GCIA · Question #35
You work as a Computer Hacking Forensic Investigator for SecureNet Inc. You want to investigate Cross-Site Scripting attack on your company's Website. Which of the following methods of investigation…
The correct answer is A. Use a Web proxy to view the Web server transactions in real time and investigate any communication B. Review the source of any HTML-formatted e-mail messages for embedded scripts or links in the URL D. Look at the Web servers logs and normal traffic logging. XSS forensic investigation uses web proxies, server logs, and email source review to trace injected scripts - raw packet capture via Wireshark is insufficient for encrypted application-layer analysis.
Question
You work as a Computer Hacking Forensic Investigator for SecureNet Inc. You want to investigate Cross-Site Scripting attack on your company's Website. Which of the following methods of investigation can you use to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
Options
- AUse a Web proxy to view the Web server transactions in real time and investigate any communication
- BReview the source of any HTML-formatted e-mail messages for embedded scripts or links in the URL
- CUse Wireshark to capture traffic going to the server and then searching for the requests going to the
- DLook at the Web servers logs and normal traffic logging.
How the community answered
(26 responses)- A73% (19)
- C27% (7)
Why each option
XSS forensic investigation uses web proxies, server logs, and email source review to trace injected scripts - raw packet capture via Wireshark is insufficient for encrypted application-layer analysis.
A web proxy intercepts HTTP and HTTPS transactions at the application layer in real time, giving investigators full visibility into request parameters and server responses where XSS payloads are embedded.
XSS attacks can be delivered via HTML-formatted email containing embedded scripts or malicious URLs, so reviewing the raw source of such messages is a valid forensic technique to identify and trace attack vectors.
Wireshark operates at the network packet level and cannot decrypt HTTPS traffic without additional configuration, making it unable to read application-layer XSS payloads in encrypted web transactions - a significant limitation for web attack forensics.
Web server access logs record all incoming requests including query strings and referrer data, making them a primary artifact for identifying when and how XSS payloads were submitted to the server.
Concept tested: Cross-site scripting forensic investigation methods
Source: https://owasp.org/www-community/attacks/xss/
Topics
Community Discussion
No community discussion yet for this question.