200-201 Question 311
Single answerA security analyst observes an alert indicating that an attacker attempted to exploit a vulnerable web application by sending the following URL:
http://example.com/index.php?page=../../etc/passwd
What is the primary reason this URL is considered malicious?
- A
It contains an attempt to perform directory traversal to access sensitive files.
- B
The URL is using HTTP instead of HTTPS, making it inherently insecure.
- C
The URL is attempting to inject a SQL statement to compromise the database.
- D
It contains a malformed domain name, which indicates potential phishing.
Show answer and explanation
Correct answer: A
Explanation
The URL attempts to exploit a directory traversal vulnerability by navigating to a system file (/etc/passwd). Directory traversal attacks allow attackers to gain unauthorized access to files and directories outside the web root folder, making this activity malicious.
- A. Correct.
This is correct because the
../../etc/passwdsegment in the URL indicates an attempt at directory traversal, which is a common attack to access sensitive system files. - B. Incorrect.
While HTTP is less secure than HTTPS, the use of HTTP alone does not make the URL malicious in this context.
- C. Incorrect.
There is no evidence of SQL injection in this URL. SQL injection typically involves database query manipulation, which is not present here.
- D. Incorrect.
There is nothing malformed about the domain name
example.comin this URL, so this option is incorrect.