Free Preparation Discussions
MENU
CompTIA Exam PT0-003 Topic 2 Question 21 Discussion
Topic #: 2
A penetration tester is trying to get unauthorized access to a web application and executes the following command:
GET /foo/images/file?id=2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
Which of the following web application attacks is the tester performing?
The attacker is attempting to access restricted files by navigating directories beyond their intended scope.
Directory Traversal (Option C):
The request uses encoded '../' sequences (%2e%2e%2f = ../) to move up directories and access /etc/passwd.
This is a classic directory traversal attack aimed at accessing system files.
Incorrect options:
Option A (Insecure Direct Object Reference - IDOR): IDOR exploits direct access to objects (e.g., changing user_id=123 to user_id=456), not directory navigation.
Option B (CSRF): CSRF forces users to execute unwanted actions, unrelated to directory access.
Veronika
2 months agoMose
28 days agoMatt
30 days agoEttie
1 months agoCiara
2 months agoKaycee
13 days agoYuki
19 days agoDenae
26 days agoSalley
1 months agoCeola
2 months agoLaurena
2 months agoElden
2 months agoLatonia
25 days agoJamal
29 days agoSamuel
1 months agoNobuko
2 months agoGracia
2 months agoMartha
2 months agoKristeen
2 months ago