A technique that exploits dynamic file include mechanisms to use a remote file on the server.

A technique that exploits dynamic file include mechanisms to use a remote file on the server.

• A. LDAP Directory Services
• B. Server-side Template Injection
• C. Server-side Includes
• D. File Injection Attack

Answer: (D)

Exploiting dynamic file include mechanisms by pulling in a remote file is all about remote file inclusion. When a script uses include or require with a path supplied by the user, an attacker can steer it to fetch a file from a remote server and execute it on the target. This remote file inclusion (RFI) can give the attacker code execution, defacing, or other control over the server. The best match among the options is the one described as a File Injection Attack, because it covers injecting a file reference (such as a URL) into the server’s inclusion call. The other options don’t describe this technique: LDAP Directory Services relates to querying directories; Server-side Template Injection targets templates rather than include mechanisms; Server-side Includes is a feature that can be abused but doesn’t inherently denote remote file inclusion; File Injection Attack is the broad category that encompasses injecting references to files into server-side processes. Mitigation focuses on validating and sanitizing input, disabling remote file fetching (for example, turning off allow_url_fopen/allow_url_include where applicable), and using strict path handling and least-privilege execution.

Exploiting dynamic file include mechanisms by pulling in a remote file is all about remote file inclusion. When a script uses include or require with a path supplied by the user, an attacker can steer it to fetch a file from a remote server and execute it on the target. This remote file inclusion (RFI) can give the attacker code execution, defacing, or other control over the server.

The best match among the options is the one described as a File Injection Attack, because it covers injecting a file reference (such as a URL) into the server’s inclusion call. The other options don’t describe this technique: LDAP Directory Services relates to querying directories; Server-side Template Injection targets templates rather than include mechanisms; Server-side Includes is a feature that can be abused but doesn’t inherently denote remote file inclusion; File Injection Attack is the broad category that encompasses injecting references to files into server-side processes.

Mitigation focuses on validating and sanitizing input, disabling remote file fetching (for example, turning off allow_url_fopen/allow_url_include where applicable), and using strict path handling and least-privilege execution.