312-50 Question 286
Single answer▪ Web Server AttacksDuring an authorized assessment, you enumerate a Linux-based public web server hosting an outdated PHP application. Banner grabbing and directory enumeration show Apache HTTP Server is running, and the application accepts file uploads for user profile images. You discover that the server executes PHP files placed within the web root and that the upload function validates files only by extension in client-side code. To demonstrate impact without causing unnecessary damage, which action is the MOST appropriate next step to confirm a web server compromise through this weakness?
- A
Upload a PHP web shell disguised as an image, then request it through the browser to verify remote command execution with a harmless command such as whoami
- B
Launch a SYN flood against the Apache service to prove the server is vulnerable to denial-of-service conditions
- C
Modify the Apache configuration remotely to disable PHP execution in the uploads directory and document the change as proof of access
- D
Exploit DNS zone transfer against the target domain to identify hidden subdomains before attempting web server compromise
Show answer and explanation
Correct answer: A
Explanation
This question tests practical application of web server attack methodology: moving from enumeration to controlled exploitation based on observed server behavior. The critical details are that Apache is serving a PHP application, uploaded files can land in the web root, and validation occurs only in client-side code. Client-side validation is not a security control because it can be bypassed easily with a proxy or crafted request. If the server permits execution of uploaded PHP content, the risk is remote code execution through a web shell or similar payload.
From an ethical hacking perspective, the most appropriate action is a minimally invasive proof-of-concept that directly demonstrates the discovered weakness. Executing a harmless command such as whoami confirms code execution while limiting impact. This aligns with common penetration testing best practices: validate the finding, demonstrate business risk, and avoid unnecessary disruption.
Relevant secure coding and deployment guidance appears in OWASP recommendations on File Upload Security, which emphasize server-side validation, allowlisting, storing uploads outside the web root where possible, and preventing execution of uploaded files. Apache hardening guidance also commonly recommends disabling script execution in upload directories and applying least privilege to the web server process. In short, the scenario describes a classic unrestricted file upload leading to web server compromise, and the correct next step is to safely confirm remote code execution through that exact path.
- A. Correct.
Correct. In this scenario, the key weakness is unrestricted or poorly validated file upload combined with server-side execution of PHP in a web-accessible location. Uploading a controlled PHP payload and invoking it to run a harmless command is an appropriate proof-of-concept because it directly validates the web server attack path: arbitrary file upload leading to remote code execution. In a CEH-style context, this is the most direct and minimally invasive method to confirm impact while staying aligned with scope and avoiding unnecessary disruption.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not a validation step for the discovered file upload and code execution weakness. Even if the server were susceptible to resource exhaustion, that would not confirm the identified web application/web server compromise path. It is also generally more disruptive and inconsistent with the stated goal of demonstrating impact without causing unnecessary damage.
- C. Incorrect.
Incorrect. Remotely changing Apache configuration would be invasive and assumes a level of access that has not yet been established. The purpose of the next step is to confirm compromise through the discovered weakness, not to alter production settings. Changing configuration during an assessment can create operational risk and is not the least intrusive way to prove exploitability.
- D. Incorrect.
Incorrect. DNS zone transfer is an information-gathering technique relevant to misconfigured DNS servers, not to confirming exploitation of a file upload vulnerability on a web server. While subdomain discovery can support broader reconnaissance, it does not validate the specific web server attack scenario presented.