nerdexam
CompTIA

SY0-301 · Question #424

Which of the following was launched against a company based on the following IDS log? 122.41.15.252 - - [21/May/2012:00:17:20 +1200] "GET…

The correct answer is B. Buffer overflow attack. The IDS log shows an extremely long repeated character string passed as a username parameter, which is a classic indicator of a buffer overflow attack attempt.

Threats, vulnerabilities, and mitigations

Question

Which of the following was launched against a company based on the following IDS log? 122.41.15.252 - - [21/May/2012:00:17:20 +1200] "GET /index.php?username=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bin/forum/commentary.pl/noframes/read/209" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Hotbar 4.4.7.0)"

Options

  • ASQL injection
  • BBuffer overflow attack
  • CXSS attack
  • DOnline password crack

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    82% (18)
  • C
    9% (2)
  • D
    5% (1)

Why each option

The IDS log shows an extremely long repeated character string passed as a username parameter, which is a classic indicator of a buffer overflow attack attempt.

ASQL injection

SQL injection attacks use SQL syntax such as single quotes, UNION statements, or boolean logic in input fields, none of which appear in this log entry.

BBuffer overflow attackCorrect

A buffer overflow attack works by sending more data than a buffer can hold, overwriting adjacent memory. The log shows a username value consisting of an excessive number of 'A' characters far beyond any legitimate username length, which is the standard technique for probing or exploiting a buffer overflow vulnerability in the target application.

CXSS attack

Cross-site scripting attacks inject script tags or JavaScript into input fields to execute code in a victim's browser, which is not present in this log entry.

DOnline password crack

Online password cracking involves submitting many different password guesses, not a single request filled with a repeated character pattern.

Concept tested: Buffer overflow attack identification via IDS logs

Source: https://owasp.org/www-community/attacks/Buffer_overflow_attack

Topics

#buffer overflow#IDS logs#attack recognition#web application attacks

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice