nerdexam
GIAC

GCIH · Question #822

How should an incident handler classify the following event shown in the output below?

The correct answer is C. Directory Traversal. Directory traversal attacks manipulate file path parameters using sequences like ../ to escape the intended directory and access arbitrary files on the server.

Web Application Attacks & Post-Exploitation

Question

How should an incident handler classify the following event shown in the output below?

Exhibit

GCIH question #822 exhibit

Options

  • ADNS Spoofing
  • BSQL Injection
  • CDirectory Traversal
  • DCommand Injection

How the community answered

(22 responses)
  • A
    18% (4)
  • B
    5% (1)
  • C
    73% (16)
  • D
    5% (1)

Why each option

Directory traversal attacks manipulate file path parameters using sequences like ../ to escape the intended directory and access arbitrary files on the server.

ADNS Spoofing

DNS Spoofing involves forging DNS responses to redirect traffic to attacker-controlled servers, which manifests as anomalous DNS records or unexpected IP resolutions, not file path manipulation.

BSQL Injection

SQL Injection inserts malicious SQL syntax into database query inputs, identifiable by characters such as single quotes, UNION SELECT statements, or Boolean-based payloads in the request.

CDirectory TraversalCorrect

Directory traversal exploits insufficient input validation on file path parameters, allowing an attacker to use sequences such as ../../etc/passwd to break out of the web root and read arbitrary files on the server filesystem. The attack requires no code execution or database interaction - it relies entirely on manipulating path strings passed to file-access functions. Indicators in output such as ../ sequences or references to system paths like /etc/passwd or /windows/system32/drivers/etc/hosts are the definitive signature of this attack type.

DCommand Injection

Command Injection embeds operating system commands into application input fields, typically evidenced by shell metacharacters such as semicolons, pipes, or backticks appearing in the request parameters.

Concept tested: Directory traversal path manipulation attack identification

Source: https://owasp.org/www-community/attacks/Path_Traversal

Topics

#directory traversal#path traversal#web attack classification#incident classification

Community Discussion

No community discussion yet for this question.

Full GCIH Practice