A penetration tester observes that the content security policy header is missing during a web application penetration test. Which of the following techniques would the penetration tester MOST likely…

Command injection targets server-side input handling where user-supplied data is passed to OS commands and has no relationship to the presence or absence of client-side HTTP security headers like CSP.

The Content Security Policy header's frame-ancestors directive controls which origins are permitted to embed the page in an iframe or frame. When CSP is absent, there is no restriction on iframe embedding, allowing an attacker to load the legitimate authenticated page inside an invisible iframe on a malicious site and trick users into unknowingly performing actions such as fund transfers or account changes - a clickjacking attack.

Directory traversal exploits improper path normalization on the server to access files outside the web root, a server-side vulnerability entirely unrelated to client-side CSP headers.

Remote file inclusion exploits server-side script inclusion mechanisms that load external files due to unsafe input handling, which is a server-side flaw independent of CSP configuration.