GCIH Web App Injection Attacks Practice Question
During an incident response engagement at a healthcare portal, an analyst reviews an Apache access.log entry: GET /report.php?view=..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1 with a 200 response size of 1845 bytes. The application runs as www-data on Linux and the 'view' parameter is passed directly to readfile() without sanitization. Which web application injection attack class best describes what the attacker successfully executed?
⚠ Common exam trap
The trap here is assuming any ../ sequence indicates Remote File Inclusion or command execution, when the parameter's sink function determines whether code runs or only file contents are disclosed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Local File Inclusion via path traversal, allowing arbitrary file read within filesystem permissions
The URL-encoded traversal sequence in the 'view' parameter, combined with a 200 response and non-trivial body size, shows the application returned a file outside its intended directory. Since the parameter feeds PHP's readfile() rather than a shell or database call, the correct classification is Local File Inclusion via path traversal. The impact is limited to reading files accessible to the web server's user account, which still exposes credential material such as /etc/passwd.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL Injection, because the traversal sequence is being interpreted by the database engine
Why it's wrong here
SQL Injection manifests in database queries and would show SQL syntax errors, UNION SELECT clauses, or database-specific comment markers in the parameter. The payload here targets the filesystem path passed to readfile(), not a SQL statement, and the retrieved file is a Linux credential file rather than database data. No database interaction is evidenced in the log.
- ✗
OS Command Injection, because readfile() ultimately invokes the operating system to open the file
Why it's wrong here
OS Command Injection requires user input to be concatenated into a shell command executed via functions like system(), exec(), or shell_exec(). Here readfile() is a PHP filesystem function that reads bytes directly; it does not spawn a shell. The attacker supplied no shell metacharacters (;, |, &&), so no command execution occurred despite the file being read from disk.
- ✓
Local File Inclusion via path traversal, allowing arbitrary file read within filesystem permissions
Why this is correct
The encoded ../ sequences (%2f is URL-encoded '/') combined with a 200 response of 1845 bytes indicate the readfile() call resolved outside the intended directory and returned /etc/passwd contents. Because only reading occurs and no code executes, this is LFI/path traversal, not remote code execution, and it is constrained to files readable by the www-data account.
- ✗
Remote File Inclusion, because the attacker supplied a path referencing a remote resource
Why it's wrong here
RFI requires the vulnerable parameter to accept a URL such as http://attacker/evil.txt and for PHP's allow_url_include to be enabled. The observed payload uses relative filesystem traversal to /etc/passwd over the local filesystem, so no remote resource is fetched and no code is included. RFI would typically show an external hostname in the parameter and often an outbound connection.
About these practice questions
One of 322 original GCIH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.