Exam SY0-601 topic 1 question 348 discussion

LFI stands for "Local file inclusion" for whoever doesnt know this. I sure didnt.

lol in Q330 we had to chose XSS out of answers now we have same Q with more options smh Xss isnt even considerad in this one LFI lol

I thought this exact question came up earlier and there was a high vote for XSS, how come nobody chose it this time in similar question.. I'm confuse

I am thinking this test is about memorization of acronyms which I don't think has any value to your proficiency as a cyber security professional.

Not gonna lie, some of these questions are really irritating. Not once did I see or hear LFI during my studying. Maybe I just overlooked it, but I've never heard of that. Ugh.

The log entries show that the attacker is able to access the /etc/passwd and /etc/sudoers files, which are sensitive files that contain user account information. This is possible because the attacker is exploiting a directory traversal vulnerability. LFI (Local File Inclusion) is a vulnerability that allows an attacker to read arbitrary files on the server. The attacker in the scenario is exploiting an LFI vulnerability by using the show_file.php script to read the /etc/passwd and /etc/sudoers files. Directory traversal is a vulnerability that allows an attacker to access files outside of the web root directory. The attacker in the scenario is exploiting a directory traversal vulnerability by using the ../ sequence in the file name to access the /etc/passwd and /etc/sudoers files.

Why LFI if attacker is reading the file from remote resource? It should be Directory traversal & RFI

This is one of those questions that likely doesn't count..seems to be from Pentest+ File inclusion attacks build on directory traversal attacks in the sense that you don’t just navigate through the system and look at files, you execute a program from the URL of the request message. There are two types of file inclusion: • Local: A local file inclusion is used to execute a program that is local or located on the web server. In this example, the hacker would typically compromise the system first and plant the program on the system. To execute the program at a later time, the hacker would include a reference to the program in the URL: http://website/index.php?include=c:\\data\\exploit. exe" -Comptia Pentest+ Certification for dummies 2nd Edition by Glen Clarke

Thanks, I donot know LFI, it is my first time to see it

I dont see LFI in the exam objectives. Am i wrong?

The attacker has exploited the LFI (Local File Inclusion) and the Directory Traversal vulnerabilities. The logs show two HTTP GET requests made to the web server: The first request was made to the show_file.php page with a parameter file set to *2et2e2f:2et2et2fetc2fpasswd. The second request was made to the same show_file.php page with a parameter file set to $2e92e292e2e2fetc\2fsudoers. Both requests seem to be trying to access sensitive files on the server. The first request appears to be trying to access the /etc/passwd file, which contains user account information, and the second request appears to be trying to access the /etc/sudoers file, which contains the list of users who are allowed to run commands with elevated privileges using the sudo command. Therefore, the attacker is trying to exploit a vulnerability that allows unauthorized access to sensitive files on the web server.

B. LFI F. Directory Traversal LFI Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server. LFI attacks can expose sensitive information, and in severe cases, they can lead to cross-site scripting (XSS) and remote code execution. LFI is listed as one of the OWASP Top 10 web application vulnerabilities. RFI Remote file inclusion (RFI) is an attack targeting vulnerabilities in web applications that dynamically reference external scripts. The perpetrator’s goal is to exploit the referencing function in an application to upload malware (e.g., backdoor shells) from a remote URL located within a different domain.

The attacker has likely exploited B. LFI and F. Directory traversal. The logs suggest the attacker is attempting to access files outside the server’s root directory, which could be indicative of a Local File Inclusion (LFI) vulnerability. Additionally, the attempt to “..dir.dir” suggests an attempt at directory traversal exploitation.

The answer is BE LFI & RFI - A race condition is an undesirable situation that occurs when a device or system attempts to perform two or more operations at the same time, have a look at the time stamps, they are different -Remote File Inclusion (RFI) is a type of vulnerability most often found on the suited PHP running web portals be on the web and the Local File Inclusion (LFI) is similar to RFI, the only difference is that in LFI, the attacker has been uploading the malicious scripts types - Pass the hash is taking a hash and cracking it -Xss is an attack on the client side of things this attack is on the web server - There is NO directory traversal happening here

B e F

B and F seems correct