PT0-001 · Question #145
Given the following: Which of the following BEST describes the above attack?
The correct answer is C. Directory traversal attack. This question references an attack shown in an omitted image or code snippet. Based on the correct answer, it depicts a directory traversal attack using path sequences to access restricted server files.
Question
Given the following:
Which of the following BEST describes the above attack?
Options
- AMalicious file upload attack
- BRedirect attack
- CDirectory traversal attack
- DInsecure direct object reference attack
How the community answered
(28 responses)- A7% (2)
- C89% (25)
- D4% (1)
Why each option
This question references an attack shown in an omitted image or code snippet. Based on the correct answer, it depicts a directory traversal attack using path sequences to access restricted server files.
A malicious file upload attack involves uploading dangerous files such as web shells to gain execution on the server, not manipulating path inputs to traverse the file system.
A redirect attack tricks a web application into forwarding users to a malicious external URL, which is unrelated to navigating server directories via path sequences.
Directory traversal attacks use sequences like '../' to navigate up the server's file system beyond the web application root, allowing an attacker to read sensitive files such as /etc/passwd or configuration files. This attack exploits insufficient validation of file path inputs in the application. The technique is distinct because it leverages the server's own file system structure rather than injecting code or manipulating object references.
An insecure direct object reference (IDOR) attack manipulates identifiers like numeric record IDs in requests to access unauthorized data objects, not file system paths.
Concept tested: Directory traversal path sequence file system attack
Source: https://owasp.org/www-community/attacks/Path_Traversal
Topics
Community Discussion
No community discussion yet for this question.