Exam CAS-004 topic 1 question 626 discussion

The most likely vulnerability exploited, based on the log files, is: A. Directory traversal revealed the hashed SSH password, which was used to access the server. Brief explanation: The log entry https://myapp.mycompany.com/something.php=?../..../../etc/shadow suggests a directory traversal attack, where the attacker attempts to access files outside the web server's intended directory. /etc/shadow is a critical file on Linux systems that contains hashed passwords. If an attacker retrieves this file, they can crack the hashes to gain credentials. The sequence of events shows: Attempted directory traversal to access /etc/shadow (likely to retrieve hashed passwords). Actions like whoami indicate the attacker tested their access level after gaining entry. An SSH session was initiated shortly after, indicating the attacker used credentials from the /etc/shadow file.