CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Local File Inclusion (LFI)

  Why it's wrong here

  Local File Inclusion (LFI) vulnerabilities occur when an application includes a file based on user input without proper validation, typically using functions like `include()` or `require()` in PHP. This allows an attacker to execute malicious files on the server or read sensitive data from local files, but it does not involve the parsing of XML documents or the processing of external entities. The mechanism of exploitation is distinct from XML-based vulnerabilities.

• ✗

  Server-Side Request Forgery (SSRF)

  Why it's wrong here

  Server-Side Request Forgery (SSRF) involves tricking a server-side application into making requests to an unintended location, which can be an internal network resource or an external system. While an XXE vulnerability can sometimes *lead* to SSRF, SSRF itself is the act of the server making an HTTP request on behalf of the attacker, not the initial exploitation method involving XML entity processing to read local files or interact with internal services directly through the XML parser.

• ✓

  XML External Entity (XXE) Injection

  Why this is correct

  XML External Entity (XXE) injection occurs when an XML parser processes XML input containing a reference to an external entity without proper validation. This vulnerability allows an attacker to define custom entities that can reference local files, network resources, or even execute commands, leading to the disclosure of sensitive data, denial-of-service, or server-side request forgery. The ability to read local files directly via the XML parser is a hallmark of XXE.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. This is typically achieved by injecting malicious SQL code into input fields, which is then executed by the database server. The scenario described, involving the discovery of a web application vulnerability that allows reading local files, does not align with the mechanism or typical outcomes of a SQL injection attack, which targets database interactions.

Go deeper

Related to this question