Web Application Incidents

You are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Which THREE actions are essential when performing log review after a web application attack?

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?

A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?

Which log file should you examine if you suspect an attacker is modifying the web server configuration files?

Which TWO settings in a WAF policy are most effective at mitigating automated bot-driven web attacks?

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

Which TWO pieces of information must be collected to successfully track a session hijacking attack across multiple log sources?

Which THREE indicators in a web access log suggest a directory traversal attempt?

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Which THREE factors should be considered when tuning a WAF to reduce false positives for an application?

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

Which THREE items should be included in an incident report following a successful SQL injection attack?

During a web application incident, an analyst observes that an attacker is injecting malicious JavaScript into a comment field that is stored and later displayed to other users. Which type of web application incident is this?

A web application is experiencing an incident where an attacker is manipulating HTTP headers to bypass IP-based access controls. The attacker sets the X-Forwarded-For header to a trusted internal IP address. Which mitigation should an incident handler recommend to prevent this bypass?

While responding to a confirmed cross-site scripting (XSS) incident on a public web application, you need to determine whether the attacker exfiltrated session cookies. The application uses HTTPS and sets cookies without the HttpOnly flag. Which evidence source is MOST likely to reveal the stolen cookie values?

An incident responder is investigating a web application breach and needs to determine the exact time an attacker uploaded a web shell. Which log source would most directly provide this information?

During an incident involving a compromised e-commerce web application, you need to determine whether an attacker used a stolen session cookie to access a user's account. Which HTTP header should you examine first in the web server access logs to identify the session token used in the malicious requests?

During an incident involving a compromised web application, you review an Apache access.log entry that shows a request for /admin/config.php with a response code of 200, but the request originated from an external IP address never seen before. The application is configured to require authentication for that path. Which incident response action is MOST appropriate to determine the scope of the compromise?

An incident responder suspects a server-side request forgery (SSRF) incident against an internal web application that fetches remote images by URL. The application runs in a cloud VPC and can reach the instance metadata service. Which immediate containment action BEST reduces the risk of credential theft while preserving evidence?

During a web application incident, an analyst discovers that an attacker is using SQL injection to extract data from a backend database. Which SQL injection technique involves the attacker inferring data by asking the database true/false questions and observing the application's response?

A web application is experiencing an incident where attackers are injecting malicious JavaScript into stored user comments. The application reflects the input without proper sanitization. Which mitigation technique, when implemented correctly, is most effective at preventing this type of attack from executing in victims' browsers?

A web application is behind a reverse proxy that forwards client requests. During an incident, you need to identify the true source IP of an attacker who is sending malicious requests. The web server logs show the IP of the reverse proxy instead of the client. Which HTTP header should you inspect in the web server logs to find the original client IP?

You are handling a confirmed incident in which an attacker uploaded a web shell named 'image_thumb.php' to a public-facing Apache server running PHP. The file is being invoked repeatedly via HTTP POST requests. Which action should you take FIRST to contain the threat while preserving forensic evidence?

You are handling a web defacement incident on an internet-facing content management system. The page content was altered, and the attacker likely used a compromised administrative account. Which TWO artifacts should you collect FIRST to establish an accurate timeline and preserve evidence? (Choose two.)

A web application is under a distributed denial-of-service (DDoS) attack that is overwhelming the server with HTTP requests. As an incident handler, you need to identify the source of the attack and mitigate it. Which TWO log sources are most critical to analyze first to understand the attack pattern and its origin? (Choose two.)

During a web application incident, you discover that an attacker is exfiltrating data through HTTP responses by abusing a deserialization endpoint. The endpoint returns serialized objects that include base64-encoded fields. Which technique should you use to identify the exfiltrated data within captured network traffic?

A web application is experiencing a suspected cross-site scripting (XSS) incident. You are reviewing web server and application logs to identify the attack. Which TWO log sources are MOST likely to contain evidence of the XSS payload being submitted and executed? (Choose two.)

During a web application incident, you review logs and find requests containing the string 'UNION SELECT username, password FROM users' in the id parameter. The database server log shows the corresponding query executed successfully and returned rows. Which type of web application attack does this evidence confirm?

A web application is suspected of being compromised through a file inclusion vulnerability. The attacker has uploaded a web shell to the server. Which type of log should you examine to find evidence of the web shell being accessed and executed?

A web application is returning verbose error messages that include full stack traces and database query fragments to users. An attacker is using these messages to map the application's internal structure. Which remediation step should the incident handler recommend to the development team?

A web application is suspected of being compromised through a file inclusion vulnerability. The attacker used the vulnerability to read sensitive files on the server. Which web server log entry would provide the MOST direct evidence of the file inclusion attempt?

You are investigating a cross-site scripting incident on a customer-facing web application. The attacker injected a persistent payload that executes in the browsers of users viewing a product review page. Which TWO actions should you take to contain the incident and protect users while preserving evidence? (Choose two.)

During an incident involving a web application, you discover that an attacker has uploaded a web shell to the server. You need to determine how the attacker uploaded the file. Which log source would provide the MOST relevant information about the upload mechanism?

A web application incident has been confirmed, and the responder needs to determine whether the attacker accessed sensitive customer records through a vulnerable API endpoint. Which log source should be examined first to identify the specific API calls and parameters used?

During an investigation of a compromised e-commerce web application, you observe that the attacker sent a single HTTP request containing a serialized object in the 'cart' cookie. The application deserialized the data and subsequently spawned a shell process on the server. Which web application vulnerability was exploited?

A web application incident responder is investigating a suspected XML External Entity (XXE) attack. Which component of the web application is most likely to be the initial target of the attack?

A web application is experiencing a denial-of-service attack characterized by a flood of HTTP requests from a large number of distributed IP addresses. Which type of attack is this most likely to be?