EC-Council
412-79V10 · Question #12
Richard, a penetration tester was asked to assess a web application. During the assessment, he discovered a file upload field where users can upload their profile pictures. Richard tried to upload a…
The correct answer is D. Parameter tampering. See the full explanation below for the reasoning.
Question
Richard, a penetration tester was asked to assess a web application. During the assessment, he discovered a file upload field where users can upload their profile pictures. Richard tried to upload a PHP shell, but the web application restricted the upload to image files only. Richard bypassed the restriction and uploaded a malicious PHP shell, but the web page denied the file upload. Trying to get around the security, Richard added the '.jpg' extension to the end of the file. The new file name looked like 'shell.php.jpg'. Richard submitted the file and observed the '.jpg' extension from the request while uploading the file. This enabled him to successfully upload the PHP shell. Identify the exploitation technique that Richard implemented to upload the PHP shell?
Options
- ASession stealing
- BCookie tampering
- CFile extension bug
- DParameter tampering
How the community answered
(17 responses)- A6% (1)
- B6% (1)
- C18% (3)
- D71% (12)
Community Discussion
No community discussion yet for this question.