CEH Web Application and Injection Attacks Practice Question
An application allows users to upload XML files for processing. A tester uploads the following payload: <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>. The server returns the contents of /etc/passwd. Which attack is being performed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
XML External Entity (XXE) injection
This is an XML External Entity (XXE) injection attack, where an external entity is defined to read a local file. The server's XML parser processes the entity and reflects the file content, confirming the vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
XML External Entity (XXE) injection
Why this is correct
XML External Entity (XXE) injection is the correct vulnerability because the provided payload explicitly defines an external entity within the DOCTYPE declaration. By referencing "file:///etc/passwd" via the SYSTEM identifier, the XML parser is instructed to retrieve the content of the specified local file. This content is then processed and potentially returned in the application's response, confirming the successful exploitation of the XML parser's ability to resolve external entities.
- ✗
SQL injection
Why it's wrong here
SQL injection is incorrect because the attack targets the application's XML parser, not a database backend via SQL queries. The payload consists of well-formed XML with an entity declaration, lacking any SQL syntax or attempts to manipulate database commands. This vulnerability exploits how XML documents are processed, entirely separate from how SQL statements are constructed or executed.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) is not the vulnerability here as it primarily involves injecting malicious client-side scripts, typically JavaScript, into web pages viewed by other users. The provided payload, an XML document with an external entity declaration, aims to read a server-side file, not to execute code within a user's browser. XSS exploits browser rendering, whereas this attack targets server-side XML parsing capabilities.
- ✗
Server-Side Request Forgery (SSRF)
Why it's wrong here
Server-Side Request Forgery (SSRF) is not the primary vulnerability, although XXE can sometimes facilitate SSRF-like behavior. This specific payload directly leverages the XML parser's ability to resolve local file paths using the "file://" protocol to read "/etc/passwd". While XXE can be used to make HTTP requests to internal systems, the core mechanism here is local file inclusion through an external entity, distinct from forging HTTP/S requests to arbitrary URLs.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.