CHFI - Computer Hacking Forensic Investigator Investigating Web Attacks Questions and Answers

Question 1

An investigator analyzing Apache access logs discovers the following entry: `89.163.146.13 - - [10/Mar/2026:14:32:54 +0000] "GET /products.php?id=105' OR '1'='1' -- HTTP/1.1" 500 294 "-" "SQLMap/1.5.11"`.
Which type of web attack is most strongly indicated by this log entry?

Accepted Answer

SQL Injection (SQLi)

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Denial of Service (DoS)

Question 2

A forensic analyst is investigating a compromised web server where the attacker is suspected of having uploaded a web shell. Which of the following is the MOST reliable indicator of a web shell's presence?

Accepted Answer

A script file in an uploads directory containing functions like `exec()`, `passthru()`, or `system()`.

Answer

An unusually large number of 404 'Not Found' errors in the access logs.

Answer

A sudden increase in outbound traffic from the web server on port 80.

Answer

A large image file (`.jpg`) with a recent modification timestamp.

Question 3

An investigator is reviewing IIS logs and finds multiple suspicious entries similar to this: `GET /pages/..%255c..%255c..%255cwindows/system32/cmd.exe?/c+dir`. This log entry is a clear indicator of which type of web attack?

Accepted Answer

Directory Traversal

Answer

Cross-Site Request Forgery (CSRF)

Answer

XML External Entity (XXE) Injection

Answer

SQL Injection (SQLi)

Question 4

A forensic investigator is analyzing web server access logs to profile an attacker's activity. What critical piece of information does the User-Agent string provide in a log entry?

Accepted Answer

The client software, browser, and operating system used to make the request.

Answer

The final HTTP status code of the server's response.

Answer

The client's IP address and port number.

Answer

The referring URL that led the client to the requested page.

Question 5

A company website that hosts a public comment forum has been compromised. An attacker posted a comment containing malicious JavaScript, which is now executing in the browsers of legitimate users who view the forum page, stealing their session cookies. This is a classic example of a Stored XSS attack. Where would an investigator most likely find the original malicious script payload?

Accepted Answer

Within the web application's database, stored as part of the attacker's forum comment.

Answer

Embedded within a modified JavaScript file in the web root directory.

Answer

In the server's error logs, triggered by failed script execution.

Answer

Exclusively in the volatile memory (RAM) of the web server.

Question 6

Which of the following forensic processes is most effective for identifying unauthorized modifications to critical system files on a web server, such as configuration files or core application scripts, after a compromise?

Accepted Answer

Comparing current file hashes against a previously established known-good baseline.

Answer

Analyzing network traffic captures for anomalous packets.

Answer

Reviewing user authentication logs for failed login attempts.

Answer

Scanning the server for common malware signatures using an antivirus tool.