Examkin

Soru

Zorluk: ZorApplication and Software Vulnerabilities

A security analyst inspects an HTTP request sent to an enterprise document service along with the corresponding server response:

http
GET /documents/download?file=..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: portal.example.com

The web server responds with an HTTP 200 OK status code containing the root filesystem account details. Additionally, when a user submits a non-existent path parameter, the application returns a detailed Java stack trace displaying internal file system paths, framework versions, and database connection strings.

Based on these findings, which of the following application vulnerabilities are present? (Select TWO.)

  1. Directory traversalCevap
  2. Improper error handlingCevap
  3. C
    Cross-site request forgery
  4. D
    SQL injection

Cevap

The application suffers from directory traversal and improper error handling.
Directory traversal occurs when an application fails to sanitize input containing relative directory sequences (like `../` or `%2F`), allowing unauthorized access to arbitrary files on the system host. Improper error handling occurs when verbose diagnostic output, such as unhandled exception stack traces, is revealed directly to end users instead of generic error pages.

Adım Adım Çözüm

1
Analyze the HTTP request parameter and payload
The file parameter contains URL-encoded relative path traversal sequences (`..%2F..%2F..%2Fetc%2Fpasswd`), which resolve to local system files (`/etc/passwd`).
This confirms a directory traversal flaw caused by insufficient validation and sanitization of file path parameters.
2
Analyze the server's error output behavior when invalid input is provided
The server exposes detailed stack traces containing internal directory structures, framework versions, and database connection metadata.
Displaying sensitive technical implementation details in client-facing error responses constitutes an improper error handling vulnerability.

Anahtar Kavram

Identifying directory traversal attacks and improper error handling disclosures in application security assessments.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru