CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Local File Inclusion (LFI)

  Why it's wrong here

  Local File Inclusion (LFI) vulnerabilities allow an attacker to include and execute arbitrary files from the local server's file system within the context of the web application. While LFI often leverages directory traversal techniques to locate the target file, its primary impact stems from the application's attempt to process the included file, potentially leading to information disclosure, arbitrary code execution, or denial of service. The core distinction is the act of inclusion and execution by the application, rather than merely reading a file's content directly.

• ✓

  Directory traversal

  Why this is correct

  Directory traversal, also known as path traversal, is a vulnerability that permits an attacker to read arbitrary files on the server's file system by manipulating file paths in user-supplied input. This exploit uses sequences like "../" (dot-dot-slash) to navigate outside the intended directory, bypassing security controls that fail to properly validate or sanitize file names or paths. The ability to "view documents by specifying" a path directly aligns with this vulnerability, as it focuses on accessing files located anywhere on the server.

• ✗

  Remote File Inclusion (RFI)

  Why it's wrong here

  Remote File Inclusion (RFI) exploits a vulnerability where a web application includes and executes a remote file, typically hosted on an attacker-controlled server, as part of its own script. This often leads to severe consequences, including arbitrary code execution on the vulnerable server, as the application processes the external content. Unlike directory traversal, RFI does not involve navigating the local file system but rather fetching and integrating content from an external, untrusted source.

• ✗

  Command injection

  Why it's wrong here

  Command injection occurs when an attacker can execute arbitrary operating system commands on the host server by injecting malicious input into an application that constructs system commands without proper sanitization. This vulnerability typically leverages shell metacharacters (e.g., "&", "|", ";") to append or chain additional commands to the legitimate one. This is fundamentally different from file path manipulation, as it targets the execution of OS commands rather than merely accessing or reading files on the file system.

Go deeper

Related to this question