Local File Inclusion (LFI) WAHS Practice Questions (Page 4)

Questions 16–17

1. 16expert · hard

   A development team is remediating an LFI vulnerability in a PHP application. The application must continue to support user-selected language files from the /lang directory. The team has implemented a filter that removes ../ from the input. A security review finds that the filter can be bypassed. Which additional control would be most effective in preventing LFI?

   • ASet the open_basedir PHP directive to /lang.
   • BDisable allow_url_include in the PHP configuration.
   • CUse realpath() to verify that the resolved path starts with the /lang directory before including the file.
   • DUse basename() to strip all directory components from the input.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is testing a Java web application that uses a parameter named file to select a report template. The analyst submits file=../../../../etc/passwd and receives an error page. Which observation would most strongly indicate that the application is still vulnerable to LFI?

   • AThe error message reveals the full path of the missing file, such as /opt/app/reports/../../../../etc/passwd.
   • BThe application returns a 404 status code for the request.
   • CThe response time increases by 500 milliseconds.
   • DThe application logs the request in the access log.
   Reveal Solution Discussion Select an answer first