312-50 Question 288
Single answer▪ Web Server Attack MethodologyDuring an authorized assessment, you discover that a company's public web server allows directory listing on several folders and exposes a "/backup/" directory containing old application files. The target runs over HTTPS, but the security team wants to know the most appropriate next step in a web server attack methodology to identify sensitive information disclosure without causing service disruption. Which action should you take FIRST?
- A
Enumerate the exposed directories and inspect accessible files such as old configuration, backup, and log files for credentials, source code, and system details
- B
Launch a password brute-force attack against the web server's administrator portal to validate whether weak credentials are in use
- C
Perform a denial-of-service test against the HTTPS service to determine whether the server can withstand volumetric attacks
- D
Exploit the TLS certificate configuration to gain shell access to the underlying operating system
Show answer and explanation
Correct answer: A
Explanation
The best answer is to enumerate the exposed directories and review accessible files. In a realistic CEH-style web server assessment, directory listing and exposed backup folders are strong indicators of information disclosure and poor hardening. The tester should first collect and analyze what is already publicly exposed before attempting louder or more invasive actions. Common high-value targets include backup archives, old source code, web.config/.env/configuration files, logs, database dumps, and temporary files. This approach aligns with standard web server assessment methodology: footprinting and banner grabbing, enumeration of exposed content, review of misconfigurations, vulnerability identification, and only then carefully authorized exploitation. Best-practice guidance from sources such as OWASP testing guidance and common web server hardening standards emphasizes restricting directory listing, removing backup files from the web root, and preventing sensitive files from being directly accessible.
- A. Correct.
Correct. In web server attack methodology, after identifying misconfigurations such as directory listing and exposed backup locations, the appropriate next step is controlled enumeration of exposed content. Reviewing accessible backup, configuration, and log files can reveal credentials, internal paths, source code, connection strings, version information, and other data that supports further testing. This is a low-impact, evidence-based action aligned with standard web enumeration practices.
- B. Incorrect.
Incorrect. Although weak authentication is a valid concern, brute-forcing an admin portal is not the best first step here because a lower-risk and more directly indicated issue already exists: exposed directories and backups. Good methodology prioritizes passive or minimally invasive enumeration before moving to intrusive authentication attacks, and brute-force activity may also violate assessment constraints if not explicitly approved.
- C. Incorrect.
Incorrect. A denial-of-service test is not part of the normal next step for investigating information disclosure on a web server, and it is highly disruptive. In most professional engagements, DoS testing requires explicit written authorization because it can affect availability. It does not logically follow from the discovery of exposed directories.
- D. Incorrect.
Incorrect. TLS certificate misconfiguration does not itself provide shell access to the host. While SSL/TLS weaknesses may expose issues such as deprecated protocols or poor cipher suites, they are not a direct path to operating system compromise in the way described. This option reflects a common misconception that transport security findings automatically translate into host-level access.