Which describes configuration weaknesses in web infrastructure exploited to launch attacks on web servers such as directory traversal, server intrusion, and data theft?

Which describes configuration weaknesses in web infrastructure exploited to launch attacks on web servers such as directory traversal, server intrusion, and data theft?

• A. Unvalidated Input and File Injection Attacks
• B. Web Server Misconfiguration
• C. Command Injection Attacks
• D. HTTP Response Splitting Attack

Answer: (B)

Web server misconfiguration describes weaknesses in how the web infrastructure is set up—weak defaults, overly permissive access, exposed management interfaces, or poor server settings—that attackers can abuse to access sensitive data, traverse the file system, or intrude into the system. When the server isn’t hardened properly, simple flaws become gateways for more damaging actions: directory traversal can occur if file paths or directory listings are exposed or not properly protected, server access controls aren’t enforced, or sensitive areas are left publicly reachable; intrusion and data theft follow from exposed admin interfaces, weak authentication, misapplied permissions, or unprotected data paths. This answer is the best fit because it centers on configuration and deployment choices that create broad, system-wide weaknesses, rather than specific coding flaws. The other options point to flaws in input handling or specific injection techniques, which describe how certain attacks are carried out rather than how the server is configured to enable them.

Web server misconfiguration describes weaknesses in how the web infrastructure is set up—weak defaults, overly permissive access, exposed management interfaces, or poor server settings—that attackers can abuse to access sensitive data, traverse the file system, or intrude into the system. When the server isn’t hardened properly, simple flaws become gateways for more damaging actions: directory traversal can occur if file paths or directory listings are exposed or not properly protected, server access controls aren’t enforced, or sensitive areas are left publicly reachable; intrusion and data theft follow from exposed admin interfaces, weak authentication, misapplied permissions, or unprotected data paths.

This answer is the best fit because it centers on configuration and deployment choices that create broad, system-wide weaknesses, rather than specific coding flaws. The other options point to flaws in input handling or specific injection techniques, which describe how certain attacks are carried out rather than how the server is configured to enable them.