CAS-005 · Question #472
An incident response analyst finds the following content inside of a log file that was collected from a compromised server: %б%90/90/./..<XML?......nty.......2308%6%678...whoami…
The correct answer is D. Improving file-parsing capabilities to stop external entities from executing commands. Improving file-parsing capabilities to prevent external entity processing (such as XML External Entity, XXE, attacks) stops malicious payloads embedded in files from executing commands, effectively preventing this type of compromise.
Question
An incident response analyst finds the following content inside of a log file that was collected from a compromised server:
%б%90/90/./..<XML?......nty.......2308%6%678...whoami..... su2032829%72%322///....../etc/passwd.... 2087031731%67%78%32... Which of the following is the best action to prevent future compromise?
Options
- ABlocking the processing of external files by forwarding them to another server for processing
- BImplementing an allow list for all text boxes throughout the web application
- CFiltering inserted characters for all user inputs and allowing only ASCII characters
- DImproving file-parsing capabilities to stop external entities from executing commands
How the community answered
(40 responses)- A10% (4)
- B5% (2)
- C5% (2)
- D80% (32)
Explanation
Improving file-parsing capabilities to prevent external entity processing (such as XML External Entity, XXE, attacks) stops malicious payloads embedded in files from executing commands, effectively preventing this type of compromise.
Community Discussion
No community discussion yet for this question.