CEH Web Application and Injection Attacks Practice Question
Which of the following is a symptom of a successful command injection attack?
⚠ Common exam trap
The CEH exam often tests the distinction between reflected output (visible in the response) and blind injection (no visible output), so candidates must recognize that seeing command output like 'id' is a direct symptom of a successful non-blind command injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The output of the 'id' command appears in the response
In a successful command injection attack, the attacker injects operating system commands into a vulnerable input field, and the web application passes them to a shell for execution. If the application returns the command output in the HTTP response, seeing the result of the 'id' command (e.g., 'uid=33(www-data) gid=33(www-data) groups=33(www-data)') is a definitive symptom that the injection succeeded and the server executed the attacker's command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server returns a 404 error
Why it's wrong here
A 404 Not Found error explicitly signifies that the server could not locate the requested resource. This HTTP status code indicates a failure to find a specific file or path, rather than the successful execution of an arbitrary operating system command. A successful command injection would typically result in a 200 OK status with altered content, or a different error code related to the command's execution, not a missing resource.
- ✓
The output of the 'id' command appears in the response
Why this is correct
The appearance of the 'id' command's output, such as user and group IDs, directly within the web application's response is a definitive indicator of successful command injection. This demonstrates that an arbitrary operating system command was not only executed on the server but also that its standard output was captured and reflected back to the attacker, providing undeniable proof of remote code execution.
- ✗
The HTTP response header contains 'Server: Apache'
Why it's wrong here
The presence of 'Server: Apache' in an HTTP response header merely indicates the type of web server software being used. This header is a standard component of HTTP responses and is often included by default for informational purposes. It provides no specific evidence that a command injection attack has successfully executed an arbitrary operating system command on the server, as it is present regardless of any malicious activity.
- ✗
The page loads slower than usual
Why it's wrong here
A page loading slower than usual is a highly ambiguous symptom that lacks specificity for diagnosing a successful command injection. Performance degradation can stem from numerous factors, including network congestion, high server load, complex database queries, or inefficient application code. While an injected command might occasionally cause a delay, this symptom alone is insufficient and unreliable to confirm successful command execution.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.