CEH Web Application and Injection Attacks Practice Question
During a penetration test, you identify a parameter in a web application that appears to fetch a file from the server. You modify the parameter to '../../../etc/passwd' and see the contents of the passwd file. Which type of vulnerability is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Directory traversal
The use of '../' sequences to traverse directories and access files outside the web root is classic directory traversal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remote File Inclusion (RFI)
Why it's wrong here
Remote File Inclusion (RFI) vulnerabilities occur when a web application includes a file from a remote server, specified by an attacker-controlled URL, into its execution context. This typically leads to remote code execution as the server fetches and interprets arbitrary code from an external source, rather than navigating the local file system to read existing files.
- ✓
Directory traversal
Why this is correct
Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files and directories stored outside the intended root directory by manipulating file paths. This is typically achieved by injecting sequences like `../` (dot-dot-slash) into input parameters, enabling navigation upwards in the directory hierarchy to read sensitive system files or application configuration.
- ✗
Server-Side Request Forgery (SSRF)
Why it's wrong here
Server-Side Request Forgery (SSRF) compels the server-side application to make HTTP requests to an arbitrary domain specified by the attacker, which can target internal network resources or external servers. The vulnerability exploits the server's ability to initiate connections, forcing it to fetch data from a URL, rather than directly manipulating local file paths to read files on its own filesystem.
- ✗
Local File Inclusion (LFI)
Why it's wrong here
Local File Inclusion (LFI) allows an attacker to include a local file on the server into the currently executing script, often leading to information disclosure or remote code execution if the included file contains executable code. While it involves local files, the primary mechanism is *inclusion* within the application's processing flow, distinct from simply traversing directories to read raw file content via path manipulation.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.