CHFI Application, Email and Cloud Forensics Practice Question
An analyst finds the following string in an IIS log: %3Cscript%3Ealert('XSS')%3C/script%3E. What does this indicate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A cross-site scripting (XSS) attempt
The string is URL-encoded HTML/JavaScript (<script>alert('XSS')</script>). It is a typical cross-site scripting payload attempting to execute in a browser.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A cross-site scripting (XSS) attempt
Why this is correct
The string 3cscri is a signature of an XSS attempt because 3c is the hexadecimal encoding of the ASCII character '<', and 'scri' is the beginning of the word 'script'. When decoded, this represents the start of an HTML/JavaScript payload such as <script>, which would execute in a victim's browser. IIS logs often capture URL-encoded or hex-encoded characters, so this observed fragment strongly indicates cross-site scripting rather than any other web attack.
- ✗
A SQL injection attempt
Why it's wrong here
A SQL injection attempt would require SQL-specific syntax such as a single quote (') to break out of a query string, keywords like UNION, SELECT, or OR, or comment markers such as -- or #. The observed fragment 3cscri decodes to '<scr', which contains none of these SQL tokens or delimiters. SQL injection does not involve script tag characters, so this string is not evidence of a SQLi attack.
- ✗
A buffer overflow attempt
Why it's wrong here
A buffer overflow attempt typically manifests as an extremely long input or a binary payload containing a NOP sled (e.g., \x90\x90), return address overwrites, or hexadecimal shellcode, not a short text fragment like 3cscri. Here, 3cscri is only a few bytes and when decoded spells '<scr', which lacks the size and machine-code structure needed to corrupt memory. Therefore, this string is not characteristic of a buffer overflow exploit.
- ✗
A path traversal attempt
Why it's wrong here
Path traversal attacks rely on dot-dot-slash sequences such as ../ or ..\ in raw or percent-encoded form (e.g., %2e%2e%2f), which allow an attacker to climb directories. The string 3cscri decodes to '<scr', which does not contain any dot-dot-slash pattern or traversal-specific encoding. Since the fragment shows no directory-escaping structure, it cannot be classified as a path traversal attempt.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.