Courseiva
← CEH
Full test
Web Application and Injection Attacks →mediumMultiple ChoiceObjective-mapped

CEH Web Application and Injection Attacks Practice Question

A penetration tester discovers that a web application includes the following code: 'include($_GET['page'] . '.php');' and the application is running on a Linux server. The tester attempts to exploit this by accessing 'index.php?page=../../etc/passwd'. What type of attack is this, and will it succeed?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Local File Inclusion (LFI); it will not succeed because the '.php' extension is appended

This is a Local File Inclusion (LFI) vulnerability. The appended '.php' extension prevents reading '/etc/passwd' because the file would be interpreted as '/etc/passwd.php', which does not exist.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Directory traversal; it will succeed because '../' bypasses restrictions

    Why it's wrong here

    Directory traversal is a technique used to access files and directories stored outside the web root directory by manipulating file paths, typically using "../" sequences. However, in this scenario, the appended ".php" extension fundamentally alters the target file path. An attempt to access "/etc/passwd" would result in the server trying to include "/etc/passwd.php", which is unlikely to exist or be the intended sensitive file, thus preventing successful traversal to read arbitrary system files.

  • ✗

    Remote File Inclusion (RFI); it will succeed because the parameter is not filtered

    Why it's wrong here

    Remote File Inclusion (RFI) specifically refers to the vulnerability where an attacker can include files hosted on a remote server into the vulnerable application. The scenario described involves attempting to include a local file, which falls under Local File Inclusion (LFI). Furthermore, even if it were an RFI attempt, the automatic appending of ".php" would cause the server to request "http://attacker.com/malicious.txt.php", likely preventing the remote malicious file from being interpreted as intended.

  • ✗

    Command injection; it will succeed if the server interprets PHP code

    Why it's wrong here

    Command injection is a distinct vulnerability where an attacker injects operating system commands into a web application, causing the server to execute arbitrary shell commands. This scenario, however, describes an attempt to manipulate a file inclusion mechanism, not to execute system commands. The vulnerability type is file inclusion, which focuses on reading or executing files, not directly running OS commands through the application's backend.

  • ✓

    Local File Inclusion (LFI); it will not succeed because the '.php' extension is appended

    Why this is correct

    Local File Inclusion (LFI) is the correct classification for this vulnerability, as it involves an attempt to include files present on the web server's local file system. However, the crucial detail preventing immediate success is the automatic appending of the ".php" extension to the user-supplied input. This means an attempt to include a file like "/etc/passwd" would result in the application trying to include "/etc/passwd.php", which typically does not exist, thereby blocking direct access to the target file without further bypass techniques.

About these practice questions

Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on CEH

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A web application uses user input in the following PHP code: include($_GET['page'] . '.php');. An attacker submits the URL: http://example.com/index.php?page=../../../../etc/passwd%00. Which two vulnerabilities are being attempted?

medium
  • A.RFI and command injection
  • ✓ B.LFI and null byte injection
  • C.SQL injection and XSS
  • D.Directory traversal and IDOR

Why B: The attacker is using '../' for directory traversal to access files outside the web root, and a null byte injection (%00) to truncate the '.php' extension. This targets LFI (local file inclusion) via directory traversal.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.