Examkin

Soru

Zorluk: KolayLog Analysis and SIEM Management

A security analyst is reviewing web server access logs collected by a Security Information and Event Management (SIEM) system. The log stream displays the following entry:

`192.168.1.45 - - [27/Jul/2026:14:22:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452`

Which of the following attack types is directly indicated by this log entry?

  1. SQL injectionCevap
  2. B
    Cross-site scripting (XSS)
  3. C
    Broken authentication
  4. D
    SIEM correlation rule misconfiguration

Cevap

SQL injection
The correct answer is SQL injection because the HTTP GET query string contains explicit database command syntax (`UNION SELECT username,password FROM users--`). This indicates an attacker attempting to bypass application input controls to exfiltrate database records.

Adım Adım Çözüm

1
Examine the HTTP GET request parameter in the log snippet.
The string contains `id=1%20UNION%20SELECT%20username,password%20FROM%20users--`.
URL encoding (`%20` for space) conceals SQL keyword syntax used to append database query results.
2
Identify the target component and intent of the injected string.
The `UNION SELECT` construct attempts to query database user tables via an unvalidated web application input field.
Injecting database commands into application parameters to interact directly with backend data is the core characteristic of SQL injection.

Anahtar Kavram

Log Identification of Web Application Attacks
Tahmini Süre:45s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru