GIAC GPEN Exam - Topic 9 Question 54 Discussion

Actual exam question for GIAC's GPEN exam

Question #: 54
Topic #: 9

You work as a Computer Hacking Forensic Investigator for SecureNet Inc. You want to investigate Cross-Site Scripting attack on your company's Website. Which of the following methods of investigation can you use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

AReview the source of any HTML-formatted e-mail messages for embedded scripts or links in the URL to the company's site.

BLook at the Web servers logs and normal traffic logging.

CUse a Web proxy to view the Web server transactions in real time and investigate any communication with outside servers.

DUse Wireshark to capture traffic going to the server and then searching for the requests going to the input page, which may give log of the malicious traffic and the IP address of the source.

Show Suggested Answer

Suggested Answer: C

by Leslee at Aug 06, 2024, 09:14 AM

Limited Time Offer

25%

Off

Get Premium GPEN Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ceola

6 months ago

Wait, can Wireshark really pinpoint the source like that?

upvoted 0 times

...

Alline

6 months ago

D is a must for tracking down that malicious traffic!

upvoted 0 times

...

Chana

6 months ago

C sounds useful, but is it really necessary?

upvoted 0 times

...

Ty

7 months ago

A and B are solid choices!

upvoted 0 times

...

Mozell

7 months ago

Definitely check the web server logs!

upvoted 0 times

...

Rosita

7 months ago

Wireshark could definitely help capture traffic, but I wonder if it’s too complex for this specific scenario. I need to double-check my notes on that.

upvoted 0 times

...

Nieves

7 months ago

Using a web proxy sounds familiar, but I can't recall if it directly relates to XSS investigations. I might need to think that one through.

upvoted 0 times

...

Audra

8 months ago

I remember practicing with web server logs in a similar question; it seems like a solid method to track down suspicious activity.

upvoted 0 times

...

Lenora

8 months ago

I think reviewing the source of HTML emails could be useful, but I'm not entirely sure if it's the best first step for a Cross-Site Scripting attack.

upvoted 0 times

...

Cathrine

8 months ago

This question is testing our knowledge of web security and forensics. I think the key is to look for any suspicious activity or communication, whether that's in email, web server logs, or network traffic. Gotta be thorough to catch that cross-site scripting attack!

upvoted 0 times

...

Rosendo

8 months ago

Okay, I've got this. Reviewing email sources for embedded scripts, looking at web server logs, using a web proxy, and capturing traffic with Wireshark - those are all solid techniques to investigate a cross-site scripting attack. I feel confident I can apply these methods effectively.

upvoted 0 times

...

Rodolfo

8 months ago

Hmm, I'm a bit unsure about this one. I know cross-site scripting is a common web vulnerability, but I'm not super familiar with the forensic investigation process. I'll need to think through the different methods carefully to make sure I select the right ones.

upvoted 0 times

...

Raylene

8 months ago

This looks like a straightforward question on investigating a cross-site scripting attack. I think I can handle this - reviewing email sources, checking web server logs, and using a web proxy and Wireshark all seem like good approaches to identify the attack.

upvoted 0 times

...

Virgie

8 months ago

Ah, I know this topic well from my quality management course. A quality audit is all about identifying areas for improvement, so I'm pretty confident the right answer is B.

upvoted 0 times

...