CHFI Application, Email and Cloud Forensics Practice Question
An analyst examining Apache access logs finds the following entry: 192.168.1.10 - - [10/Oct/2023:13:55:36 -0400] "GET /search.php?q=1'%20OR%20'1'='1 HTTP/1.1" 200 5324 "-" "Mozilla/5.0". Which of the following attacks is MOST likely occurring?
⚠ Common exam trap
EC-Council often tests the distinction between SQL injection and XSS by using payloads that contain SQL syntax; here the single quote and OR '1'='1 tautology clearly target the database layer, not client-side script execution. Candidates might instead confuse this with path traversal or remote file inclusion, but the query-string SQL tautology confirms SQL injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
The log entry shows a GET request to /search.php with a query parameter q containing the SQL injection payload 1' OR '1'='1. This classic tautology-based SQL injection attempts to manipulate the SQL query to always return true, potentially bypassing authentication or extracting data. The 200 OK response and 5324 bytes indicate the server processed the malicious input, confirming the attack is SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SQL injection
Why this is correct
The payload contains SQL code trying to manipulate the query.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
XSS typically involves script tags or JavaScript in the request, not SQL syntax.
- ✗
Remote file inclusion
Why it's wrong here
RFI uses URLs to include remote files, not SQL syntax.
- ✗
Path traversal
Why it's wrong here
Path traversal uses '../' sequences to access files outside web root.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.