WorksheetsCHFI v9 - Module 8 Investigating Web Attacks
Total questions: 20
Worksheet time: 10mins
1. A Network Administrator suspects that there has been an illegal entry into a shared file. What command would he use to check file shares:
C:\> net view <IP address>
C:\ > net session
C:\> net use
C:\ > nbtstat -S
Where do you look to verify users using open shares?
C:\> net view <IP address>
C:\ > net session
C:\> net use
C:\ > nbtstat -S
If I need to check if TCP and UDP ports have unusual listening, I would use the command:
C:\> net view <IP address>
C:\ > netstat -na
C:\> net use
C:\ > nbtstat -S
A Network Admin finds that an unusual session was opened with other systems. What command did he use to find this?
C:\> net view <IP address>
C:\ > netstat -na
C:\> net use
C:\ > nbtstat -S
If you wish to Analyze NetBIOS over TCP/IP activity, you would use this command?
C:\> net view <IP address>
C:\ > netstat -na
C:\> net use
C:\ > nbtstat -S
An Admin found that new accounts were being created in the system. Where did he find this information?
C:\> lusrmgr.msc
C:\> net start
C:\> dir
C:\> Admin
Internet Information Services (IIS) for Windows server can host anything on the web.
True
False
An attack vector is a pathway or means by which an attacker can gain access to a computer or network in order to deliver an attack or cause a malicious outcome.
True
False
A Network Administrator finds that some of the companies web applications are vulnerable to SQL attacks that are allowing untrusted data to be interpreted and executed by command or query. This is known as what type of flaw?
Injection
SQL
IIS violation
Intrusion
Intrusion detection is the art of detecting appropriate activity.
True
False
An administrator finds that there are some suspicious activities occurring in their Network. What should they look at in order to determine if there is a problem and to gather artifacts if there is?
Master files
Network files
Logs
System events
How many layers are there to Web Application Architecture?
2
1
5
4
Which of the following steps is not part of investigating a Web attack?
Confirmation of the Attack and Identification of its Nature
Capturing Volatile Data
Understanding the Flow of an Application
Identifying the intruder
Analysis of the Log Files
When you are investigating a Windows-Based Server attack, you look here to see if there has been any type of breach:
C:\> event.exe
C:\> eventvwr.msc
C:\> tskmgr.msc
C:\> eventvwr.exe
Choose which of the following is an example of an IIS Windows Server 2012 log file:
%SystemDrive/inetpub/logs/LogFiLes
%SystemDrive\inetpub\logs\LogFiLes
%SystemDrive/ logs/inetpub/LogFiLes
%SystemDrive/inetpub/logs/ASCIIFiLes
UTC is the universal time set for all computers. IIS records logs using UTC
True
False
If a network administrator sets the server’s time zone to UTC -06:00, then the first log entries should appear around what time?
14:00 (00:00-04:00 = 14:00)
06:00 (00:00-18:00 = 06:00)
12:00 (00:00-06:00 = 18:00)
18:00 (00:00-06:00 = 18:00)
You would check the following area for an Apache configuration file to find the exact location of the log files: (check all that apply)
REHEL/Red Hat/CentOS/Fedora Linux: /usr/local/etc/apache22/httpd.conf
Debian/Ubuntu Linux: /etc/apache2/apache2.conf
FreeBSD: etc/httpd/conf/https.conf
WIN10: etc/httpd/apache/https.conf
Ubuntu Linux: /etc/usr/local/apache2.conf
An example of an Apache access log file entry, as viewed in a text editor:
10.10.10.10 – [17/Aug/2016:00:12:34 +0300] “Get /images/content/bg_body_1.jpg HTTP/1.0” 500 1458
10.10.10 – Jason [17/Aug/2020:00:10:34 +0300] “Get /images/content/bg_body_1.jpg HTTP/1.0” 500 1458
10.10.10.10 – Jason [17/Aug/2016:00:12:34 +0300] “Get /images/content/bg_body_1.jpg HTTP/1.0” 500 1458
10.10.10.10 – Jason [17/Aug/2016:00:12:34 +0300] “Usr /images/content/bg_body_1.jpg HTTP/1.0” 500 1458
Common XSS attacks use HTML tags, such as <script></script>, <IMG>, <INPUT>, <BODY>, etc. These are considered to be which type of attack?
Apache
IIS
WIN Server
Cross-Site Scripting
