CHFI Application, Email and Cloud Forensics Practice Question

During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?

⚠ Common exam trap

Test-takers frequently confuse the 'UNION SELECT' syntax with a path traversal or RFI attack because they see a URL parameter with special characters, but the key indicator is the SQL-specific command structure, not file paths or remote URLs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SQL injection (SQLi)

The log entry shows a UNION-based SQL injection attempt, where the attacker appends 'UNION SELECT username, password FROM users--' to the 'id' parameter in the GET request. This manipulates the original SQL query to return sensitive data from the 'users' table, which is the hallmark of SQL injection (SQLi). The HTTP 200 response indicates the query executed successfully, confirming the attack vector.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting would require the injected payload to be client-side script such as <script>alert(1)</script> or an event handler like onerror=...; the log entry instead contains SQL keywords (UNION, SELECT) and a double-dash comment token. XSS executes in a victim's browser and affects the user session, whereas the observed parameter value is designed to manipulate the database query itself. The presence of SQL syntax in the id parameter, not markup or JavaScript, rules out XSS.
✓
SQL injection (SQLi)
Why this is correct
The GET request to the id parameter with ' UNION SELECT username,password FROM users -- is a textbook UNION-based SQL injection payload. The single quote closes the original SQL string, UNION SELECT appends attacker-controlled columns to the result set, and the '--' comment sequence comments out the remainder of the original WHERE clause so the query executes exactly as the attacker intends. This causes the application's database to return records (e.g., credentials) that should never be exposed, making SQL injection the correct classification.
✗
Path traversal
Why it's wrong here
Path traversal attacks manipulate file path references using traversal sequences such as ../../etc/passwd or encoded variants (%2e%2e%2f) to make the application read or include files outside its intended directory. The captured log shows no dot-dot-slash constructs and no file system path; instead, it contains SQL tokens like UNION and SELECT inside the id parameter. These tokens alter database query logic rather than directory resolution, so the artifact is inconsistent with path traversal.
✗
Remote file inclusion (RFI)
Why it's wrong here
Remote file inclusion occurs when an application dynamically includes a file from a URL, commonly seen as parameter values like http://attacker.com/shell.txt or data:// payloads in PHP applications. The log entry's id parameter contains a SQL query fragment, not a URL or file path, meaning the attacker is not trying to load an external resource into server-side code. RFI would leave artifacts of HTTP requests to external hosts or include statements in logs, neither of which appears here.

Go deeper

CHFI Application, Email and Cloud Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question