CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remote file inclusion

  Why it's wrong here

  Remote file inclusion (RFI) abuses server-side file inclusion functions, such as PHP's include(), to load and execute a malicious file from an external URL, typically through payloads containing http://, ftp://, or data:// wrappers in request parameters like ?page=. A UNION SELECT statement is SQL syntax that combines database query results; it neither specifies a remote resource nor triggers a file system include operation. The observed log entry therefore indicates an attack against the database layer, not a remote file inclusion attempt.

• ✓

  SQL injection

  Why this is correct

  The presence of UNION SELECT in a query parameter is a classic, definitive indicator of in-band SQL injection. An attacker appends a UNION-based query to the original SQL statement that the application executes against the backend database; if the attacker correctly matches the number and data types of the original query's columns, the database returns the attacker's chosen rows alongside the legitimate results, enabling data exfiltration. This technique operates entirely within the database engine and does not involve remote file loading, client-side script execution, or filesystem path traversal, making the log evidence fully consistent with an automated SQL injection probe.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting (XSS) requires the injection of client-side executable content, such as <script> tags, event handlers like onerror=alert(1), or javascript: URIs, that the victim's browser renders and executes after the server reflects or stores the payload. A UNION SELECT statement is pure SQL syntax containing no HTML, JavaScript, or other browser-interpreted content; it is processed server-side by the database and never executed in the client's browser. Therefore, the log entry represents a server-side SQL injection attack, not a client-side XSS payload.

• ✗

  Directory traversal

  Why it's wrong here

  Directory traversal attacks exploit insufficient file path sanitization by using ../ sequences or URL-encoded variants like %2e%2e%2f to navigate outside the web root and read arbitrary files, typically through parameters that specify a file path, template name, or page name. The payload UNION SELECT is not a filesystem path expression and contains no directory traversal characters; it is SQL syntax that the database parser interprets. Because the attack targets SQL query logic rather than file path resolution, the log entry is a clear indicator of SQL injection, not directory traversal.

Go deeper

Related to this question