CAS-001 · Question #140
An administrator is reviewing logs and sees the following entry: Message: Access denied with code 403 (phase 2). Pattern match "\bunion\b.{1,100}?\bselect\b" at ARGS:$id. [data "union all select"]…
The correct answer is C. SQL injection. The log entry clearly shows a SQL injection attempt. The pattern 'UNION ALL SELECT' is a canonical SQL injection technique known as a UNION-based SQL injection, where an attacker appends a UNION SELECT statement to an existing query to retrieve data from other database tables…
Question
An administrator is reviewing logs and sees the following entry:
Message: Access denied with code 403 (phase 2). Pattern match "\bunion\b.{1,100}?\bselect\b" at ARGS:$id. [data "union all select"] [severity "CRITICAL"] [tag "WEB_ATTACK"] [tag "WASCTC/WASC- 19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] Action: Intercepted (phase 2) Apache-Handler: php5-script Which of the following attacks was being attempted?
Options
- ASession hijacking
- BCross-site script
- CSQL injection
- DBuffer overflow
How the community answered
(38 responses)- A8% (3)
- B3% (1)
- C87% (33)
- D3% (1)
Explanation
The log entry clearly shows a SQL injection attempt. The pattern 'UNION ALL SELECT' is a canonical SQL injection technique known as a UNION-based SQL injection, where an attacker appends a UNION SELECT statement to an existing query to retrieve data from other database tables. The WAF (Web Application Firewall) rule matched the regex pattern for 'union...select' in the HTTP request argument '$id', tagged it as OWASP Top 10 A1 (Injection), WASC-19 (SQL Injection), and blocked it with a 403 response. Option A (session hijacking) involves stealing or forging session tokens. Option B (XSS) involves injecting client-side scripts. Option D (buffer overflow) involves sending excessive input to overwrite memory - none of which match the UNION SELECT pattern observed in the log.
Topics
Community Discussion
No community discussion yet for this question.