John, a SOC analyst, while monitoring and analyzing Apache web server logs, identified an event log matching Regex /(\.|(%|%25)2E)(\.|(%|%25)2E)(\/|(%|%25)2F|\\|(%|%25)5C)/i. What does this event…

Question

Options

• AXSS Attack
• BSQL injection Attack
• CDirectory Traversal Attack
• DParameter Tampering Attack

• A
  7% (4)
• B
  3% (2)
• C
  79% (48)
• D
  11% (7)

Explanation

The regex pattern /(.|(%|%25)2E)(.|(%|%25)2E)(/|(%|%25)2F|\|(%|%25)5C)/i is indicative of a Directory Traversal Attack. This type of attack exploits insufficient security controls to gain unauthorized access to files and directories that are stored outside the web root folder. Here’s a breakdown of the regex pattern: (.|(%|%25)2E) matches a period . or its URL-encoded forms %2E or %252E. In file systems, a period can represent the current directory or, when used as .., the parent directory. (/|(%|%25)2F|\|(%|%25)5C) matches a forward slash /, its URL-encoded form %2F or %252F, or a backslash , which is %5C in URL encoding. These characters are used in file paths to navigate When combined, this pattern can match sequences like ../ or ..%2F, which are commonly used in directory traversal attempts to navigate up the directory tree and access files outside of the intended and responding to various types of cyber threats, including Directory Traversal Attacks12. The program emphasizes the importance of understanding and identifying different attack vectors, including those that involve manipulating file paths, which is a critical skill for SOC analysts. The regex pattern provided is a typical example of what SOC analysts might encounter and need to recognize as part of their role in monitoring and analyzing web server logs12.

No community discussion yet for this question.