Digital Forensics · Topic 7 of 11
Wireless and Web Application Attack Investigation
Investigate Wi-Fi weaknesses, rogue access points, jamming, XSS, SQL injection, traversal, command injection, XXE and cookie poisoning, for CHFI v11.
- 6 min
- WEP is broken. WPA2 handshakes allow offline guessing. WPA3 uses SAE.
- Rogue AP detection compares BSSID, OUI and settings with the authorized list.
- Jamming shows a high noise floor. A deauth flood shows many deauthentication frames.
What it is
Wireless networks and web applications are two of the most common entry points. Both leave evidence, in radio frames for Wi-Fi and in web server logs for applications.
This page covers wireless weaknesses and rogue devices, how to capture wireless traffic, and how each web attack in the outline appears in logs.
How it works
Wireless network security vulnerabilities
| Weakness | Why it matters |
|---|---|
| WEP | RC4 with a short initialization vector, broken within minutes |
| WPA with TKIP | Legacy, with known weaknesses |
| WPA2 Personal | Strong with AES-CCMP, but a captured 4-way handshake allows offline password guessing |
| WPA3 | Uses SAE, which resists offline guessing |
| WPS | PIN based setup can be guessed |
| Open networks | No encryption, easy to eavesdrop |
| Management frames | Deauthentication frames are unauthenticated unless 802.11w (protected management frames) is used |
| Default settings | Default passwords, SSIDs and open management interfaces |
Performing attack and vulnerability monitoring
Monitoring means watching the radio environment, not only the wired network. A wireless IDS or IPS compares what it hears with a list of authorized access points and flags differences.
Tools include Kismet and the Aircrack-ng suite (airodump-ng lists access points and clients) with a card in monitor mode, plus spectrum analyzers for interference. Monitor mode passes all 802.11 frames to the capture tool, unlike a normal client connection.
Rogue access points and MAC spoofing
A rogue AP is an unauthorized access point connected to the corporate network. An evil twin copies the SSID of a real network so users connect to the attacker. AP MAC spoofing copies a real access point's BSSID.
| Check | Finding |
|---|---|
| Compare BSSID and SSID with the authorized list | Unknown device |
| Vendor part (OUI) of the MAC | Does not match approved hardware |
| Channel, signal strength, beacon interval, security settings | Differ from the real AP with the same BSSID |
| Switch port and MAC address table | An unapproved device on a wired port |
| Two sources of the same BSSID | Possible spoofing |
Misconfigured, honeypot and jamming
A misconfigured AP has default credentials, weak or no encryption, WPS enabled or open management access. A honeypot AP advertises an attractive open SSID (such as free Wi-Fi) to lure users and capture their traffic. It looks like an evil twin from the client side.
Jamming denies service by flooding the radio channel with noise. A related attack, the deauthentication flood, sends many forged deauth frames. Signs are a high noise floor on a spectrum analyzer, a spike in retries, clients repeatedly dropped, and in captures many frames with wlan.fc.type_subtype == 0x0c (deauthentication).
Investigate wireless network traffic
Capture in monitor mode, on the right channel, and save the file with a hash. Encrypted traffic can be decrypted in Wireshark only if you have the key and captured the 4-way handshake (eapol filter). Useful filters: wlan.fc.type_subtype == 0x08 for beacons, eapol for handshakes and wlan.addr == aa:bb:cc:dd:ee:ff for one device. The capture shows which clients connected, to which BSSID, and when.
XSS, SQL injection and directory traversal
Web server access logs record the request line, status code and source. Common locations are /var/log/apache2/access.log, /var/log/nginx/access.log and C:\inetpub\logs\LogFiles\ for IIS.
| Attack | What appears in the request |
|---|---|
| Cross site scripting (XSS) | <script>, onerror=, or URL encoded forms such as %3Cscript%3E in parameters |
| SQL injection | ', OR 1=1, UNION SELECT, --, time delay functions, followed by error or 500 responses |
| Directory traversal | ../ or encoded %2e%2e%2f to reach files like /etc/passwd or win.ini |
The status code and response size help decide whether it worked. A 200 response with an unusually large size after a UNION SELECT suggests data was returned.
Command injection, parameter tampering and XXE
| Attack | Indicator |
|---|---|
| Command injection | Shell operators (semicolon, pipe, &&, backticks) and commands such as whoami or cat in a parameter |
| Parameter tampering | Changed values such as a price, quantity or user ID, often in hidden fields, or sequential IDs requested by one client |
| XML external entity (XXE) | XML containing a DOCTYPE with an ENTITY that points to a SYSTEM file or URL |
Application logs and web application firewall logs often show these better than the access log, because POST bodies are not in a normal access log line.
Brute force and cookie poisoning
A web brute force shows many POST requests to a login page from one or a few sources, repeated failures for one account, then a different status or response size when it succeeds. Rate limiting, lockout and multi factor authentication counter it.
Cookie poisoning modifies cookie values to change identity or privileges, for example altering a role or user ID value, or reusing a stolen session ID. Indicators are cookies with values the server never issued, one session ID used from different addresses, and privilege changes without a login event.
A worked example
An access log contains GET /product.php?id=5' UNION SELECT username,password FROM users-- from 198.51.100.7, with a 200 response about ten times larger than normal. The same address earlier requested /admin, /login and /backup.sql.
The investigator identifies SQL injection after reconnaissance, checks the database log for the query and preserves the logs with hashes. Whether the attack worked rests on the response size and the database evidence, not the request alone.
How the exam asks about this
- "Requests contain
../../etc/passwd. Which attack is it?" -> Directory traversal. - "A new AP uses the SSID of the corporate network but a different BSSID. What is it?" -> An evil twin (rogue AP).
- "Which frame type is flooded in a Wi-Fi deauthentication attack?" -> Deauthentication management frames.
What to remember for the exam
- WEP is broken. WPA2 handshakes allow offline guessing. WPA3 uses SAE.
- Rogue AP detection compares BSSID, OUI and settings with the authorized list.
- Jamming shows a high noise floor. A deauth flood shows many deauthentication frames.
- Traversal uses
../, SQL injection uses quotes andUNION SELECT, XXE usesENTITY. - Always read the response code and size to decide if an attack succeeded.
A request in a log shows an attempt, not a result. Confirm success from the response, the database or file access evidence before reporting a breach.
Common mistakes
Calling every extra access point rogue. It could be an approved device missing from the inventory, so verify before reporting.
Reading only access logs for POST attacks. Request bodies are often missing, so also use application, database and WAF logs.
Ignoring URL encoding. Attackers encode payloads, so decode before searching.
Check yourself
What is an evil twin?
A rogue access point that copies a legitimate SSID so clients connect to it.
Which log detail helps decide that a SQL injection worked?
The response status and size, backed by database evidence.
Why is monitor mode needed to investigate Wi-Fi?
It passes all 802.11 frames, including management frames, to the capture tool.
Topic 7 of 11 in Digital Forensics
Test yourself on Digital Forensics
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.