300-215 Question 180
Single answerYou are investigating a suspected SQL injection attack on a web application hosted on an NGINX server. During your forensic analysis, you examine the access logs and notice the following entry:
192.168.1.10 - - [10/Oct/2023:14:32:10 +0000] "GET /product?id=105%20OR%201=1 HTTP/1.1" 200 512 "-" "Mozilla/5.0"
What is the most appropriate next step to confirm and analyze this potential attack?
- A
Review the application error logs for SQL-related errors corresponding to the timeframe of the request.
- B
Block the IP address 192.168.1.10 in the NGINX configuration to prevent further attacks.
- C
Inspect the database logs for unusual queries or errors that match the timestamp in the access log.
- D
Immediately update the web application firewall (WAF) rules to block SQL injection attempts.
Show answer and explanation
Correct answer: A
Explanation
The access log entry suggests a potential SQL injection attempt due to the suspicious 'OR 1=1' condition in the request URL. The most effective action to confirm the attack is to review application error logs for any SQL-related errors or anomalies that occurred at the same time. This will help determine if the attack succeeded and allow for further investigation.
- A. Correct.
Reviewing the application error logs can provide evidence of SQL injection attempts by identifying corresponding database errors or unexpected application behavior.
- B. Incorrect.
Blocking the IP address 192.168.1.10 is premature without confirming the attack, as the IP could belong to a legitimate user whose request was manipulated.
- C. Incorrect.
Inspecting the database logs may be useful later in the investigation but does not address the immediate need to confirm the attack by analyzing application behavior.
- D. Incorrect.
Updating WAF rules is a preventative step but does not help in analyzing whether the attack occurred or what its impact might have been.