CEH Web Application and Injection Attacks Practice Question
A security engineer observes that an internal web application uses XML to transmit data between systems. The engineer discovers that by sending a crafted XML payload, they can read sensitive files from the server's filesystem. Which attack is being performed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
XXE injection
XXE (XML External Entity) injection allows reading files via external entities in XML.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSRF
Why it's wrong here
Server-Side Request Forgery (SSRF) compels a server-side application to make HTTP requests to an arbitrary domain specified by the attacker, often targeting internal networks or services. While SSRF can be leveraged to access internal resources, the primary mechanism involves manipulating URLs or request parameters, not directly parsing XML entities to read local files. Therefore, the described scenario of file reading through XML entities points to a different vulnerability.
- ✗
Command injection
Why it's wrong here
Command injection vulnerabilities arise when an application executes operating system commands constructed using unsanitized user input, allowing attackers to inject arbitrary shell commands. This type of attack enables actions like listing directories, reading files, or deleting data directly on the underlying server's operating system. However, the scenario explicitly details reading files through the processing of XML, which is distinct from executing shell commands via an OS command interpreter.
- ✓
XXE injection
Why this is correct
XXE injection occurs when an XML parser processes XML input containing references to external entities, which are then resolved by the server without proper validation. Attackers can define malicious external entities within the Document Type Definition (DTD) to exploit this, often using the "file://" protocol to read local files from the server's filesystem, such as configuration files or sensitive credentials. This direct file disclosure via XML entity processing perfectly matches the described observation.
- ✗
XPath injection
Why it's wrong here
XPath injection exploits vulnerabilities in applications that dynamically construct XPath queries using unsanitized user-supplied input. This allows an attacker to manipulate the query logic, potentially bypassing authentication, extracting sensitive data from the XML document, or altering the results of the XPath query itself. Unlike XXE, XPath injection specifically targets the query language used to navigate and select nodes within an XML document, rather than facilitating the reading of arbitrary files from the server's filesystem through external entity processing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web application is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are potential impacts of successfully exploiting an XXE vulnerability?
easy- A.SQL injection
- ✓ B.Arbitrary file read on the server
- ✓ C.Denial of Service (DoS)
- ✓ D.Server-Side Request Forgery (SSRF)
- E.Remote code execution via command injection
Why B: XXE can be used for reading local files (e.g., /etc/passwd), performing SSRF by making the server issue requests, and causing denial of service (e.g., billion laughs attack).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.