CEH Web Application and Injection Attacks Practice Question
During a web application penetration test, a tester discovers a file inclusion vulnerability. Which THREE of the following are potential impacts or exploitation scenarios? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disclosure of sensitive files like /etc/passwd
LFI can lead to remote code execution (via log poisoning), local file disclosure (e.g., /etc/passwd), and session hijacking (by including session files). Port scanning is not a direct impact of file inclusion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disclosure of sensitive files like /etc/passwd
Why this is correct
Local File Inclusion (LFI) vulnerabilities allow an attacker to read arbitrary files from the server's file system. By manipulating the vulnerable parameter with paths like /etc/passwd or /etc/shadow, an attacker can directly access and disclose critical system configuration files, user credentials, or application source code. This exposure of sensitive data is a primary and direct impact of LFI, providing valuable information for further exploitation.
- ✓
Remote code execution via log poisoning
Why this is correct
Log poisoning is a sophisticated technique where an attacker injects malicious code, typically PHP, into a server log file (e.g., Apache access logs) by crafting a request that gets logged. Subsequently, the LFI vulnerability is exploited to include this poisoned log file. When the web server processes the included log file, it interprets and executes the injected code, granting the attacker remote code execution capabilities on the server.
- ✗
Port scanning of internal network hosts
Why it's wrong here
Local File Inclusion (LFI) vulnerabilities are fundamentally designed to read or include files from the local server's file system. They do not provide the necessary network primitives or capabilities to initiate outbound network connections or probe ports on other internal network hosts. Therefore, LFI alone cannot be used as a mechanism for port scanning, as its scope is limited to file system interactions rather than network reconnaissance.
- ✗
Denial of service by including large files
Why it's wrong here
While theoretically possible to cause a denial of service by repeatedly including extremely large files, this is generally not considered a primary or efficient impact of Local File Inclusion. Such an attack would consume server resources like CPU and memory, potentially leading to slow performance or crashes. However, LFI's primary and more impactful consequences typically involve information disclosure or remote code execution, which offer greater strategic advantage to an attacker.
- ✓
Session hijacking by including session files
Why this is correct
An LFI vulnerability can be leveraged to read server-side session files, which often store sensitive user session data, including session IDs. By locating and including these files (e.g., /var/lib/php/sessions/sess_PHPSESSID), an attacker can extract a valid session ID. This stolen session ID can then be used to impersonate the legitimate user, bypassing authentication mechanisms and effectively hijacking their active session.
Go deeper
Related to this question
Learn chapter
Scanning Networks
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:
medium- A.Command injection
- B.Local File Inclusion (LFI)
- ✓ C.Directory traversal
- D.Server-Side Request Forgery (SSRF)
Why C: Directory traversal (also known as path traversal) allows an attacker to access files outside the intended directory by using '../' sequences.
Variation 2. During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?
medium- ✓ A.Local File Inclusion (LFI)
- B.Remote File Inclusion (RFI)
- C.Command Injection
- D.Directory Traversal
Why A: Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.
Variation 3. A web application uses a parameter 'file' to include server-side files. The following request is intercepted: GET /page.php?file=../../../etc/passwd HTTP/1.1. The response contains the contents of /etc/passwd. This vulnerability is most likely which of the following?
hard- ✓ A.Local File Inclusion (LFI)
- B.Directory Traversal
- C.Command Injection
- D.Remote File Inclusion (RFI)
Why A: The request uses path traversal sequences (../) to access a file outside the web root. Since the application then *includes* and displays the contents of this local file (`/etc/passwd`), this is a classic example of a Local File Inclusion (LFI) vulnerability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.