ITPEC FE Morning April 2019 Question 37

Directory Traversal Attack — accessing restricted files by manipulating file path input

Correct answer: d) An attacker specifies a file by using the path name and illegally views a file that is not intended for viewing by the administrator.

Directory traversal (also called path traversal) exploits insufficient input validation on file path parameters. The attacker uses sequences like ../../ to navigate outside the intended directory and access sensitive system files.

Why not the others:

• •a) SQL Injection — injecting database commands through application input fields
• •b) Cross-Site Scripting (XSS) — exploiting poor HTML escaping to execute malicious scripts in a user's browser
• •c) Session Hijacking — stealing or spoofing a valid session ID to impersonate a logged-in user

Key rule: If the attack involves file paths and unauthorized file access, it's directory traversal. A common indicator is the use of ../ sequences in user input.

AI-generated — may contain errors