Examkin

Soru

Zorluk: KolayNetwork Security Monitoring and Alerting

A security analyst reviews a network security monitoring alert generated by a Network Intrusion Detection System (NIDS). The alert log highlights the following HTTP GET parameter string:

`GET /login.php?username=admin'%20OR%20'1'='1'-- HTTP/1.1`

Which of the following best identifies the type of malicious activity captured in this alert?

  1. SQL injection attempt designed to bypass database authentication logicCevap
  2. B
    Cross-Site Scripting (XSS) attack injecting malicious JavaScript into the client browser
  3. C
    Honeypot failure where a deception system failed to block inline network traffic
  4. D
    Preventive control enforcement stopping unauthorized host network access

Cevap

SQL injection attempt designed to bypass database authentication logic
The URL-decoded string `admin' OR '1'='1'--` is a classic SQL injection payload. Attackers inject single quotes, boolean tautologies (like `'1'='1'`), and SQL comment flags (`--`) to force the backend database query to return true, bypassing authentication controls.

Adım Adım Çözüm

1
Analyze the HTTP GET request parameter string in the NIDS alert log.
Identified the payload string: username=admin'%20OR%20'1'='1'--
URL-decoded payload represents admin' OR '1'='1'--, which manipulates SQL query logic.
2
Evaluate the attack vector and security monitoring classification.
Matches SQL injection (SQLi) syntax targeting the application backend database.
SQLi uses single quotes, boolean OR statements, and comment characters to alter backend database behavior.

Anahtar Kavram

Identifying SQL Injection Indicators in Network Security Alerts
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru