CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The logs indicate a successful SQL injection attack

  Why it's wrong here

  A successful SQL injection would appear in logs as crafted SQL syntax within parameters, such as single quotes, UNION SELECT statements, OR 1=1 payloads, or time-based sleep functions, none of which appear in these URIs. Instead, the presence of a cmd parameter carrying operating-system-level commands indicates the attacker is invoking server-side command execution, not manipulating a database query. SQL injection targets the database layer, whereas cmd execution targets the underlying OS, and the log pattern here is unequivocally the latter.

• ✗

  The logs show a cross-site scripting (XSS) attack targeting administrators

  Why it's wrong here

  Cross-site scripting (XSS) is a client-side vulnerability: the attacker injects JavaScript or other script content that executes in a victim's browser, typically to steal cookies, session tokens, or perform actions on behalf of an authenticated administrator. The logs under investigation show server-side command execution via the cmd parameter, not scripted content reflected or stored for browser execution. Furthermore, the non-standard User-Agent and direct OS command invocations indicate a webshell channel, which is fundamentally different from XSS payloads that would appear in HTML/JavaScript form within HTTP parameters or response bodies.

• ✗

  The server is infected with ransomware, encrypting files

  Why it's wrong here

  Ransomware behavior is characterized by mass file encryption, changes to file extensions, and the deployment of a ransom note, none of which is visible in these logs. The cmd parameter and unusual User-Agent indicate an interactive, command-and-control style webshell session, where the attacker is executing arbitrary commands on the server, not an automated crypto-malware process. Ransomware would generate a distinct pattern of file I/O, encryption API calls, and a ransom demand, none of which is consistent with the URI command execution trail observed here.

• ✓

  A webshell is being used to execute commands on the server

  Why this is correct

  The logs indicate a webshell is in use because the HTTP requests contain a cmd parameter whose values are operating-system commands, a classic hallmark of server-side web shells such as China Chopper or b374k. The non-standard User-Agent further suggests a customized or automated attacker tool, and the consistent use of this parameter across requests shows persistent remote access. This behavior is the result of a command injection vulnerability, where the web application fails to sanitize user input before passing it to the system shell, allowing the attacker to execute arbitrary commands directly against the server.

Go deeper

Related to this question