CHFI Investigating Web Attacks 3

Question 1

A CHFI analyst is reviewing Apache logs and sees a User-Agent string containing `sqlmap/1.6`. What should the analyst conclude?

Accepted Answer

An automated SQL injection tool targeted the application

Answer

SQLMap is an open-source automated SQL injection tool, and its presence in the User-Agent field confirms it was used against the application.

Question 2

Which log file on a Linux Apache server would contain evidence of a PHP web shell being executed?

Accepted Answer

/var/log/apache2/error.log and access.log

Answer

Apache's access.log records every request including to uploaded PHP shells, while error.log may show PHP execution errors triggered by the attacker.

Question 3

During investigation of a web compromise, the analyst finds `/etc/passwd` content in a server response. Which vulnerability was likely exploited?

Accepted Answer

Local file inclusion (LFI)

Answer

Local File Inclusion (LFI) allows an attacker to read arbitrary files on the server, such as `/etc/passwd`, by manipulating file path parameters.

Question 4

What is the forensic significance of the `Referer` HTTP header found in web server logs?

Accepted Answer

It shows the URL from which the request originated, helping trace attack navigation paths

Answer

The Referer header shows what page or resource the request came from, helping investigators trace how an attacker navigated through an application.

Question 5

An investigator finds that an attacker used `UNION SELECT NULL, username, password FROM users--` in a web request. What is this technique called?

Accepted Answer

UNION-based SQL injection

Answer

UNION-based SQL injection appends a UNION SELECT statement to extract data from other database tables into the application's response.

CHFI - Computer Hacking Forensic Investigator Practice Test