ITPEC FE Morning October 2019 Question 40

Directory Traversal Attack — accessing unauthorized files by manipulating file path parameters.

A directory traversal (also called path traversal) attack occurs when an attacker includes path characters like ../ in input parameters to navigate outside the intended directory and read sensitive files (e.g., /etc/passwd).

Why not others:
- (b) This describes SQL injection — inserting database commands into input fields to execute unauthorized SQL.
- (c) This describes Cross-Site Scripting (XSS) — exploiting improper HTML escaping to run malicious scripts in a user's browser.
- (d) This describes session hijacking — stealing a valid session ID to impersonate an authenticated user.

Key rule: Directory traversal = unauthorized file access via path manipulation (../).

AI-generated — may contain errors