312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

During an investigation at a hosting provider in Denver, Colorado, analysts need to bulk-scan web server logs for path/directory-traversal attempts that can occur in both encoded and literal forms. Which expression should they use to reliably match these dot-dot-slash patterns across encodings in a single pass?

A %5C
B %2e%2e%2f
C ((.|%2E)( .|%2E)(/|%2F|\|%5C))
D ((..\)(../))

Explanation

Directory-traversal sequences consist of two dots followed by a path separator. A comprehensive detection expression must allow each dot to be literal or percent-encoded as %2E, and must allow the separator to be a literal slash or backslash or percent-encoded as %2F or %5C. Choice C is the only option designed to cover those literal, encoded, and mixed representations in one pattern.

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ309

Community Discussion