Question 52

Directory traversal

The logs indicate an attempt to access sensitive files on the server, specifically the `/etc/passwd` and `/etc/shadow` files, using a path traversal technique. This is characteristic of a directory traversal attack, where the attacker exploits the file system structure to gain unauthorized access to files.

A) File injection

File injection typically involves inserting malicious files into a system or application to execute harmful code. While the logs do indicate attempts to access files, they do not suggest that files are being injected into the system, making this option incorrect.

B) Privilege escalation

Privilege escalation refers to exploiting a vulnerability to gain higher access levels than intended. The provided logs do not show any evidence of elevating privileges but rather focus on file access, thus this option is not applicable.

C) Directory traversal

This option accurately describes the attack reflected in the logs. The use of `../../.../` in the GET requests indicates an attempt to navigate outside the web server's intended directory structure to access sensitive system files, which is the hallmark of a directory traversal attack.

D) Cookie forgery

Cookie forgery involves manipulating or creating cookies to impersonate a user or gain unauthorized access. The logs provided do not reference cookies or any related manipulation, making this option irrelevant to the situation described.

Conclusion

Directory traversal is definitively the correct answer as it directly correlates with the attempt to access sensitive system files through crafted URL requests. All other options either misinterpret the nature of the attack or do not align with the evidence presented in the logs, reinforcing that directory traversal is the only accurate classification of the attempted attack.