CEH Web Application and Injection Attacks Practice Question
A security engineer is reviewing web server logs and finds the following request: GET /files/../../../etc/passwd HTTP/1.1. Which THREE attacks could be associated with this request? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Directory traversal
The request uses path traversal to access /etc/passwd (directory traversal/LFI). It can be used for file disclosure, and if the file is included in a script, it could be LFI. Command injection is not related.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Directory traversal
Why this is correct
Directory traversal, also known as path traversal, is an attack that allows an attacker to access files and directories stored outside the web root directory. The `../` sequences in the request are a clear indicator, as they instruct the server to navigate up the directory hierarchy. By repeatedly using `../`, the attacker attempts to escape the restricted web directory and access sensitive system files like `/etc/passwd`.
- ✓
File disclosure
Why this is correct
File disclosure refers to the unauthorized retrieval and display of sensitive files from a server. In this scenario, the attacker's objective is to read the contents of `/etc/passwd`, which contains user account information. If successful, this attack would directly expose system user details, constituting a critical information leak and a direct consequence of a successful path manipulation.
- ✗
SQL injection
Why it's wrong here
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. The observed log entry, containing path traversal sequences like `../` and targeting a file path `/etc/passwd`, does not exhibit any characteristics of SQL syntax or database interaction. Therefore, it is not indicative of an SQL injection attempt, which would typically involve manipulating database queries.
- ✗
Command injection
Why it's wrong here
Command injection is an attack where an attacker executes arbitrary operating system commands on the host server through a vulnerable application. While both involve server-side execution, the request shown specifically manipulates file paths using `../` to access a file, `/etc/passwd`, rather than attempting to inject and execute system commands like `ls`, `cat`, or `whoami` within the application's context.
- ✓
Local File Inclusion (LFI)
Why this is correct
Local File Inclusion (LFI) is a vulnerability that allows an attacker to include files from the local server file system into the web application's response. If a web application dynamically includes files based on user-supplied input without proper validation, the provided path `../../../../etc/passwd` could be used to force the application to read and display the contents of the `/etc/passwd` file. This often leads to information disclosure.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.