CSA (312-39) SOC Simulation Lab
Scenario Context
You are monitoring the SIEM for Terabytes Inc., an e-commerce platform. A custom alert fires: "High Volume of 404/200 Responses to Legacy PHP Wrapper".
The target is an older endpoint, process.php, which is known to fetch and display dynamic files to users. You pull the raw Apache access logs to investigate the traffic originating from the suspected threat actor's IP address.
Security Environment (Telemetry)
Review the following extract from the web server's access log (/var/log/apache2/access.log):
Question
Identify the attack when an attacker by several trial and error can read the contents of a password file present in the restricted etc folder just by manipulating the URL in the browser as shown: http://www.terabytes.com/process.php./../../../../etc/passwd
Expert Insight
What is happening:
The attacker is manipulating the URL to access files outside the intended web root directory. The application fails to properly sanitize the input supplied after process.php. By iterating the "dot-dot-slash" (../) sequence, the attacker steps up the directory tree until they reach the system root (/), allowing them to navigate to and read the highly sensitive /etc/passwd file. The HTTP 200 response in the final log line confirms the attack was successful.
Why Directory Traversal (A) is correct:
The explicit use of ../ to break out of the web directory and access local OS files is the exact definition of a Directory Traversal (or Path Traversal) attack. The objective is unauthorized file read access, not database manipulation.
Why the others are wrong:
- SQL Injection: Targets backend databases using SQL syntax (e.g.,
' OR 1=1--). There is no SQL syntax in this URI payload. *(Note: Some legacy exam dumps incorrectly list this as SQLi, but as a SOC analyst, you must recognize this as a strict file system attack).* - Denial-of-Service: Aims to exhaust system resources to take the application offline. This attack aims for data exfiltration/reading.
- Form Tampering: Involves intercepting and modifying POST body parameters, hidden fields, or headers to manipulate business logic (e.g., changing a price from $100 to $1).
MINI LESSON: SOC Detection & Mitigation for Path Traversal
As a SOC analyst, relying solely on standard `../` strings in SIEM alerts is dangerous because attackers use evasion techniques. You must build robust detection logic.
- URL Encoding: Attackers often encode the payload to bypass basic WAF rules. Look for
%2e%2e%2f(../),%2e%2e%5c(..\), or even double URL encoding%252e%252e%252f. - Null Byte Injection: Legacy applications might require a null byte (
%00) to bypass file extension checks (e.g.,../../../etc/passwd%00.jpg). - Mitigation Strategy: In incident response, advise the dev team to avoid passing user input directly to filesystem APIs. If unavoidable, they must use a strict allowlist of files, sanitize input by stripping traversal sequences, and ensure the web server runs with least-privileged access (e.g., a chroot jail) so it cannot physically access
/etc/.