CHFI Investigating Web Attacks 3 — Questions and Answers
Question 1: A CHFI analyst is reviewing Apache logs and sees a User-Agent string containing `sqlmap/1.6`. What should the analyst conclude?
- A vulnerability scanner performed a general audit
- An automated SQL injection tool targeted the application (Correct answer)
- A legitimate SEO crawler indexed the site
- A DDoS bot flooded the server
Correct answer: An automated SQL injection tool targeted the application
SQLMap is an open-source automated SQL injection tool, and its presence in the User-Agent field confirms it was used against the application.
Question 2: Which log file on a Linux Apache server would contain evidence of a PHP web shell being executed?
- /var/log/auth.log
- /var/log/apache2/error.log and access.log (Correct answer)
- /var/log/syslog
- /var/log/kern.log
Correct answer: /var/log/apache2/error.log and access.log
Apache's access.log records every request including to uploaded PHP shells, while error.log may show PHP execution errors triggered by the attacker.
Question 3: During investigation of a web compromise, the analyst finds `/etc/passwd` content in a server response. Which vulnerability was likely exploited?
- Cross-site request forgery (CSRF)
- Local file inclusion (LFI) (Correct answer)
- Open redirect
- Insecure deserialization
Correct answer: Local file inclusion (LFI)
Local File Inclusion (LFI) allows an attacker to read arbitrary files on the server, such as `/etc/passwd`, by manipulating file path parameters.
Question 4: What is the forensic significance of the `Referer` HTTP header found in web server logs?
- It identifies the server-side programming language used
- It shows the URL from which the request originated, helping trace attack navigation paths (Correct answer)
- It records the attacker's operating system
- It specifies the encryption cipher used in the connection
Correct answer: It shows the URL from which the request originated, helping trace attack navigation paths
The Referer header shows what page or resource the request came from, helping investigators trace how an attacker navigated through an application.
Question 5: An investigator finds that an attacker used `UNION SELECT NULL, username, password FROM users--` in a web request. What is this technique called?
- Blind SQL injection
- UNION-based SQL injection (Correct answer)
- Error-based SQL injection
- Time-based SQL injection
Correct answer: UNION-based SQL injection
UNION-based SQL injection appends a UNION SELECT statement to extract data from other database tables into the application's response.
Question 6: Which forensic artifact is MOST useful for identifying the geographic origin of a web attack?
- HTTP response headers
- Source IP address in access logs correlated with GeoIP databases (Correct answer)
- TLS session tickets
- Cookie values
Correct answer: Source IP address in access logs correlated with GeoIP databases
The source IP address recorded in access logs can be queried against GeoIP databases to approximate the attacker's geographic location.
Question 7: A web application firewall (WAF) log shows a block event for a request containing `SLEEP(5)` in a parameter. What attack technique was attempted?
- Reflected XSS
- Time-based blind SQL injection (Correct answer)
- HTTP response splitting
- Remote file inclusion
Correct answer: Time-based blind SQL injection
Time-based blind SQL injection uses functions like `SLEEP()` to cause database delays, inferring information based on response time when no data is returned directly.
CHFI Investigating Web Attacks 3
A CHFI analyst is reviewing Apache logs and sees a User-Agent string containing `sqlmap/1.6`.
What should the analyst conclude?