312-39V2: Certified SOC Analyst v2

Question

Identify the attack in which an attacker, through several trial-and-error attempts, can read the contents of a password file in the restricted etc folder merely by manipulating the URL in the browser as shown:

http://www.terabytes.com/process.php./../../../../etc/passwd

Explanation

A directory traversal attack uses ../ path components to escape an application’s intended directory and access files elsewhere on the server, such as /etc/passwd. OWASP identifies this technique as path (directory) traversal and specifically describes ../ sequences being used to reach sensitive system files.

Learn more

OWASP Path Traversal

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ190

Community Discussion