This attack attempts to manipulate the API by fuzzing the authorization token (Authorization: Bearer (FUZZ)). This suggests an attempt to bypass authentication or escalate privileges by using an invalid, stolen, or guessed token-a form of API abuse.
* Option A (Directory traversal) #:
* Involves manipulating file paths (e.g., ../../../etc/passwd), but this attack targets API authentication.
* Option B (API abuse) #:
* Correct. Fuzzing the authorization token suggests an attempt to bypass authentication or test for weak API security.
* Option C (Server-side request forgery - SSRF) #:
* SSRF manipulates backend requests to make unauthorized HTTP calls, which is not evident here.
* Option D (Privilege escalation) #:
* While API abuse may lead to privilege escalation, fuzzing the token alone does not directly escalate privileges.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - API Security Testing & Authentication Bypasses