A penetration tester fuzzes an internal server looking for hidden services and applications and obtains the following output: Which of the following is the most likely explanation for the output?

The correct answer is C. The admin, test, and db directories redirect to the log-in page. The output of the fuzzing tool shows that the admin, test, and db directories have the same size, words, and lines as the login page, which indicates that they are redirecting to the login page. This means that the tester cannot access these directories without valid…

Reconnaissance and enumeration

Question

A penetration tester fuzzes an internal server looking for hidden services and applications and obtains the following output:

Which of the following is the most likely explanation for the output?

Exhibit

Options

AThe tester does not have credentials to access the server-status page.
BThe admin directory cannot be fuzzed because it is forbidden.
CThe admin, test, and db directories redirect to the log-in page.
DThe robots.txt file has six entries in it.

How the community answered

(38 responses)

A
16% (6)
B
8% (3)
C
74% (28)
D
3% (1)

Explanation

The output of the fuzzing tool shows that the admin, test, and db directories have the same size, words, and lines as the login page, which indicates that they are redirecting to the login page. This means that the tester cannot access these directories without valid credentials. The server- status page returns a 403 Forbidden status code, which means that the tester does not have permission to access it. The robots.txt file returns a 404 Not Found status code, which means that the file does not exist on the server.

Topics

#Fuzzing#Directory Enumeration#Web Application Responses#Vulnerability Discovery

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice