CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection is a code injection technique primarily used to attack data-driven applications by inserting malicious SQL statements into an entry field for execution. This attack vector specifically targets the database backend to manipulate or extract data, not to upload files to a web server's file system. The vulnerability described in the question involves direct file system interaction via WebDAV PUT, which is fundamentally distinct from database query alteration.

• ✓

  File upload vulnerability

  Why this is correct

  The ability to upload and execute arbitrary files via WebDAV PUT requests constitutes a critical file upload vulnerability. WebDAV's PUT method allows clients to create or replace resources on the server. If this functionality is enabled without strict access controls, file type validation, or execution restrictions, an attacker can upload malicious scripts (e.g., web shells) and subsequently execute them, leading to remote code execution on the server.

• ✗

  Directory brute forcing

  Why it's wrong here

  Directory brute forcing is a reconnaissance technique focused on discovering hidden directories and files on a web server by systematically guessing common names or using wordlists. While it helps in mapping the server's structure and finding sensitive resources, its primary function is enumeration, not the active uploading of new files. This method does not exploit a file upload mechanism like WebDAV PUT, but rather seeks to uncover existing, potentially unlinked, content.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting (XSS) is a client-side code injection attack where malicious scripts are injected into otherwise benign and trusted websites. These scripts are executed in the victim's browser, typically to steal cookies, session tokens, or deface websites. XSS fundamentally operates within the user's browser context and does not involve uploading server-side files or directly manipulating the server's file system, making it irrelevant to a WebDAV PUT vulnerability.

Go deeper

Related to this question