CHFI Investigating Web Attacks 4 — Questions and Answers
Question 1: During a web forensics investigation, an analyst discovers requests to `/admin/../../../etc/shadow`. What evasion technique is the attacker using?
- Parameter pollution
- Path traversal with null byte injection
- Path traversal disguised within a valid-looking path (Correct answer)
- HTTP verb tampering
Correct answer: Path traversal disguised within a valid-looking path
The attacker embeds `../` sequences within an apparently legitimate path to evade simple blacklist filters that only check the beginning of the URL.
Question 2: What does a `403 Forbidden` response to automated scanner requests in web logs typically indicate from a forensic perspective?
- The attack succeeded and the attacker retreated
- Access controls blocked the request, but the target resource exists (Correct answer)
- The server crashed due to the request
- The request was silently logged and discarded
Correct answer: Access controls blocked the request, but the target resource exists
A 403 response means the server understood the request but refused it due to access controls, confirming the resource exists but was protected.
Question 3: Which field in an IIS web server log records the action method used in an HTTP request (GET, POST, PUT, etc.)?
- cs-uri-stem
- cs-method (Correct answer)
- sc-status
- cs-bytes
Correct answer: cs-method
The `cs-method` field in IIS W3C logs records the HTTP method (verb) used in the client's request.
Question 4: An attacker injected `; ls -la` into a web form parameter that is passed to a system command. What type of attack is this?
- SQL injection
- LDAP injection
- OS command injection (Correct answer)
- XML injection
Correct answer: OS command injection
OS command injection occurs when user-supplied input is incorporated into a system shell command, allowing the attacker to execute arbitrary OS commands.
Question 5: In a web attack investigation, what is the purpose of correlating web server logs with database query logs?
- To verify SSL certificate validity
- To match malicious HTTP requests with the actual database queries they generated (Correct answer)
- To measure page load performance
- To identify legitimate user session cookies
Correct answer: To match malicious HTTP requests with the actual database queries they generated
Correlating web and database logs links specific HTTP requests to the database queries they triggered, confirming whether an injection attack reached and affected the database.
Question 6: A forensic analyst finds that an attacker sent an HTTP request with the header `X-Forwarded-For: 127.0.0.1`. What was the attacker trying to achieve?
- Exploit an open redirect vulnerability
- Spoof the source IP to appear as localhost and bypass IP-based access controls (Correct answer)
- Inject JavaScript into the response
- Escalate HTTP to HTTPS
Correct answer: Spoof the source IP to appear as localhost and bypass IP-based access controls
By forging the `X-Forwarded-For` header to `127.0.0.1`, attackers attempt to trick applications into treating the request as coming from localhost, bypassing IP allowlists.
Question 7: Which OWASP tool is specifically designed for intercepting and modifying HTTP/HTTPS traffic during web application security testing and forensic analysis?
- OpenVAS
- OWASP ZAP (Zed Attack Proxy) (Correct answer)
- Metasploit
- Maltego
Correct answer: OWASP ZAP (Zed Attack Proxy)
OWASP ZAP is an open-source web proxy tool used to intercept, inspect, and modify HTTP/HTTPS traffic for security testing and forensic purposes.
CHFI Investigating Web Attacks 4
During a web forensics investigation, an analyst discovers requests to `/admin/../../../etc/shadow`.
What evasion technique is the attacker using?