312-50V13 · Question #105
Study the following log extract and identify the attack.
The correct answer is D. Unicode Directory Traversal Attack. Although the log extract is missing, the presence of specific Unicode encoding in an attempt to bypass directory traversal filters points to a Unicode Directory Traversal Attack.
Question
Exhibit
Options
- AHexcode Attack
- BCross Site Scripting
- CMultiple Domain Traversal Attack
- DUnicode Directory Traversal Attack
How the community answered
(43 responses)- A9% (4)
- B5% (2)
- C16% (7)
- D70% (30)
Why each option
Although the log extract is missing, the presence of specific Unicode encoding in an attempt to bypass directory traversal filters points to a Unicode Directory Traversal Attack.
'Hexcode Attack' is a vague term; while Unicode encoding uses hexadecimal, the attack is more specifically classified as directory traversal.
Cross-Site Scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, which is unrelated to accessing server files via directory traversal.
'Multiple Domain Traversal Attack' is not a standard or recognized attack type; directory traversal specifically refers to navigating file system paths.
A Unicode Directory Traversal Attack attempts to access files and directories outside of the intended web root by using Unicode encoding (e.g., `%c0%af` or `%c0%9v`) to represent directory traversal sequences like `../` (dot-dot-slash). This encoding often bypasses poorly implemented input validation filters that only look for the ASCII representation of the traversal characters.
Concept tested: Unicode directory traversal
Topics
Community Discussion
No community discussion yet for this question.