Exam SY0-601 topic 1 question 151 discussion

C. Command injection and directory traversal attempts

Answer: Command injection and directory traversal attempts Directory traversal is when an attacker uses the software on a web server to access data in a directory other than the server's root directory. If the attempt is successful, the threat actor can view restricted files or execute commands on the server. Command injection is an attack that involves executing commands on a host. Typically, the threat actor injects the commands by exploiting an application vulnerability, such as insufficient input validation. The attacker is attempting to traverse the directory of the host and execute the cat command which could be used to print the contents of a file.

This video explains more clearly about directory traversal: https://www.youtube.com/watch?v=NQwUDLMOrHo

The log entries show attempts to perform command injection and directory traversal attacks. In a command injection attack, the attacker tries to execute arbitrary commands on the target system by injecting malicious input into the application. In this case, the GET requests in the log entries include sequences like "../../../../../../etc/passwd" and "../../../../../../etc/shadow," which are attempts to traverse directories and access sensitive files on the system. Directory traversal attacks are an attempt to access files and directories that are outside of the web application's intended directory structure. By using "../" sequences, the attacker tries to navigate to parent directories and access files that should not be publicly accessible.

The log entries suggest command injection and directory traversal attempts. The attacker is attempting to execute commands on the web server by entering special characters, such as semicolons and forward slashes, in the input fields. They are also trying to access directories outside of the web root by using "../" in the URI. Therefore, the correct answer is C.

When I saw 'Get' instantly I went for cmd injection and traversal attempts.

The cat command traverses files in a directory.

Agree with C

Agree with C for this one