MENU
John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He performs Web vulnerability scanning on the We-are-secure server. The output of the scanning test is as follows:
C:\whisker.pl -h target_IP_address
-- whisker / v1.4.0 / rain forest puppy / www.wiretrip.net -- = - = - = - = - =
= Host: target_IP_address
= Server: Apache/1.3.12 (Win32) ApacheJServ/1.1
mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.22
+ 200 OK: HEAD /cgi-bin/printenv
John recognizes /cgi-bin/printenv vulnerability ('Printenv' vulnerability) in the We_are_secure server. Which of the following statements about 'Printenv' vulnerability are true?
Each correct answer represents a complete solution. Choose all that apply.
Suggested Answer: A, C, D
Get Premium GSLC Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
DA
Daren
11 months ago
B seems misleading, it's not really about logging activities.
JE
Jettie
11 months ago
D is spot on, attackers can exploit it for sure.
YU
Yuki
12 months ago
Wait, does 'printenv' really log user activities? Sounds off.
KY
Kyoko
12 months ago
Totally agree, that script is a big risk!
DA
Dalene
12 months ago
A is definitely true, removing the CGI script is key.
AN
Anastacia
1 year ago
I think option D makes sense because if an attacker can access the 'printenv' output, they could potentially craft malicious inputs. So, that one seems correct too.
SH
Shayne
1 year ago
I feel like option C is misleading. 'Printenv' itself doesn't directly lead to cross-site scripting; it just reveals sensitive information.
VI
Virgina
1 year ago
I'm not entirely sure about option B. I thought 'printenv' just exposes environment variables, but does it really log user activities?
CL
Claudio
1 year ago
I remember studying the 'printenv' vulnerability and that removing the CGI script is a common countermeasure. So, I think option A is definitely true.
CH
Cherelle
1 year ago
I'm pretty sure the annular ligament is located in the wrist, so I'll go with C.
MA
Marcelle
1 year ago
The HTML Composer might be the way to go if we need more granular control over the email content and layout. But I'd want to double-check that it supports the necessary testing functionality.
QU
Quentin
1 year ago
This seems like a straightforward question about video encoding. I think the key is to find a way to get four 30 fps H.264 streams from the same camera product.