Courseiva
← CEH
Full test
Introduction to Ethical Hacking →hardMultiple ChoiceObjective-mapped

CEH Introduction to Ethical Hacking Practice Question

Exhibit

Refer to the exhibit.

192.168.1.10   - - [01/Oct/2023:13:55:36 -0400] "GET /index.html HTTP/1.1" 200 2326
192.168.1.10   - - [01/Oct/2023:13:55:37 -0400] "GET /admin/login.php HTTP/1.1" 404 169
192.168.1.10   - - [01/Oct/2023:13:55:38 -0400] "GET /admin/ HTTP/1.1" 403 195
192.168.1.10   - - [01/Oct/2023:13:55:39 -0400] "GET /images/..%252f..%252f..%252f..%252fetc/passwd HTTP/1.1" 200 523
192.168.1.10   - - [01/Oct/2023:13:55:40 -0400] "GET /cgi-bin/test.cgi HTTP/1.1" 200 89

Based on the exhibit, what type of attack is being attempted?

⚠ Common exam trap

Many candidates confuse directory traversal with command injection because both involve manipulating input to access system resources, but directory traversal uses path sequences (`../`) while command injection uses shell metacharacters (`;`, `|`, `&`).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Directory Traversal

The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Directory Traversal

    Why this is correct

    The exhibit clearly shows an attempt to manipulate a file path using `..%2f` sequences, which are URL-encoded representations of `../`. This technique aims to navigate outside of an intended directory and access restricted files, such as `/etc/passwd`, which stores user account information on Unix-like systems. Such an attack exploits inadequate input validation on user-supplied file paths, allowing an attacker to read or potentially write to arbitrary files on the server's file system.

  • ✗

    Command Injection

    Why it's wrong here

    Command Injection involves injecting and executing arbitrary operating system commands through an application. The provided exhibit does not contain any typical command separators like semicolons (`;`), ampersands (`&`), pipes (`|`), or backticks (`` ` ``), nor does it show common command utilities such as `ls`, `cat`, or `whoami`. Therefore, there is no indication that the attacker is attempting to execute system-level commands on the server.

  • ✗

    SQL Injection

    Why it's wrong here

    SQL Injection exploits vulnerabilities in an application's database layer by inserting malicious SQL code into input fields. The exhibit lacks any characteristic SQL syntax, such as single quotes (`'`), double dashes (`--`) for comments, or keywords like `UNION`, `SELECT`, `OR`, or `AND`, which are typically used to manipulate database queries. Without these elements, the attempt does not align with the patterns of an SQL injection attack targeting a backend database.

  • ✗

    Cross-Site Scripting

    Why it's wrong here

    Cross-Site Scripting (XSS) attacks involve injecting malicious client-side scripts, typically JavaScript, into web pages viewed by other users. The exhibit does not display any HTML tags like `<script>`, `<img>` with `onerror` attributes, or `javascript:` pseudo-protocols commonly used to embed or execute scripts within a web browser. The observed input is focused on file path manipulation rather than browser-side script execution.

About these practice questions

One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.