A penetration tester is trying to get unauthorized access to a web application and execute the following command: Which of the following web application attacks is the tester performing?

The correct answer is C. Directory Traversal. The request contains a URL-encoded string: id=2%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd which decodes to: id=../../../../etc/passwd This is a classic directory traversal attack, where the tester attempts to access files outside the intended directory structure by…

Submitted by anna_se· Mar 6, 2026Attacks and Exploits

Question

A penetration tester is trying to get unauthorized access to a web application and execute the following command:

Which of the following web application attacks is the tester performing?

Options

AInsecure Direct Object Reference
BCross-Site Request Forgery
CDirectory Traversal
DLocal File Inclusion

How the community answered

(59 responses)

A
3% (2)
B
3% (2)
C
92% (54)
D
2% (1)

Explanation

The request contains a URL-encoded string: id=2%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd which decodes to: id=../../../../etc/passwd This is a classic directory traversal attack, where the tester attempts to access files outside the intended directory structure by navigating up the file system hierarchy.

Topics

#Web application attacks#Directory Traversal#Path manipulation#LFI/RFI

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice