GCIH · Question #822
How should an incident handler classify the following event shown in the output below?
The correct answer is C. Directory Traversal. Directory traversal attacks manipulate file path parameters using sequences like ../ to escape the intended directory and access arbitrary files on the server.
Question
How should an incident handler classify the following event shown in the output below?
Exhibit
Options
- ADNS Spoofing
- BSQL Injection
- CDirectory Traversal
- DCommand Injection
How the community answered
(22 responses)- A18% (4)
- B5% (1)
- C73% (16)
- D5% (1)
Why each option
Directory traversal attacks manipulate file path parameters using sequences like ../ to escape the intended directory and access arbitrary files on the server.
DNS Spoofing involves forging DNS responses to redirect traffic to attacker-controlled servers, which manifests as anomalous DNS records or unexpected IP resolutions, not file path manipulation.
SQL Injection inserts malicious SQL syntax into database query inputs, identifiable by characters such as single quotes, UNION SELECT statements, or Boolean-based payloads in the request.
Directory traversal exploits insufficient input validation on file path parameters, allowing an attacker to use sequences such as ../../etc/passwd to break out of the web root and read arbitrary files on the server filesystem. The attack requires no code execution or database interaction - it relies entirely on manipulating path strings passed to file-access functions. Indicators in output such as ../ sequences or references to system paths like /etc/passwd or /windows/system32/drivers/etc/hosts are the definitive signature of this attack type.
Command Injection embeds operating system commands into application input fields, typically evidenced by shell metacharacters such as semicolons, pipes, or backticks appearing in the request parameters.
Concept tested: Directory traversal path manipulation attack identification
Source: https://owasp.org/www-community/attacks/Path_Traversal
Topics
Community Discussion
No community discussion yet for this question.
