Welcome to the CHFI Digital Forensics Simulation. This exercise will test your ability to examine network traffic and identify the most probable locations for web application attack vectors. Analyze the PCAP evidence and determine the correct HTTP field.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are a digital forensics investigator in Austin, Texas, tasked with analyzing a potential data breach at an e-commerce company. The database administrator reported an anomalous spike in malformed SQL queries resulting in excessive data extraction over a 30-minute window.

You have acquired a full packet capture (PCAP) from the network sensor positioned in front of the web application firewall. You must pinpoint how the malicious SQL commands were injected into the web application traffic.

Evidence Collected

Extraction of HTTP streams from the PCAP reveals the following anomalous requests targeting the backend database:

[STREAM 1042] GET /catalog/item.php?id=12%20UNION%20SELECT%20username,%20password%20FROM%20admin_users-- HTTP/1.1 Host: www.target-ecommerce.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Referer: https://www.target-ecommerce.com/catalog [STREAM 1089] POST /login/authenticate.php HTTP/1.1 Host: www.target-ecommerce.com Content-Type: application/x-www-form-urlencoded Content-Length: 48 user=admin'%20OR%20'1'='1&pass=randomtext

Question

In a network-forensics investigation, an analyst is analyzing traffic to identify a potential "SQL Injection" attack. Which field in the HTTP request is most likely to contain the malicious SQL code?

Forensic Hint: Review the PCAP stream snippets. Look for where user input (like product IDs or login credentials) is traditionally passed from the browser to the web server to be processed by a database.

Expert Analysis

1. What the Evidence Shows

The PCAP HTTP streams clearly display malicious SQL syntax URL-encoded in two distinct locations: as a parameter in a GET request URI (?id=12 UNION SELECT...) and within the message body of a POST request (user=admin' OR '1'='1).

2. Forensic Stage

Examination and Analysis. The network traffic has already been preserved and collected. The analyst is now parsing the HTTP protocol fields to locate the specific attack payload.

3. Why the Correct Answer is Correct

A. URL query parameters or POST data: This is the primary and most common vector for SQL injection. Web applications inherently take input from URL parameters (in GET requests) and form data (in POST requests) and pass these variables directly to backend database queries. Attackers manipulate these direct input fields to execute arbitrary SQL commands.

4. Why Others are Wrong

While an attacker could inject SQL into headers if the application logs them to a database improperly (a second-order SQL injection), they are not the most likely vectors:

B. User-Agent header: Usually identifies the client's browser. While sometimes logged, it's rarely used to build dynamic application queries.

C. Referer header: Indicates the previous web page. Again, primarily used for analytics, not direct application logic.

D. Cookie header: Used for session management. While cookie poisoning exists, standard form fields and URL parameters present a far wider and more direct attack surface.

5. Real-World Forensic Action

A forensic analyst would utilize tools like Wireshark or tshark to apply display filters (e.g., http.request.uri matches "(?i)union|select|drop") across the PCAP. They would then correlate the malicious requests with the corresponding HTTP responses to determine if the server returned an HTTP 500 Error (indicating a failed injection) or an HTTP 200 OK with abnormally large data payloads (indicating a successful exfiltration).

MINI LESSON: HTTP Artifact Interpretation

  • GET vs POST: In a GET request, the parameters are visible in the URI string (e.g., /page?var=payload). In a POST request, the URI is clean, and the parameters are found in the HTTP message body.
  • URL Encoding: Attack payloads in network traffic are rarely plain text. Investigators must recognize URL encoding (e.g., %20 for space, %27 for a single quote ') when scanning raw packet captures.
  • Network Evidence: PCAPs provide absolute ground truth of an attack, bypassing the possibility of the attacker having tampered with local web server or database logs.

Ready for more real-world forensics challenges?

Sharpen your analytical skills with full CHFI practice exams.

Explore more CHFI simulations