CHFI Investigating Web Attacks 5

Question 1

A forensic investigator finds that attacker requests used chunked transfer encoding with abnormal chunk sizes. What might this indicate?

Accepted Answer

An attempt to evade WAF/IDS signature detection by obfuscating the payload

Answer

Attackers sometimes use chunked transfer encoding to split malicious payloads across chunks, evading WAF and IDS signatures that inspect full request bodies.

Question 2

During investigation, logs show the attacker's session cookie was identical across 20 different IP addresses. What attack scenario does this MOST likely indicate?

Accepted Answer

Session hijacking — the attacker stole and reused a victim's session token

Answer

A single session cookie appearing from multiple IPs indicates the attacker stole a legitimate session token and used it from different hosts or proxies.

Question 3

What is the forensic significance of finding `null bytes (%00)` in web server log entries?

Accepted Answer

They may be used to truncate file extensions or bypass input validation filters

Answer

Null byte injection (`%00`) was historically used to truncate strings in C-based languages, tricking the application into treating a file like `shell.php%00.jpg` as a PHP file.

Question 4

An analyst examining a compromised web server finds an `.htaccess` file modified to redirect all traffic to an external malicious site. What type of attack occurred?

Accepted Answer

Web server configuration tampering / malicious redirect

Answer

Modifying `.htaccess` to redirect visitors to a malicious site is a web defacement/compromise technique used after gaining write access to the server.

Question 5

Which forensic technique involves reviewing the `Last-Modified` and `ETag` HTTP response headers to establish a timeline of web content changes?

Accepted Answer

Cache-based temporal analysis

Answer

Cache-related headers like `Last-Modified` and `ETag` reflect when server-side content was last changed, helping investigators establish a timeline of modifications.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Investigating Web Attacks 5