312-39 practice question 3 of 35

Which of the following attack can be eradicated by disabling of "allow_url_fopen and allow_url_include" in the php.ini file?

Full set: 100 questions

Answer options

A: File Injection Attacks Correct answer

B: URL Injection Attacks

C: LDAP Injection Attacks

D: Command Injection Attacks

Correct Answer:

A. File Injection Attacks

Explanation

Disabling the allowurlfopen and allowurlinclude directives in the php.ini configuration file is a critical security measure against Remote File Inclusion (RFI) attacks. RFI is a specific type of File Injection vulnerability where an attacker causes the web application to fetch and execute a malicious file from a remote URL. By setting these directives to Off, PHP is prevented from treating URLs as files for inclusion or file-opening operations, thus directly mitigating the RFI threat vector.

Why Incorrect

B. URL Injection Attacks: This is a broader term. These settings specifically prevent file inclusion from URLs, not all forms of URL manipulation or redirection attacks.
C. LDAP Injection Attacks: This attack targets applications querying LDAP directories. It is unrelated to PHP's file handling capabilities and is mitigated by input validation.
D. Command Injection Attacks: This involves executing OS commands through a vulnerable application. It is a separate vulnerability class not directly prevented by these specific PHP directives.

References

1. PHP. (n.d.). Description of core php.ini directives. PHP: The PHP Documentation. Retrieved from https://www.php.net/manual/en/ini.core.php. See descriptions for allowurlfopen and allowurlinclude.

2. OWASP Foundation. (n.d.). File Inclusion. OWASP Cheat Sheet Series. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/FileInclusionCheatSheet.html. (Note: While OWASP is a non-profit, its publications are widely adopted as de facto standards and referenced in academic and official contexts for cybersecurity principles). Section "Remote File Inclusion (RFI)" explains the vulnerability mitigated by these settings.

Question breakdown

Tests: Mitigating file inclusion/injection attacks in PHP
Difficulty: Easy

Key idea: Disabling allow_url_fopen and allow_url_include stops PHP from opening or including remote files, which mitigates remote file inclusion (file injection) attacks.

How to reach the answer

The clue is the two php.ini directives, both of which govern how PHP treats URLs as files.
allow_url_include lets include and require pull in remote code, which is the core of remote file inclusion.
Turning both off prevents attacker-supplied URLs from being loaded as executable files.
LDAP and command injection are unrelated to file-opening settings, and 'URL injection' is not the category these directives address.

Each option

ACorrect. File injection or remote file inclusion relies on PHP including remote files, which these directives control.
BIncorrect. URL injection is not the attack these settings target; they stop remote file inclusion specifically.
CIncorrect. LDAP injection manipulates directory queries and is unaffected by PHP file-handling settings.
DIncorrect. Command injection abuses OS command execution functions, not remote file inclusion.

Common trap: The 'url' in the directive names tempts candidates to choose URL Injection Attacks.

In practice: PHP hardening baselines set allow_url_include=Off, and often allow_url_fopen=Off, to block remote file inclusion web shells. Analysts check for these settings after RFI alerts.

Remember: allow_url_fopen and allow_url_include settings relate to file inclusion/injection attacks.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free 312-39 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test