A penetration tester is validating whether input validation mechanisms have been implemented in a web application. Which of the following should the tester use to determine whether the application…

Path traversal attacks exploit insufficient input validation by using directory traversal sequences like ../ to access files or directories outside the intended application directory. The URL-encoded form ..%2f is commonly used to bypass basic filters, and attempting to access /etc/hosts is a standard way to confirm this vulnerability on Unix-like systems.

This looks like a command injection attempt (pwd) combined with an invalid filename, not a path traversal attempt.

This is an incomplete and malformed request that does not demonstrate a path traversal attempt.

This is a command injection attempt (ncat to create a reverse shell) and not a path traversal attempt, which focuses on directory navigation.