In what type of attack does an intruder manipulate a URL in such a way that the Web server executes or reveals the contents of a file anywhere on the server, including those lying outside the document root directory?
-
cross-site scripting
-
command injection
-
SQL injection
-
path traversal attacks
To answer this question, the user needs to have knowledge about different types of web attacks.
The answer is D. Path Traversal Attacks.
Option A is incorrect because Cross-site scripting (XSS) attacks allow an attacker to inject malicious scripts into a web page viewed by other users. This allows the attacker to steal user information, hijack user accounts, spread malware, and perform other malicious activities.
Option B is incorrect because Command Injection Attacks occur when an attacker sends malicious input to an application, tricking it into executing unintended commands. This can allow the attacker to run arbitrary commands on the web server, potentially compromising the server and its data.
Option C is incorrect because SQL Injection attacks occur when an attacker sends malicious SQL statements to a web application database. This can allow the attacker to view or modify data in the database, or even take control of the entire database server.
Option D is the correct answer because Path Traversal Attacks occur when an attacker manipulates a URL to access files outside of the web server's root directory. This can allow the attacker to view sensitive data or execute arbitrary code on the web server.
The correct answer is path traversal attack. This attack manipulates a URL (often using sequences like ../../ or encoded variants) to make the web server access files outside the intended document root, exposing configuration files, source code, or system files it should never serve. Cross-site scripting is wrong because it injects malicious script into pages viewed by other users, not about accessing arbitrary server files. Command injection involves getting the server to execute arbitrary OS commands, not just read files via path manipulation. SQL injection targets the database layer through malformed queries, not the file system via URL paths. Path traversal is specifically about escaping the web root directory boundary through crafted file paths in the URL, which precisely matches the scenario described.