CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  SQL injection (SQLi) attack

  Why this is correct

  The log entry contains classic SQL injection signatures: quote characters, SQL logical operators such as OR and AND, and observable query fragments like UNION SELECT. These tokens indicate an attempt to terminate a string literal and append a new SQL predicate to manipulate the database's response. A successful injection of this nature could allow an attacker to bypass authentication, extract data, or modify records, making this the correct classification.

• ✗

  Cross-site scripting (XSS) attack

  Why it's wrong here

  Cross-site scripting attacks are characterized by injected client-side code, typically <script> tags, event handler attributes (onerror, onload), or javascript: URIs, all designed to execute in a victim's browser. The observed payload contains none of these indicators; instead, it uses SQL-specific syntax such as quotes and boolean operators. XSS targets the client-side DOM, whereas the log entry shows an attempt to affect the server-side SQL query parser, so this verdict is incorrect.

• ✗

  Path traversal attack

  Why it's wrong here

  Path traversal attacks rely on directory traversal sequences like ../, ..\, or encoded variants (%2e%2e%2f) to escape the web root and access sensitive files such as /etc/passwd or web.config. The log entry's payload is devoid of these sequential dot-dot-slash patterns and instead presents SQL artifacts like single quotes and OR clauses. Since the request is aimed at query manipulation rather than filesystem navigation, path traversal does not apply here.

• ✗

  Remote file inclusion (RFI) attack

  Why it's wrong here

  Remote file inclusion attacks append external URLs — generally http:// or https:// — often with embedded file names or shell payloads, to dynamic include parameters so the server executes remote code. The logged request carries SQL tokens, not a remote resource locator, and there is no evidence of an external host being referenced. RFI compromises server-side file inclusion mechanisms, whereas this payload is clearly targeting a database's SQL interpreter, making this classification wrong.