CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Directory traversal

  Why this is correct

  Directory traversal, also known as path traversal, is an attack that exploits insufficient security validation or sanitization of user-supplied input to access files and directories stored outside the intended web root directory. The `../` sequence, or its URL-encoded equivalent `%2e%2e%2f`, allows an attacker to navigate up the directory hierarchy. By chaining multiple `../` sequences, an attacker can potentially access sensitive system files like `/etc/passwd` or configuration files, thereby compromising the system's confidentiality.

• ✗

  Remote file inclusion (RFI)

  Why it's wrong here

  Remote File Inclusion (RFI) vulnerabilities occur when a web application incorporates a remote file, specified by a URL, into the server-side script without proper validation. This allows an attacker to execute malicious code hosted on an external server. The provided log entry, however, shows a local path (`../`), not an external URL (e.g., `http://malicious.com/shell.txt`), indicating that the attempt is to access a file on the local system, not to include a remote one.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution. This typically involves manipulating database queries through input like single quotes, `OR 1=1`, or `UNION SELECT` clauses. The log entry displays a file path (`../`), which bears no resemblance to SQL syntax or common injection patterns, thus ruling out an SQL injection attempt.

• ✓

  Local file inclusion (LFI)

  Why this is correct

  Local File Inclusion (LFI) is a vulnerability that allows an attacker to include a local file on the server through the web application. While the `../` pattern is indicative of directory traversal, LFI specifically refers to the scenario where the application processes and displays or executes the *content* of the specified local file. If the web application attempts to include the file identified by the traversed path, such as `/etc/passwd`, into its output, it constitutes an LFI vulnerability, potentially leading to information disclosure or remote code execution.

• ✗

  Command injection

  Why it's wrong here

  Command injection is an attack in which the goal is to execute arbitrary commands on the host operating system via a vulnerable application. This typically involves injecting shell metacharacters such as `&`, `|`, `||`, `;`, or backticks (`` ` ``) into user-supplied input that is subsequently passed to a system command. The `../` pattern observed in the log is a path manipulation technique, not a command operator, and does not indicate an attempt to execute OS commands.

Go deeper

Related to this question