Which of the following are application threat vectors?

• A. Arbitrary Code Execution and Password Attacks
• B. Footprinting and Profiling
• C. Privilege Escalation and Backdoor Attacks
• D. Hidden-Field Manipulation and SQL Injection

Answer: (D)

Application threat vectors are ways attackers compromise an application by manipulating how it processes input and data. Hidden-field manipulation involves tampering with values in form fields that the client can modify, aiming to influence server-side logic or data. SQL Injection targets the database by sending malicious input that is not properly sanitized, enabling unauthorized queries or data access. These are classic examples of threats that arise from the application layer handling user-supplied data.

The other options blend issues that are not focused on how an application processes input or interacts with its database—reconnaissance activities, credential-focused attacks, or broader system-level exploits like privilege escalation and backdoors. That’s why the pair containing hidden-field manipulation and SQL Injection best represents application threat vectors.