&pass=secret`.
URL encoding hides character syntax such as `%27` representing a single quote `'` and `%20` representing spaces.
2
Analyze the structural intent of the decoded payload against web attack types.
The insertion of `' OR '1'='1` forces an inline database SQL query statement to always evaluate as true.
This signature is characteristic of SQL Injection targeting relational database backend verification rather than browser-rendered scripts (XSS).

Anahtar Kavram

Identifying SQL Injection alert signatures in network traffic monitoring
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru