CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Command injection; remote shell access

  Why it's wrong here

  The log entry does not exhibit characteristics of a command injection attempt. Command injection involves injecting operating system commands, such as `ls` or `cat`, into an application's input that is then executed by the underlying system. The observed `../` sequences and file path (`/etc/passwd`) clearly indicate an attempt to manipulate a file path for reading, rather than executing an arbitrary system command or using shell metacharacters.

• ✓

  Directory traversal; reading sensitive files

  Why this is correct

  The presence of `../` sequences in the URL path is a definitive indicator of a directory traversal (also known as path traversal) attack. This technique exploits vulnerabilities in file handling routines to access files and directories stored outside the intended web root directory by manipulating relative paths. The goal is often to read sensitive system files, such as `/etc/passwd`, or configuration files, leading directly to unauthorized information disclosure.

• ✗

  SQL injection; data exfiltration

  Why it's wrong here

  This request does not represent an SQL injection attempt. SQL injection attacks involve inserting malicious SQL statements into an input field, which are then executed by an underlying database server. Typical indicators include SQL keywords like `SELECT`, `UNION`, or `OR`, along with single quotes or comments. The provided log entry, however, clearly shows path manipulation with `../` sequences targeting a file system path, not database query syntax.

• ✗

  Remote File Inclusion (RFI); arbitrary code execution

  Why it's wrong here

  The request does not indicate a Remote File Inclusion (RFI) vulnerability. RFI allows an attacker to include a *remote* file, typically hosted on an attacker-controlled server, into the vulnerable application, often leading to arbitrary code execution. In contrast, the log entry shows an attempt to access a *local* file (`../../../../etc/passwd`) using path traversal, not an external URL or resource, therefore it is not an RFI attempt.

Go deeper

Related to this question