ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ133

VerifiedWeb Application Penetration Testing Methodology

While auditing a web application for vulnerabilities, Donald uses Burp Proxy and alters the GET requests as follows:

http://www.example.com/GET/process.php./../../../../../../../../etc/password

What is Donald attempting to accomplish?

Explanation

Directory traversal uses sequences such as ../ to navigate outside an intended web-accessible directory and attempt to read files elsewhere on the server, such as /etc/password.

Community Discussion

No comments yet. Be the first to start the discussion!