Which term describes attackers using the ../ sequence to access restricted directories outside the web server root?

Which term describes attackers using the ../ sequence to access restricted directories outside the web server root?

• A. Web Defacement
• B. Directory Traversal Attacks
• C. HTTP Response Splitting Attack
• D. Web Server Misconfiguration

Answer: (B)

Directory traversal attacks rely on improper path handling by the web server. When user-supplied input isn’t properly sanitized, an attacker can request paths that include sequences like ../ to move up the directory tree. Each ../ steps out of the web root, and by chaining these steps, the attacker can reach files and directories outside the intended document root, potentially exposing sensitive data such as system configuration files or passwords. The attacker’s goal is to access restricted areas rather than just modify content. This differs from web defacement, which is about altering the visible site content after gaining access, not about escaping the web root to read restricted files. It also isn’t about manipulating HTTP responses with header injection (HTTP Response Splitting Attack), which targets the response structure rather than file system access. And it isn’t a general misconfiguration category, which covers broader server setup issues rather than the specific technique of traversing directories with relative path sequences.

Directory traversal attacks rely on improper path handling by the web server. When user-supplied input isn’t properly sanitized, an attacker can request paths that include sequences like ../ to move up the directory tree. Each ../ steps out of the web root, and by chaining these steps, the attacker can reach files and directories outside the intended document root, potentially exposing sensitive data such as system configuration files or passwords. The attacker’s goal is to access restricted areas rather than just modify content.

This differs from web defacement, which is about altering the visible site content after gaining access, not about escaping the web root to read restricted files. It also isn’t about manipulating HTTP responses with header injection (HTTP Response Splitting Attack), which targets the response structure rather than file system access. And it isn’t a general misconfiguration category, which covers broader server setup issues rather than the specific technique of traversing directories with relative path sequences.