CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Command injection

  Why this is correct

  The presence of a 'cmd' parameter in the URL, especially when followed by a system command like 'id', strongly indicates that the web application is passing user-supplied input directly to an underlying operating system shell. This vulnerability arises when the application fails to properly sanitize or validate this input, allowing an attacker to append arbitrary shell commands using special characters such as semicolons, pipes, or ampersands. Consequently, the server executes these injected commands with the privileges of the web server process, potentially leading to remote code execution.

• ✗

  Local File Inclusion (LFI)

  Why it's wrong here

  Local File Inclusion (LFI) vulnerabilities typically manifest when a web application includes a file from the local server's filesystem based on user-supplied input, often through parameters like 'file', 'page', or 'template'. An LFI attack would involve an attacker attempting to specify a file path, such as `?file=/etc/passwd` or `?page=../../config.php`, to read sensitive system files. The observed `cmd=id` parameter, which executes a system command, does not align with the pattern of file path manipulation characteristic of LFI.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection exploits occur when an attacker manipulates user-supplied input to alter or inject malicious SQL queries into a backend database. This type of attack typically involves parameters that interact with a database, such as 'id', 'user', or 'category', and would feature SQL-specific syntax like single quotes, `OR 1=1`, `UNION SELECT`, or comments (`--`). The observed `cmd=id` parameter, which directly invokes an operating system command, bears no resemblance to the structure or purpose of an SQL injection attempt.

• ✗

  Directory traversal

  Why it's wrong here

  Directory traversal, also known as path traversal, allows an attacker to access files and directories stored outside the intended web root directory by manipulating file paths. This vulnerability is typically exploited using sequences like `../` (dot-dot-slash) to navigate up the directory hierarchy, often within parameters designed to handle file names or paths. The `cmd=id` parameter, which is clearly attempting to execute a system command rather than manipulate a file path with traversal sequences, does not fit the characteristics of a directory traversal attack.

Go deeper

Related to this question