CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Server-Side Request Forgery (SSRF)

  Why it's wrong here

  Server-Side Request Forgery (SSRF) involves an attacker coercing a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. While an XXE vulnerability can sometimes be leveraged to perform SSRF by fetching external URLs, the primary attack described here—reading a local file directly through XML entity expansion—is fundamentally an XML processing vulnerability, not an HTTP request manipulation attack in its core mechanism.

• ✗

  XPath injection

  Why it's wrong here

  XPath injection specifically targets applications that construct XPath queries from user-supplied input without proper sanitization. Attackers inject malicious XPath syntax to alter the query logic, potentially bypassing authentication or retrieving unauthorized data from an XML document. This attack vector is distinct from the manipulation of XML entity declarations for file system access, which is the hallmark of an XXE vulnerability.

• ✓

  XML External Entity (XXE) injection

  Why this is correct

  XML External Entity (XXE) injection is the correct answer because the scenario describes an attacker leveraging an XML parser to process user-supplied XML containing references to external entities. By defining an external entity that points to a local file path, such as file:///etc/passwd, the vulnerable parser is tricked into reading the content of that file. This content is then embedded within the XML document's response, leading to the unauthorized disclosure of sensitive server-side information.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection is a distinct type of vulnerability where an attacker inserts malicious SQL code into input fields to interfere with an application's database queries. This attack exploits improper sanitization of user input before it is incorporated into SQL statements, allowing for data manipulation or extraction. The described scenario, however, involves manipulating an XML parser with an XML payload, making SQL injection entirely irrelevant to the attack vector.

Go deeper

Related to this question