CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Path Traversal

  Why it's wrong here

  Path Traversal manipulates file paths using sequences like ../ to escape the web root and read arbitrary files. This request instead injects a UNION SELECT statement into a SQL query parameter, indicating SQL injection. Path traversal would be the answer if the payload contained directory traversal sequences targeting the filesystem.

• ✓

  SQL Injection

  Why this is correct

  The URL-encoded payload `1' UNION SELECT 1,2,3--` in the query string is the defining signature: the apostrophe closes the string literal, UNION SELECT appends attacker-controlled columns, and `--` comments out the remainder. This satisfies the stem's request to identify the attack from the log entry, confirming SQL injection rather than XSS or traversal.

• ✗

  Cross-Site Scripting (XSS)

  Why it's wrong here

  Cross-Site Scripting (XSS) is incorrect because the payload `1%27%20UNION%20SELECT%201,2,3--` comprises SQL syntax designed to manipulate a server-side database query, not client-side script intended for browser execution. This option is tempting as both XSS and SQL Injection often utilise URL parameters for payload delivery. However, XSS would be indicated by the presence of client-side script elements, such as `<script>` tags, aimed at executing within a user's web browser, rather than database commands.

• ✗

  Remote File Inclusion

  Why it's wrong here

  Remote File Inclusion exploits a parameter that loads an external URL into the script, typically showing a path or URL in the request. Here the payload is a SQL UNION SELECT injection in the q parameter, so the mechanism is database query manipulation, not file inclusion. RFI would be correct for a vulnerable include parameter.