CHFI Investigating Web Attacks 4

Question 1

During a web forensics investigation, an analyst discovers requests to `/admin/../../../etc/shadow`. What evasion technique is the attacker using?

Accepted Answer

Path traversal disguised within a valid-looking path

Answer

The attacker embeds `../` sequences within an apparently legitimate path to evade simple blacklist filters that only check the beginning of the URL.

Question 2

What does a `403 Forbidden` response to automated scanner requests in web logs typically indicate from a forensic perspective?

Accepted Answer

Access controls blocked the request, but the target resource exists

Answer

A 403 response means the server understood the request but refused it due to access controls, confirming the resource exists but was protected.

Question 3

Which field in an IIS web server log records the action method used in an HTTP request (GET, POST, PUT, etc.)?

Accepted Answer

cs-method

Answer

The `cs-method` field in IIS W3C logs records the HTTP method (verb) used in the client's request.

Question 4

An attacker injected `; ls -la` into a web form parameter that is passed to a system command. What type of attack is this?

Accepted Answer

OS command injection

Answer

OS command injection occurs when user-supplied input is incorporated into a system shell command, allowing the attacker to execute arbitrary OS commands.

Question 5

In a web attack investigation, what is the purpose of correlating web server logs with database query logs?

Accepted Answer

To match malicious HTTP requests with the actual database queries they generated

Answer

Correlating web and database logs links specific HTTP requests to the database queries they triggered, confirming whether an injection attack reached and affected the database.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Investigating Web Attacks 4