CEH Web Application and Injection Attacks Practice Question
A penetration tester finds that a web application accepts XML input and returns the parsed data in the response. The tester submits the following payload: <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>. The server returns the contents of /etc/passwd. Which vulnerability is being exploited?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
XXE injection
The payload defines an external entity (XXE) that reads a local file, indicating an XML External Entity (XXE) injection vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSRF
Why it's wrong here
SSRF (Server-Side Request Forgery) occurs when a web application is tricked into making requests to an arbitrary domain specified by the attacker, often targeting internal network resources. While an XXE payload could potentially trigger an outbound request, the primary goal of reading a local file like `/etc/passwd` directly through entity resolution is a characteristic of XXE, not the server-side request forgery itself. SSRF focuses on manipulating the *destination* of a server's request, whereas XXE focuses on *parsing content* from a specified source.
- ✗
Command injection
Why it's wrong here
Command injection vulnerabilities allow an attacker to execute arbitrary operating system commands on the server by injecting them into input that is subsequently passed to a system shell. This attack vector directly manipulates the underlying OS command execution, distinct from how XML external entities are processed by an application's parser. The described payload leverages XML entity resolution to read a file, not to directly execute shell commands.
- ✓
XXE injection
Why this is correct
XXE injection exploits vulnerabilities in XML parsers that are configured to process external entities within a Document Type Definition (DTD). By defining a `SYSTEM` entity that references a local file path, such as `/etc/passwd`, the attacker can compel the XML parser to read the content of that file. This content is then often returned within the application's response or an error message, enabling sensitive data exfiltration directly through XML processing.
- ✗
XPath injection
Why it's wrong here
XPath injection targets XPath query syntax within XML processing, not external entity resolution via SYSTEM identifiers. The payload uses a DOCTYPE declaration with an external entity referencing a local file, which is the mechanism of XML External Entity (XXE) attack, not XPath manipulation. This option is tempting because both vulnerabilities involve XML input, and XPath injection is commonly tested alongside XXE in certification scenarios, but XPath injection would require altering query logic (e.g., `' or '1'='1`) rather than defining entities to read files.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.