SY0-301 · Question #424
Which of the following was launched against a company based on the following IDS log? 122.41.15.252 - - [21/May/2012:00:17:20 +1200] "GET…
The correct answer is B. Buffer overflow attack. The IDS log shows an extremely long repeated character string passed as a username parameter, which is a classic indicator of a buffer overflow attack attempt.
Question
Which of the following was launched against a company based on the following IDS log? 122.41.15.252 - - [21/May/2012:00:17:20 +1200] "GET /index.php?username=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bin/forum/commentary.pl/noframes/read/209" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Hotbar 4.4.7.0)"
Options
- ASQL injection
- BBuffer overflow attack
- CXSS attack
- DOnline password crack
How the community answered
(22 responses)- A5% (1)
- B82% (18)
- C9% (2)
- D5% (1)
Why each option
The IDS log shows an extremely long repeated character string passed as a username parameter, which is a classic indicator of a buffer overflow attack attempt.
SQL injection attacks use SQL syntax such as single quotes, UNION statements, or boolean logic in input fields, none of which appear in this log entry.
A buffer overflow attack works by sending more data than a buffer can hold, overwriting adjacent memory. The log shows a username value consisting of an excessive number of 'A' characters far beyond any legitimate username length, which is the standard technique for probing or exploiting a buffer overflow vulnerability in the target application.
Cross-site scripting attacks inject script tags or JavaScript into input fields to execute code in a victim's browser, which is not present in this log entry.
Online password cracking involves submitting many different password guesses, not a single request filled with a repeated character pattern.
Concept tested: Buffer overflow attack identification via IDS logs
Source: https://owasp.org/www-community/attacks/Buffer_overflow_attack
Topics
Community Discussion
No community discussion yet for this question.