CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The application includes files from http://attacker.com/shell.txt

  Why this is correct

  This scenario directly indicates Remote File Inclusion (RFI) because the application is fetching and executing or displaying content from an external, attacker-controlled HTTP server (http://attacker.com). RFI vulnerabilities allow an attacker to inject a remote URL into an include statement, causing the web server to download and process the specified file. This can lead to arbitrary code execution, data exfiltration, or defacement if the included file contains malicious scripts.

• ✗

  The application includes files with '..' and '/' sequences

  Why it's wrong here

  The presence of '..' (dot-dot-slash) and '/' sequences in file inclusion paths is characteristic of a Directory Traversal vulnerability, which typically leads to Local File Inclusion (LFI). These sequences allow an attacker to navigate the server's file system to access files outside the intended web root. While LFI can sometimes be chained with other vulnerabilities to achieve remote code execution, these patterns alone do not directly demonstrate Remote File Inclusion, which specifically involves fetching files from an external server.

• ✗

  The application includes /etc/passwd in the response

  Why it's wrong here

  Including a local system file like /etc/passwd in the application's response is a clear indicator of a Local File Inclusion (LFI) vulnerability. LFI allows an attacker to read arbitrary files present on the web server's file system. However, this action does not demonstrate Remote File Inclusion, which specifically involves the application fetching and processing files from a remote server location, not just local files.

• ✗

  The application includes files with .inc extension

  Why it's wrong here

  The file extension, such as .inc (include), does not inherently determine whether a file inclusion vulnerability is local or remote. Many web applications use .inc or similar extensions for local configuration or template files. An application could include a local .inc file via LFI, or potentially a remote one via RFI if misconfigured. Therefore, merely observing a .inc extension provides insufficient evidence to specifically identify Remote File Inclusion.

• ✓

  The application allows inclusion of files from external FTP servers

  Why this is correct

  Allowing the inclusion of files from external FTP servers unequivocally demonstrates Remote File Inclusion (RFI). RFI vulnerabilities are not restricted solely to HTTP or HTTPS protocols; they encompass any mechanism where the application fetches and processes content from a remote, external source. If an attacker can specify an ftp:// URL to include a malicious file, it confirms the presence of an RFI vulnerability, enabling potential arbitrary code execution or data manipulation.

Go deeper

Related to this question