Examkin

Soru

Zorluk: KolayApplication and Software Vulnerabilities

A security analyst is reviewing a vulnerability scan report for a company web application. The report indicates that an attacker can access arbitrary files on the server's file system by inserting relative path sequences (such as `../../etc/passwd`) into a file request parameter. Which of the following application vulnerabilities is described in this scenario?

  1. Directory traversalCevap
  2. B
    Cross-site scripting (XSS)
  3. C
    Improper authentication
  4. D
    Network firewall misconfiguration

Cevap

Directory traversal
The correct answer is directory traversal because the inclusion of dot-dot-slash (`../`) sequences in input fields specifically aims to bypass access controls and navigate out of the web server root directory to read arbitrary files from the operating system.

Adım Adım Çözüm

1
Analyze the attack payload described in the scenario
The input uses directory navigation symbols (`../../`) to traverse system directories
Sequences like `../` move up one level in the file system directory structure
2
Map the vulnerability mechanism to standard security taxonomy
The flaw allows accessing files outside the web root directory (path traversal)
Insufficient input validation combined with unsafe file path construction results in directory traversal

Anahtar Kavram

Directory Traversal / Path Traversal Vulnerability
Tahmini Süre:45s
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru