GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ625

Web Application Injection Attacks

During the identification phase of a Web server compromise, you observe the following entries in the web server logs. If "admin" is a valid username but its associated password is not "pass1," and "root" is not a valid username, what can be inferred solely from these logs?

Question Image

  • A This is a web spidering attack using wget
  • B This is an account harvesting attack
  • C This is a session hijacking attack
  • D This is a password brute-forcing attack
Explanation

Different application responses for valid and invalid usernames reveal whether an account exists even when the supplied password is incorrect. Trying many usernames with the same password and using those distinguishable responses is account harvesting (username enumeration).

Community Discussion

No comments yet. Be the first to start the discussion!