CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  XML External Entity (XXE) injection

  Why this is correct

  XML External Entity (XXE) injection occurs when an XML parser processes a DOCTYPE declaration that defines an external entity, allowing the attacker to include content from external URIs or local files into the XML document. By defining an entity that points to a file path like `/etc/passwd`, the server's XML parser will attempt to resolve and embed the file's content within the XML response or process it internally. This vulnerability leverages the server's ability to fetch resources specified within the DTD, leading to information disclosure or even server-side request forgery.

• ✗

  Directory traversal

  Why it's wrong here

  Directory traversal attacks exploit vulnerabilities in file input handling to access files and directories stored outside the intended root directory. Attackers typically use sequences like `../` (dot-dot-slash) in file paths to navigate up the directory hierarchy and access arbitrary files on the server's file system. While both XXE and directory traversal can lead to file disclosure, directory traversal specifically relies on manipulating file path strings in application input, rather than leveraging XML entity resolution mechanisms.

• ✗

  Server-Side Request Forgery (SSRF)

  Why it's wrong here

  Server-Side Request Forgery (SSRF) occurs when a web application is tricked into making requests to an arbitrary domain specified by an attacker, from the server's perspective. This allows an attacker to cause the server to connect to internal network resources, other external websites, or even itself, potentially bypassing firewalls or accessing sensitive internal services. Unlike XXE, which directly processes external content within an XML document, SSRF primarily involves manipulating URLs that the server then fetches via HTTP, not necessarily through XML entity resolution.

• ✗

  Command injection

  Why it's wrong here

  Command injection vulnerabilities allow an attacker to execute arbitrary operating system commands on the host server by injecting shell metacharacters into user-supplied input that is then passed to a system shell. This typically involves manipulating parameters that are directly used in system calls or subprocess execution, such as `system()` or `exec()`. The core mechanism of command injection is the execution of shell commands, which is fundamentally different from XXE's exploitation of XML parser features for data inclusion or server-side requests.

Go deeper

Related to this question

Same concept, more angles

1 more way this is tested on CEH

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.