CHFI Investigating Web Attacks 2 — Questions and Answers
Question 1: During a web attack investigation, you find the string `' OR '1'='1` in server logs. What type of attack does this indicate?
- Cross-site scripting (XSS)
- SQL injection (Correct answer)
- Directory traversal
- Command injection
Correct answer: SQL injection
The string `' OR '1'='1` is a classic SQL injection payload used to bypass authentication by making a WHERE clause always evaluate to true.
Question 2: Which HTTP response code in web server logs most strongly indicates a successful directory traversal attack?
- 403 Forbidden
- 404 Not Found
- 200 OK with unexpected file content (Correct answer)
- 500 Internal Server Error
Correct answer: 200 OK with unexpected file content
A 200 OK response to a traversal-style request (e.g., `../../etc/passwd`) confirms the server served a file outside the web root.
Question 3: A forensic investigator notices repeated POST requests to `/wp-login.php` with hundreds of different passwords. What attack type is this?
- Credential stuffing
- Brute-force attack (Correct answer)
- Password spraying
- Dictionary attack
Correct answer: Brute-force attack
Repeated login attempts against a single account with many passwords characterizes a brute-force attack.
Question 4: What artifact would BEST help determine whether an attacker successfully exploited a web shell uploaded to a server?
- IDS alert timestamps
- Web server access logs showing GET/POST requests to the shell file (Correct answer)
- Firewall deny rules
- SSL certificate expiration dates
Correct answer: Web server access logs showing GET/POST requests to the shell file
Access log entries showing requests to the web shell file with resulting 200 responses confirm the shell was accessed and used.
Question 5: Which tool is primarily used by forensic analysts to reconstruct and replay HTTP sessions captured in a PCAP file?
- Volatility
- Wireshark's Follow TCP Stream (Correct answer)
- Autopsy
- Nessus
Correct answer: Wireshark's Follow TCP Stream
Wireshark's Follow TCP Stream feature allows analysts to reconstruct and review full HTTP conversations from packet captures.
Question 6: An attacker sends the payload `<img src=x onerror=alert(1)>` in a comment field that is rendered on a public page. This is an example of which XSS variant?
- Reflected XSS
- Stored XSS (Correct answer)
- DOM-based XSS
- Blind XSS
Correct answer: Stored XSS
Stored (persistent) XSS occurs when malicious script is saved to the server (e.g., a database) and later rendered to other users.
Question 7: In web attack forensics, what does the presence of `%2e%2e%2f` in a URL request indicate?
- Base64-encoded command injection
- URL-encoded directory traversal (`../`) (Correct answer)
- LDAP injection attempt
- XML entity injection
Correct answer: URL-encoded directory traversal (`../`)
`%2e%2e%2f` is the URL-encoded form of `../`, used in directory traversal attacks to escape the web root.
CHFI Investigating Web Attacks 2
During a web attack investigation, you find the string `' OR '1'='1` in server logs.
What type of attack does this indicate?