A penetration tester is reviewing the security of a web application running in an IaaS compute instance. Which of the following payloads should the tester send to get the running process credentials?

The correct answer is B. file=../../../proc/self/environ. This payload exploits a Local File Inclusion (LFI) or path traversal vulnerability to read the Linux /proc/self/environ pseudo-file. The /proc/self/environ file contains all environment variables of the currently running process. In cloud-based IaaS environments and…

Attacks and Exploits

Question

Options

Bfile=../../../proc/self/environ
Cfile='%20or%2054365=54365;--

How the community answered

(37 responses)

B
78% (29)
C
22% (8)

Explanation

This payload exploits a Local File Inclusion (LFI) or path traversal vulnerability to read the Linux /proc/self/environ pseudo-file. The /proc/self/environ file contains all environment variables of the currently running process. In cloud-based IaaS environments and containerized applications, credentials, API keys, database passwords, and cloud provider secrets are commonly passed to processes as environment variables. By traversing the directory structure with '../' sequences to escape the web root and reading /proc/self/environ, an attacker can dump all these secrets. The second option shown (%20or%2054365=54365;--) is a URL-encoded SQL injection payload used to bypass authentication, not to retrieve process credentials.

Topics

#Local File Inclusion#Path Traversal#Credential Disclosure#Web Application Exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice