CEH Web Application and Injection Attacks Practice Question
A web application allows users to access files using parameters like 'file=report.pdf'. A tester changes the parameter to '../../etc/passwd' and retrieves the system password file. This is an example of which attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Directory traversal
Directory traversal attacks exploit insufficient input validation to access files outside the intended directory by using '../' sequences.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Local file inclusion (LFI)
Why it's wrong here
Local File Inclusion (LFI) involves a server-side script including a file from the local server's file system into its execution context. While LFI can sometimes leverage path traversal techniques to locate files, its primary mechanism is the server-side interpretation and execution of the included file, often leading to code execution or sensitive information disclosure through script processing, rather than merely direct file retrieval.
- ✗
Remote file inclusion (RFI)
Why it's wrong here
Remote File Inclusion (RFI) specifically refers to a vulnerability where a server-side script is tricked into including and executing a file from a remote, external Uniform Resource Locator (URL). This allows an attacker to inject and run arbitrary code hosted on their own server, which is fundamentally different from manipulating local file paths to access files already residing on the target system's local storage.
- ✗
Command injection
Why it's wrong here
Command injection exploits vulnerabilities where user-supplied input is directly incorporated into an operating system command executed by the web server. This allows an attacker to execute arbitrary system commands on the underlying server, such as `ls` or `cat`, which is a distinct attack vector from manipulating file paths to read existing files without directly invoking new system processes.
- ✓
Directory traversal
Why this is correct
Directory traversal, also known as path traversal, is an attack that exploits insufficient security validation of user-supplied file paths. By injecting special sequences like `../` (dot-dot-slash) or its URL-encoded equivalent, an attacker can navigate outside the intended directory structure, allowing them to access or read arbitrary files and directories on the server's file system that would otherwise be restricted.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?
medium- A.Command injection
- B.Local file inclusion (LFI)
- ✓ C.Directory traversal
- D.Remote file inclusion (RFI)
Why C: Directory traversal (path traversal) uses ../ sequences to access files outside the web root.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.