CAS-003 · Question #296
A security analyst sees some suspicious entries in a log file from a web server website, which has a form that allows customers to leave feedback on the company's products. The analyst believes a…
The correct answer is A. SQL injection. The log entries from the web feedback form most likely indicate SQL injection scanning. SQL injection attacks manipulate database queries by inserting SQL metacharacters and syntax (e.g., single quotes, OR 1=1, UNION SELECT statements) into form fields. A malicious actor…
Question
A security analyst sees some suspicious entries in a log file from a web server website, which has a form that allows customers to leave feedback on the company’s products. The analyst believes a malicious actor is scanning the web form. To know which security controls to put in place, the analyst first needs to determine the type of activity occurring to design a control. Given the log below:
Which of the following is the MOST likely type of activity occurring?
Exhibit
Options
- ASQL injection
- BXSS scanning
- CFuzzing
- DBrute forcing
How the community answered
(29 responses)- A66% (19)
- B10% (3)
- C17% (5)
- D7% (2)
Explanation
The log entries from the web feedback form most likely indicate SQL injection scanning. SQL injection attacks manipulate database queries by inserting SQL metacharacters and syntax (e.g., single quotes, OR 1=1, UNION SELECT statements) into form fields. A malicious actor probing a web form for SQL injection would generate log entries showing these patterns in submitted input. Option B (XSS scanning) would show JavaScript injection attempts like <script> tags. Option C (fuzzing) involves sending large volumes of random or malformed data to find crashes, producing a different pattern. Option D (brute forcing) involves repeated authentication attempts with credential combinations, which applies to login forms, not feedback forms.
Topics
Community Discussion
No community discussion yet for this question.