While analyzing SIEM alerts for a company WAF, an incident response analyst observes the following: https://corporate-A.com/loadimage?filename=../../etc/ https://corporate-A.com/loadimage?filename=../../etc/passwd https://corporate-A.com/loadimage?filename=../../etc/passwd Which of the following best describes the observed behavior?

Rationale

Directory traversal.

The observed behavior indicates an attempt to access files outside the intended directory, specifically targeting sensitive files like 'passwd' in the '/etc/' directory. This type of exploit is characteristic of directory traversal attacks, where attackers manipulate file paths to gain unauthorized access to system files.

A (Credential replay) YOUR ANSWER

Credential replay attacks involve intercepting and reusing valid user credentials to gain unauthorized access to systems. The scenario described does not demonstrate any reuse of credentials or authentication processes, but rather focuses on file access attempts, making this choice irrelevant to the observed behavior.

B (Directory traversal) CORRECT

This correctly identifies the behavior described, as the attempted URLs include patterns that exploit directory traversal vulnerabilities. By utilizing the '../../' sequence, the attacker seeks to navigate up the directory structure to access files that should not be publicly accessible, such as the 'passwd' file, confirming the nature of the attack as a directory traversal.

C (Brute-force attack) YOUR ANSWER

A brute-force attack refers to systematically trying many combinations of passwords or encryption keys to gain access to a system. The URLs provided do not show any attempts at password guessing or brute-forcing user accounts, thus making this choice inappropriate for describing the observed behavior.

D (Resource exhaustion) YOUR ANSWER

Resource exhaustion attacks aim to deplete system resources, such as memory or processing power, often through excessive requests or data processing. The actions observed do not involve overwhelming the system's resources but focus on accessing specific files, making this option unsuitable in this context.

Conclusion

The incident response analysis reveals an attempt at directory traversal, evident from the URLs attempting to access sensitive files via manipulated paths. This type of attack exploits vulnerabilities in web applications to gain unauthorized file access, underscoring the importance of securing web applications against such risks. Understanding these attack vectors enables more effective defensive strategies and incident response plans.

Directory traversal.

Related Questions

Related Quizzes

How familiar were you with this question?

Report an Issue

Rate this Practice Test