300-215 Question 183
Select 3During an incident response investigation, you are tasked with analyzing access logs from an NGINX server. The logs contain a series of HTTP 404 error codes accompanied by suspicious User-Agent strings. Which log entries would most likely indicate an attempted directory traversal attack?
- A
GET /../../etc/passwd HTTP/1.1 - 404 - User-Agent: MaliciousScanner/1.0
- B
GET /admin/login.php HTTP/1.1 - 200 - User-Agent: Mozilla/5.0
- C
GET /%2e%2e/%2e%2e/etc/passwd HTTP/1.1 - 404 - User-Agent: CustomBot/2.1
- D
GET /index.html HTTP/1.1 - 200 - User-Agent: Mozilla/5.0
- E
GET /wp-admin/../../config.php HTTP/1.1 - 404 - User-Agent: SuspiciousCrawler/3.3
Show answer and explanation
Correct answers: A, C, E
Explanation
Directory traversal attacks aim to access restricted files or directories on a server by manipulating the file path in the URL. In NGINX logs, such attempts are often identified by patterns like '../' or their URL-encoded equivalents ('%2e%2e'). HTTP 404 status codes in these cases usually indicate that the server blocked the malicious attempt. The correct answers highlight log entries exhibiting these characteristics.
- A. Correct.
This log entry includes a clear directory traversal attempt using '../' to access the /etc/passwd file, which is a common target in attacks. The 404 status indicates the attempt failed due to server restrictions.
- B. Incorrect.
This log entry shows a legitimate request to a login page with an HTTP 200 status, indicating successful access. It does not suggest malicious activity.
- C. Correct.
This log entry contains a URL-encoded directory traversal attempt ('%2e%2e' is the URL-encoded form of '../'), aimed at accessing /etc/passwd. The 404 status highlights that the attempt was blocked.
- D. Incorrect.
This log entry represents a standard access to an index page with a 200 status, indicating successful and legitimate access. No malicious activity is present.
- E. Correct.
This log entry includes a directory traversal attempt to access 'config.php' through '../', which is a common technique to exploit vulnerabilities. The 404 status suggests the attempt was unsuccessful.