Topic 1: Input-validation vulnerabilities

Question 1

what is a command injection?

Answer 1

attacker can insert arbitrary commands on the host OS via a vulnerable application

Question 2

when is command injection possible?

Answer 2

when an application passes an unsafe input

Question 3

what is a path traversal?

Answer 3

attacker provides a path as input for navigational purposes