A penetration tester discovers a web application with the following URL: https://app.example.com/report?file=../../../etc/passwd. Testing this URL returns the contents of /etc/passwd. Which vulnerability class is this, and what is the appropriate next step in a black-box test?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the ../ sequences in the file parameter traversing to /etc/passwd is a textbook Path Traversal vulnerability (CWE-22/OWASP A01); the next step is to assess business impact by attempting to read higher-value files like SSH keys or application database credentials while staying within scope. A is wrong because SQL injection tests for database query manipulation, unrelated to file path traversal.
Full explanation below image
Full Explanation
B is correct because the ../ sequences in the file parameter traversing to /etc/passwd is a textbook Path Traversal vulnerability (CWE-22/OWASP A01); the next step is to assess business impact by attempting to read higher-value files like SSH keys or application database credentials while staying within scope. A is wrong because SQL injection tests for database query manipulation, unrelated to file path traversal. C is wrong because XSS involves injecting client-side scripts, not path traversal. D is wrong because CSRF involves forging cross-site state-changing requests, which is unrelated to file inclusion.