PT0-003: CompTIA PenTest+Demo

By CompTIA · Question Mode

QuestionQ88

Vulnerability Discovery and Analysis

A penetration tester discovers that an application returns the contents of the /etc/passwd file when this payload is submitted:

Question Image

Which recommendation should the tester include in the report to best prevent this type of vulnerability?

  • A Drop all excessive file permissions with chmod o-rwx.
  • B Ensure the requests application access logs are reviewed frequently.
  • C Disable the use of external entities.
  • D Implement a WAF to filter all incoming requests.
Explanation

XML External Entity (XXE) attacks occur when an XML parser resolves externally defined entities, allowing attacker-controlled input to access local files or other resources. Disabling external-entity processing prevents the parser from resolving the malicious file reference.

Community Discussion

No comments yet. Be the first to start the discussion!