CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Command injection

  Why it's wrong here

  Command injection vulnerabilities allow an attacker to execute arbitrary operating system commands on the host server by injecting malicious input into an application. This typically occurs when an application passes user-supplied data directly to a system shell without proper sanitization. The provided URL pattern `../` is a path manipulation technique used to traverse directories, not to inject and execute system commands, making this option incorrect.

• ✗

  Local file inclusion (LFI)

  Why it's wrong here

  Local File Inclusion (LFI) is a vulnerability where an application includes a local file specified by the user, often leading to information disclosure or remote code execution. While LFI attacks frequently utilize directory traversal techniques (like `../`) to specify the target file's path, the question specifically describes the *method* of path manipulation itself. The URL pattern `../` is the direct indicator of a directory traversal attempt, which is a technique, whereas LFI is a broader vulnerability class.

• ✓

  Directory traversal

  Why this is correct

  Directory traversal, also known as path traversal, is an attack that allows an attacker to access files and directories stored outside the intended web root directory. This is achieved by manipulating variables that reference files with "dot-dot-slash" (`../`) sequences, or similar absolute path representations, to navigate the file system. The URL pattern `../` precisely exemplifies this technique, enabling the attacker to move up the directory hierarchy to access unauthorized files.

• ✗

  Remote file inclusion (RFI)

  Why it's wrong here

  Remote File Inclusion (RFI) is a vulnerability that allows an attacker to include a remote file, usually via a URL, on the vulnerable server. This typically leads to remote code execution as the server fetches and executes code from an external source. The URL pattern `../` is exclusively used for navigating *local* file system paths, not for specifying or including files from a remote server, making it distinct from RFI.

Go deeper

Related to this question