An administrator discovers the following log entry on a server: Nov 12 2013 00:23:45 httpd[2342]: GET /app2/prod/proc/process.php?input=change;cd%20../../../etc;cat%20shadow Which of the following…

Question

Options

• ACommand injection
• BPassword attack
• CBuffer overflow
• DCross-site scripting

• A
  76% (19)
• B
  4% (1)
• C
  12% (3)
• D
  8% (2)

Explanation

Command Injection Attack Explained

Option A is correct because the log entry shows an attacker appending shell commands (;cd%20../../../etc;cat%20shadow) to an HTTP request parameter, attempting to break out of the web application's context and execute OS-level commands - specifically navigating to the /etc directory and reading the shadow password file. This is the classic hallmark of command injection: malicious commands are injected into input fields to be executed by the underlying operating system.

Option B (Password attack) is incorrect because, while the shadow file contains passwords, the method used here is command injection, not a brute force, dictionary, or credential-stuffing attack. Option C (Buffer overflow) is wrong because no attempt is being made to overflow a memory buffer with excessive input data. Option D (Cross-site scripting) is incorrect because XSS involves injecting client-side scripts (like JavaScript) to target users' browsers, not server-side OS commands.

Memory Tip: Look for semicolons and chained OS commands (like cd, cat, ls) inside URL parameters - if it looks like a terminal command hiding in a web request, think Command Injection.

No community discussion yet for this question.