CHFI OS and Network Forensics Practice Question
A network analyst captures traffic and sees an HTTP request containing: GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1. Which of the following is MOST likely occurring?
⚠ Common exam trap
The CHFI exam often tests the distinction between webshell (command execution) and code injection (SQLi/XSS). The trap here is that candidates see a parameter (`cmd=id`) and mistakenly think it is SQL injection, but the absence of SQL syntax and the presence of a system command (`id`) clearly point to a webshell.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Webshell access
The HTTP request `GET /wp-content/uploads/evil.php?cmd=id HTTP/1.1` indicates that the attacker is accessing a PHP file (`evil.php`) in the WordPress uploads directory and passing a command (`cmd=id`) to it. This is a classic indicator of a webshell — a malicious script uploaded to the server that allows remote command execution. The `id` command is a common Unix command used to verify the current user context, confirming the attacker has achieved interactive shell-like access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Webshell access
Why this is correct
The request to a PHP file carrying a 'cmd' parameter is the hallmark of a webshell: the script accepts the parameter and passes it to a server-side command execution function such as system(), exec(), or passthru(). This gives the attacker a remote command prompt on the web server, so the observed traffic is direct evidence of webshell access rather than any of the other attack classes.
- ✗
SQL injection attack
Why it's wrong here
A SQL injection attack operates at the database layer by altering the syntax of a SELECT, INSERT, or other SQL statement, usually through parameters embedded in queries like id=1' OR '1'='1. The 'cmd' parameter observed here is not being concatenated into a query string to manipulate database logic; it is being consumed by PHP to run operating-system commands. SQLi would yield database errors or data leakage, not a command shell, so this traffic pattern does not match SQL injection.
- ✗
Cross-site scripting (XSS) attack
Why it's wrong here
Cross-site scripting is a client-side vulnerability in which an attacker causes the browser to execute malicious JavaScript by injecting script payloads into stored or reflected page output. The observed request is a direct server-side invocation of a PHP file with a command parameter; there is no vector for the payload to execute in a victim's browser. XSS would produce anomalous script tags or encoded JavaScript in HTTP responses, not a 'cmd' parameter feeding a server-side command interpreter.
- ✗
Directory traversal attack
Why it's wrong here
A directory traversal attack exploits insufficient path validation by inserting traversal sequences such as ../../etc/passwd into file-serving parameters to read arbitrary files outside the web root. The observed 'cmd' parameter does not specify a filesystem path for retrieval; it specifies a command to be executed by the PHP script. Directory traversal would yield file contents in the response, whereas this request would yield the output of an executed command, so the two are distinctly different attack types.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.