CEH Web Application and Injection Attacks Practice Question
A web server is found to have directory listing enabled for the /uploads folder. An attacker discovers a shell.php file uploaded earlier. Which attack is the attacker MOST likely to perform next?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote code execution via uploaded shell
With directory listing, the attacker can find the path to the uploaded shell and then access it to execute commands on the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
File inclusion
Why it's wrong here
File inclusion vulnerabilities, such as Local File Inclusion (LFI) or Remote File Inclusion (RFI), allow an attacker to include arbitrary files on the server or from a remote source. While an attacker might use file inclusion to execute a shell if it were already present and they needed a way to trigger it, the primary impact of directory listing in this scenario is locating an already uploaded shell, not facilitating the inclusion mechanism itself. File inclusion is a distinct vulnerability class that doesn't directly leverage directory listing for shell discovery or execution.
- ✗
Cross-site scripting
Why it's wrong here
Cross-site scripting (XSS) is a client-side vulnerability where malicious scripts are injected into web pages viewed by other users. Its primary goal is to compromise user sessions, deface websites, or redirect users, not to gain direct server-side command execution or locate uploaded files on the server's file system. Directory listing does not facilitate the injection or execution of XSS payloads; instead, it exposes server file structures, which is unrelated to client-side script execution.
- ✓
Remote code execution via uploaded shell
Why this is correct
Directory listing, when enabled, exposes the file and directory structure of the web server, allowing an attacker to browse its contents. If an attacker has successfully uploaded a web shell through a separate vulnerability (e.g., insecure file upload), directory listing allows them to precisely locate the shell's path and filename. Once the shell's URL is known, the attacker can directly access it via a web browser, enabling remote execution of arbitrary commands on the compromised server, thus achieving remote code execution.
- ✗
SQL injection
Why it's wrong here
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. It is primarily used to extract, modify, or delete data, or in some cases, execute operating system commands if the database configuration permits. Directory listing provides no direct mechanism to exploit SQL injection vulnerabilities, nor does SQL injection directly facilitate the discovery or execution of uploaded files on the web server's file system, as it targets the database layer, not the file system.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.