How to Retrieve Running Process Credentials in an IaaS Instance?
A penetration tester is reviewing the security of a web application running in an IaaS compute instance. Which of the following payloads should the tester send to get the running process credentials?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of Linux /proc filesystem enumeration through Local File Inclusion (LFI), pitting it against cloud metadata endpoints. The common trap is confusing instance metadata (169.254.169.254) with process-level environment variables.
The correct payload for retrieving running process credentials on an IaaS compute instance is a directory traversal to /proc/self/environ. This environment file exposes variables that often contain credentials; community consensus overwhelmingly supports answer B.
Answer D (file=http://169.254.169.254/latest/meta-data/) is the most common alternative because it retrieves cloud instance metadata and can include IAM role credentials. However, those are instance-level credentials, not the credentials of the current running process, which are found in /proc/self/environ.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
B,file=../../../proc/self/environ, is a classic LFI payload that exploits directory traversal to read /proc/self/environ on a Linux system. This file contains environment variables of the current process (e.g., the web server), often including database passwords, API keys, or other secrets. As comment [1] explains, /proc gives access to process information, /self refers to the process currently reading the file, and /environ exposes the process environment variables — correctly called the "keys to the castle."Why the Other Options Are Wrong
A (document.cookie) attempts to read a JavaScript cookie and send it externally, but that is unrelated to process credentials. C is an SQL injection payload, not an LFI/file-read attempt. D accesses the AWS EC2 metadata service at 169.254.169.254, which can provide IAM role temporary credentials, but those are instance-level or role-based credentials, not the credentials of the web server process itself. The question specifically asks for "running process credentials," making B the only choice that directly enumerates the process environment.Community Comment Notes
Comments [1], [3], [4], and [5] all correctly identify B and explain /proc/self/environ as accessing process environment variables. Comment [2] argues for D, citing the metadata service, but it misinterprets the question's wording: while metadata can contain IAM role credentials, those are not the running process's credentials. The distinction is critical for the exam: understand what each payload targets before selecting the answer.Official Reference
Exam Strategy
When a question asks for "running process credentials" on a Linux host, immediately think of /proc/self/environ as the direct source. Avoid picking cloud metadata endpoints (169.254.169.254) unless the question refers to instance IAM roles or instance metadata — these are two different types of credential exposure on the exam.