While testing a web application in development, you notice that the web server does not properly ignore the "dot dot slash" (../) character string and instead returns the file listing of a folder…

The correct answer is D. Directory traversal. In a directory traversal attack, an attacker can access files and directories that are stored outside of the web root directory. The attacker can exploit this vulnerability to access sensitive information such as configuration files, password files, and other sensitive data.

Submitted by hans_de· Mar 4, 2026Web Application Hacking

Question

While testing a web application in development, you notice that the web server does not properly ignore the "dot dot slash" (../) character string and instead returns the file listing of a folder higher up in the folder structure of the server. What kind of attack is possible in this scenario?

Options

ACross-site scripting
BSQL injection
CDenial of service
DDirectory traversal

How the community answered

(16 responses)

B
6% (1)
D
94% (15)

Explanation

In a directory traversal attack, an attacker can access files and directories that are stored outside of the web root directory. The attacker can exploit this vulnerability to access sensitive information such as configuration files, password files, and other sensitive data.

Topics

#web application vulnerability#directory traversal#path traversal

Community Discussion

No community discussion yet for this question.

Full 312-50V12 Practice