A penetration tester discovers a web application with the following URL: https://app.example.com/report?file=../../../etc/passwd. Testing this URL returns the contents of /etc/passwd. Which vulnerability class is this, and what is the appropriate next step in a black-box test?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — the ../ sequences in the file parameter are a textbook path traversal issue. You should document the proof and then test for higher-value files to determine business impact.
Full Explanation
The Path Traversal (Directory Traversal) answer is correct because the ../ sequences in the file parameter traverse outside the intended directory and return /etc/passwd, which is a textbook path traversal issue (CWE-22/OWASP A01). In a black-box test, you should document the finding with proof, such as the response showing /etc/passwd, then test for additional sensitive files such as /etc/shadow, application config files, and private keys to determine business impact while staying within scope. The SQL Injection answer is wrong because SQL injection tests database query manipulation, unrelated to file path traversal. The Cross-Site Scripting answer is wrong because XSS involves injecting client-side scripts, not path traversal. The CSRF answer is wrong because CSRF involves forging cross-site state-changing requests, which is unrelated to file inclusion.