Which of the following attack can be eradicated by disabling of "allow_url_fopen and allow_url_include" in the php.ini file?

Question breakdown

Tests

Mitigating file inclusion/injection attacks in PHP

Difficulty

Easy

Key idea: Disabling allow_url_fopen and allow_url_include stops PHP from opening or including remote files, which mitigates remote file inclusion (file injection) attacks.

How to reach the answer

1. The clue is the two php.ini directives, both of which govern how PHP treats URLs as files.
2. allow_url_include lets include and require pull in remote code, which is the core of remote file inclusion.
3. Turning both off prevents attacker-supplied URLs from being loaded as executable files.
4. LDAP and command injection are unrelated to file-opening settings, and 'URL injection' is not the category these directives address.

Each option

• ACorrect. File injection or remote file inclusion relies on PHP including remote files, which these directives control.
• BIncorrect. URL injection is not the attack these settings target; they stop remote file inclusion specifically.
• CIncorrect. LDAP injection manipulates directory queries and is unaffected by PHP file-handling settings.
• DIncorrect. Command injection abuses OS command execution functions, not remote file inclusion.

Common trap: The 'url' in the directive names tempts candidates to choose URL Injection Attacks.

In practice: PHP hardening baselines set allow_url_include=Off, and often allow_url_fopen=Off, to block remote file inclusion web shells. Analysts check for these settings after RFI alerts.

Remember: allow_url_fopen and allow_url_include settings relate to file inclusion/injection attacks.

Drafted with AI assistance and checked against the answer key.