CHFI Investigating Web Attacks 5 — Questions and Answers
Question 1: A forensic investigator finds that attacker requests used chunked transfer encoding with abnormal chunk sizes. What might this indicate?
- Normal CDN behavior
- An attempt to evade WAF/IDS signature detection by obfuscating the payload (Correct answer)
- A legitimate compression technique
- An HTTP/2 protocol upgrade
Correct answer: An attempt to evade WAF/IDS signature detection by obfuscating the payload
Attackers sometimes use chunked transfer encoding to split malicious payloads across chunks, evading WAF and IDS signatures that inspect full request bodies.
Question 2: During investigation, logs show the attacker's session cookie was identical across 20 different IP addresses. What attack scenario does this MOST likely indicate?
- Distributed brute-force attack
- Session hijacking — the attacker stole and reused a victim's session token (Correct answer)
- Cross-site request forgery
- Cookie poisoning by a rogue CDN node
Correct answer: Session hijacking — the attacker stole and reused a victim's session token
A single session cookie appearing from multiple IPs indicates the attacker stole a legitimate session token and used it from different hosts or proxies.
Question 3: What is the forensic significance of finding `null bytes (%00)` in web server log entries?
- They indicate compressed content
- They may be used to truncate file extensions or bypass input validation filters (Correct answer)
- They signal an encrypted payload
- They indicate the client browser version is outdated
Correct answer: They may be used to truncate file extensions or bypass input validation filters
Null byte injection (`%00`) was historically used to truncate strings in C-based languages, tricking the application into treating a file like `shell.php%00.jpg` as a PHP file.
Question 4: An analyst examining a compromised web server finds an `.htaccess` file modified to redirect all traffic to an external malicious site. What type of attack occurred?
- SQL injection
- Web server configuration tampering / malicious redirect (Correct answer)
- Denial of service
- DNS poisoning
Correct answer: Web server configuration tampering / malicious redirect
Modifying `.htaccess` to redirect visitors to a malicious site is a web defacement/compromise technique used after gaining write access to the server.
Question 5: Which forensic technique involves reviewing the `Last-Modified` and `ETag` HTTP response headers to establish a timeline of web content changes?
- Passive fingerprinting
- Cache-based temporal analysis (Correct answer)
- Fuzzing
- Deep packet inspection
Correct answer: Cache-based temporal analysis
Cache-related headers like `Last-Modified` and `ETag` reflect when server-side content was last changed, helping investigators establish a timeline of modifications.
Question 6: A web attack investigation reveals the server was sending `HTTP 301` redirects to users visiting certain pages. What should the forensic analyst check?
- TLS handshake logs
- Whether the redirect destination was altered by an attacker post-compromise (Correct answer)
- Database connection pool settings
- User-Agent string mismatches
Correct answer: Whether the redirect destination was altered by an attacker post-compromise
Attackers who gain server access sometimes inject 301 redirects in web configs or CMS settings to redirect users to phishing or malware delivery sites.
Question 7: In CHFI investigations of web attacks, what is the PRIMARY purpose of hashing web server log files upon collection?
- To compress the logs for storage efficiency
- To ensure the integrity of log evidence and detect any post-collection tampering (Correct answer)
- To encrypt the logs from unauthorized access
- To index the logs for faster searching
Correct answer: To ensure the integrity of log evidence and detect any post-collection tampering
Hashing log files (e.g., with SHA-256) at the time of collection creates a verifiable integrity record, proving the evidence has not been altered since acquisition.
CHFI Investigating Web Attacks 5
A forensic investigator finds that attacker requests used chunked transfer encoding with abnormal chunk sizes.
What might this indicate?