CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  RFI and command injection

  Why it's wrong here

  RFI (Remote File Inclusion) is incorrect because the provided PHP `include` statement does not process user input as a remote URL, which would typically begin with schemes like `http://` or `ftp://`. Command injection is also not indicated, as there is no function present (e.g., `exec()`, `shell_exec()`, `system()`, or backticks) that would execute operating system commands based on user input. The `include` function is designed for file system operations, not direct command execution.

• ✓

  LFI and null byte injection

  Why this is correct

  LFI (Local File Inclusion) is the primary vulnerability, as the `include` function directly incorporates a local file path derived from user input, allowing an attacker to traverse directories (e.g., `../../`) and include arbitrary files from the server's file system. Null byte injection (`%00`) is crucial here because it can bypass the `.php` extension automatically appended by the application. By injecting `%00` after the desired file path (e.g., `/etc/passwd%00`), the server's string handling may truncate the string at the null byte, effectively ignoring the unwanted `.php` extension and including the specified file.

• ✗

  SQL injection and XSS

  Why it's wrong here

  SQL injection is not applicable because the PHP code snippet does not interact with a database; there are no SQL queries being constructed or executed based on user input. Similarly, XSS (Cross-Site Scripting) is irrelevant as the `include` function processes file paths on the server-side and does not output user-controlled data directly into a web page in a client-side executable context. The vulnerability lies in file inclusion, not in manipulating database queries or injecting client-side scripts into a browser.

• ✗

  Directory traversal and IDOR

  Why it's wrong here

  While directory traversal is a *component* of exploiting Local File Inclusion to reach files outside the intended directory, it is not the overarching vulnerability type itself in this context; LFI is the more precise classification. IDOR (Insecure Direct Object Reference) is entirely unrelated to this scenario. IDOR involves accessing unauthorized resources by manipulating an object's identifier (e.g., `user_id=123`), whereas this code deals with file path manipulation and inclusion.

Go deeper

Related to this question