Calvin, a software developer, uses a feature that helps him auto-generate the content of a...

The scenario describes an injection attack involving Server Side Includes (SSI). SSI directives are instructions placed in web pages that are executed by the web server before the page is sent to the user. If user input is improperly validated and directly used in an SSI-enabled environment, attackers can inject malicious SSI directives (such as file manipulation commands).

From CEH v13 Official Courseware:

Server-Side Includes (SSI) Injection occurs when attackers submit specially crafted input that is included in server responses and interpreted as SSI directives.

These directives can perform dangerous actions like:

Reading sensitive files (e.g., /etc/passwd)

Deleting or modifying files

Running shell commands via #exec directive

Incorrect options:

A. Server-side template injection is related to template engines like Jinja2 or Twig.

B. Server-side JS injection applies to environments like Node.js.

C. CRLF injection manipulates HTTP headers, not SSI parsing.

Reference – CEH v13 Official Courseware:

Module 14: Hacking Web Applications

Section: “Injection Flaws”

Subsection: “SSI Injection”

Lab Reference: CEH iLabs – Web Application Exploitation

=