A security administrator observed the following in a web server log while investigating an incident: "GET ../../../../etc/passwd" Which of the following attacks did the security administrator most likely see?
Choose an answer
Tap an option to check your answer.
Correct answer: Directory traversal.
Why this is the answer
The GET request ../../../../etc/passwd is a classic example of a directory traversal attack. This attack attempts to access files and directories that are stored outside the web server's root directory by manipulating URLs with sequences like ../ (dot-dot-slash) to navigate up the directory tree. In this case, the attacker is trying to access the /etc/passwd file, which contains user account information on Unix-like systems. Privilege escalation involves gaining higher-level access than initially granted, but the log entry itself doesn't directly show this. Credential replay uses stolen credentials to gain unauthorized access, which is not indicated by the directory traversal attempt. Brute force involves systematically trying many passwords or keys, which is also not reflected in the provided log entry.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed