CompTIA Exam PT0-003 Topic 2 Question 21 Discussion

Actual exam question for CompTIA's PT0-003 exam

Question #: 21
Topic #: 2

[All PT0-003 Questions]

A penetration tester is trying to get unauthorized access to a web application and executes the following command:

GET /foo/images/file?id=2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

Which of the following web application attacks is the tester performing?

AInsecure Direct Object Reference

BCross-Site Request Forgery

CDirectory Traversal

DLocal File Inclusion

Show Suggested Answer

Suggested Answer: C

The attacker is attempting to access restricted files by navigating directories beyond their intended scope.

Directory Traversal (Option C):

The request uses encoded '../' sequences (%2e%2e%2f = ../) to move up directories and access /etc/passwd.

This is a classic directory traversal attack aimed at accessing system files.

Incorrect options:

Option A (Insecure Direct Object Reference - IDOR): IDOR exploits direct access to objects (e.g., changing user_id=123 to user_id=456), not directory navigation.

Option B (CSRF): CSRF forces users to execute unwanted actions, unrelated to directory access.

by Devorah at Mar 22, 2025, 06:34 AM

Limited Time Offer

25%

Off

Get Premium PT0-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Veronika

14 days ago

Well, this is clearly a directory traversal attempt. The tester is trying to access a sensitive file by using the '../' syntax to move up the directory tree. Not a very subtle approach, but hey, sometimes the direct route works!

upvoted 0 times

...

1 months ago

I think the penetration tester is performing a Directory Traversal attack.

upvoted 0 times

...