GCFA: GIAC Certified Forensic AnalystDemo

By GIAC · Question Mode

QuestionQ20

Enterprise Environment Incident Response

You are a Web developer at ABC Inc. and need to investigate a Cross-Site Scripting attack against your company’s Web site. Which of the following investigation methods can you use to accomplish this task?

Each correct answer represents a complete solution. Choose all that apply.

Choose four
  • A Review the source of any HTML-formatted e-mail messages for embedded scripts or links in the URL to the company's site.
  • B Look at the Web server's logs and normal traffic logging.
  • C Use Wireshark to capture traffic going to the server and then searching for the requests going to the input page, which may give log of the malicious traffic and the IP address of the source.
  • D Use a Web proxy to view the Web server transactions in real time and investigate any communication with outside servers.
Explanation

XSS payloads are commonly delivered through crafted links and untrusted input, so reviewing HTML email source, web-server logs, packet captures, and live HTTP proxy transactions can each reveal malicious requests, injected script content, source IP information, or outbound communication to attacker-controlled systems. OWASP guidance supports examining HTTP requests and responses with proxies or traffic monitoring and reviewing web-server logs for evidence of attacks.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!