CHFI Investigating Web Attacks 2

Question 1

During a web attack investigation, you find the string `' OR '1'='1` in server logs. What type of attack does this indicate?

Accepted Answer

SQL injection

Answer

The string `' OR '1'='1` is a classic SQL injection payload used to bypass authentication by making a WHERE clause always evaluate to true.

Question 2

Which HTTP response code in web server logs most strongly indicates a successful directory traversal attack?

Accepted Answer

200 OK with unexpected file content

Answer

A 200 OK response to a traversal-style request (e.g., `../../etc/passwd`) confirms the server served a file outside the web root.

Question 3

A forensic investigator notices repeated POST requests to `/wp-login.php` with hundreds of different passwords. What attack type is this?

Accepted Answer

Brute-force attack

Answer

Repeated login attempts against a single account with many passwords characterizes a brute-force attack.

Question 4

What artifact would BEST help determine whether an attacker successfully exploited a web shell uploaded to a server?

Accepted Answer

Web server access logs showing GET/POST requests to the shell file

Answer

Access log entries showing requests to the web shell file with resulting 200 responses confirm the shell was accessed and used.

Question 5

Which tool is primarily used by forensic analysts to reconstruct and replay HTTP sessions captured in a PCAP file?

Accepted Answer

Wireshark's Follow TCP Stream

Answer

Wireshark's Follow TCP Stream feature allows analysts to reconstruct and review full HTTP conversations from packet captures.

CHFI - Computer Hacking Forensic Investigator Practice Test