An attacker targets weaknesses by using crafted input to traverse server directories beyond the root?

An attacker targets weaknesses by using crafted input to traverse server directories beyond the root?

• A. Directory Traversal Attacks
• B. HTTP Response Splitting Attack
• C. Cookie Tampering
• D. Web Defacement

Answer: (A)

This describes a directory traversal vulnerability. An attacker feeds crafted input that uses path navigation sequences (like ../) to move up the directory tree and access files outside the intended web root. Because the application doesn’t properly validate or canonicalize the input, it may serve or reveal sensitive files such as configuration files, logs, or source code, which should be inaccessible. This concept is about manipulating file paths to escape the restricted directory and reach areas that should be off-limits. It’s not about injecting or splitting HTTP headers (that would be HTTP Response Splitting), nor about altering cookie values (cookie tampering), nor about changing the site’s content (web defacement). Those other issues involve different weaknesses and attack methods. To mitigate, validate and sanitize all user-supplied file paths, canonicalize paths before access, implement access controls and least privilege on the server, avoid directly exposing filesystem paths, and consider using fixed mappings from user input to safe, intended resources.

This describes a directory traversal vulnerability. An attacker feeds crafted input that uses path navigation sequences (like ../) to move up the directory tree and access files outside the intended web root. Because the application doesn’t properly validate or canonicalize the input, it may serve or reveal sensitive files such as configuration files, logs, or source code, which should be inaccessible.

This concept is about manipulating file paths to escape the restricted directory and reach areas that should be off-limits. It’s not about injecting or splitting HTTP headers (that would be HTTP Response Splitting), nor about altering cookie values (cookie tampering), nor about changing the site’s content (web defacement). Those other issues involve different weaknesses and attack methods.

To mitigate, validate and sanitize all user-supplied file paths, canonicalize paths before access, implement access controls and least privilege on the server, avoid directly exposing filesystem paths, and consider using fixed mappings from user input to safe, intended resources.