Question

While reviewing a PCAP in Wireshark, an analyst follows an HTTP stream and sees the following request line: GET /download.php?file=../../../../etc/passwd HTTP/1.1 followed by a 200 OK response containing lines beginning with root:x:0:0. Interpreting the URI field in the request header, which intrusion is most likely occurring?

Accepted Answer

Directory (path) traversal attack retrieving a sensitive system file

Answer

SQL injection using a UNION statement to dump database tables

Answer

Cross-site scripting injecting a script into the file parameter

Answer

HTTP request smuggling using duplicate content-length headers