ITPEC FE Morning October 2019 Question 40
Which of the following is a description of a directory traversal attack?
Explanation
Reading an unauthorized file by specifying a path name — directory traversal climbs out of the directory the application meant to serve.
An application that builds a file path from user input, such as a file= parameter, can be given a value like ../../etc/passwd. Each ../ moves up one directory, so the server opens a file outside its public directory. The defence is to reject path separators and .. in input, or to map input to a fixed list of files.
Answer (a)
Why not others:
- •(b) — injecting database commands through input data is SQL injection
- •(c) — exploiting missing escaping in HTML output to run a script in the user's browser is cross-site scripting (XSS)
- •(d) — stealing a logged-in user's session ID and posing as that user is session hijacking
Key rule: Name an injection-type attack by what the input is interpreted as: a file path (directory traversal), SQL (SQL injection), HTML or script (XSS), or an OS command (OS command injection).
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.