CEH Practice Test 45 — 15 Questions

Question 1

During a web application assessment, a tester intercepts a request and modifies the 'Referer' header. The application then performs a state-changing action without requiring a token. Which vulnerability is most likely present?

Accepted Answer

Cross-site request forgery (CSRF). Cross-Site Request Forgery (CSRF) attacks rely on the application not verifying the origin of the request; a missing CSRF token and lack of Referer validation make the application vulnerable.

Answer

Cross-site scripting (XSS)

Answer

Server-side request forgery (SSRF)

Answer

Clickjacking

Question 2

A web server is configured with WebDAV and allows PUT requests. An attacker uploads a .asp file and accesses it to execute code. Which tool or method is most directly associated with exploiting this misconfiguration?

Accepted Answer

File upload vulnerability. WebDAV with PUT enabled allows attackers to upload arbitrary files, including web shells, leading to remote code execution.

Answer

SQL injection

Answer

Directory brute forcing

Answer

Cross-site scripting (XSS)

Question 3

Which THREE of the following are common types of SQL injection attacks? (Select three)

Accepted Answer

Out-of-band SQL injection. In-band SQL injection (including error-based and union-based) are classic types. Blind SQL injection (boolean-based and time-based) are also common. Out-of-band is less common but still a type.

Answer

Reflected SQL injection

Answer

Stored SQL injection

Question 4

A web server is found to have directory listing enabled for the /uploads folder. An attacker discovers a shell.php file uploaded earlier. Which attack is the attacker MOST likely to perform next?

Accepted Answer

Remote code execution via uploaded shell. With directory listing, the attacker can find the path to the uploaded shell and then access it to execute commands on the server.

Answer

File inclusion

Answer

Cross-site scripting

Answer

SQL injection

Question 5

Which of the following is a primary defense against SQL injection attacks?

Accepted Answer

Prepared statements. Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.

Answer

HTTPS encryption

Answer

Input blacklisting

Answer

Output encoding

Question 6

A web application uses an XML parser to process user-supplied XML documents. An attacker submits the following payload: ]>&xxe;. Which vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. The payload defines an external entity that reads a local file, which is classic XXE (XML External Entity) injection.

Answer

Server-Side Request Forgery (SSRF)

Answer

XPath injection

Answer

SQL injection

Question 7

Which THREE of the following are common attack vectors against IoT devices? (Choose three.)

Accepted Answer

Firmware reversing. Default credentials, insecure protocols like MQTT, and firmware reversing are all common IoT attack vectors. SQL injection is more typical for web applications.

Answer

Container escape

Answer

SQL injection

Question 8

In Burp Suite, which tool is used to modify and resend individual HTTP requests to observe responses, allowing manual testing of input validation and parameter manipulation?

Accepted Answer

Repeater. Burp Repeater is designed for manually crafting and resending requests to see individual responses, ideal for testing parameter handling.

Answer

Proxy

Answer

Scanner

Answer

Intruder

Question 9

Which OWASP Top 10 (2021) category describes the vulnerability where an application allows an attacker to include a remote file from an external server, leading to code execution or data disclosure?

Accepted Answer

Injection (A03:2021). Injection (A03:2021) covers various injection flaws, including Remote File Inclusion (RFI). RFI is a type of injection where user input is used to include a remote file, leading to code execution.

Answer

Security Misconfiguration (A05:2021)

Answer

Broken Access Control (A01:2021)

Answer

Cryptographic Failures (A02:2021)

Question 10

Which TWO of the following are effective defenses against CSRF attacks? (Choose 2.)

Accepted Answer

Using anti-CSRF tokens that are validated on the server. CSRF tokens and SameSite cookies both prevent cross-site request forgery. Double Submit Cookie is also a method but not listed. Custom headers are not a standard defense; the primary ones are CSRF tokens and SameSite cookies.

Answer

Setting the Secure flag on cookies

Answer

Using input validation to block special characters

Answer

Enabling the HttpOnly flag on session cookies

Question 11

A web application allows users to access files using parameters like 'file=report.pdf'. A tester changes the parameter to '../../etc/passwd' and retrieves the system password file. This is an example of which attack?

Accepted Answer

Directory traversal. Directory traversal attacks exploit insufficient input validation to access files outside the intended directory by using '../' sequences.

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Answer

Command injection

Question 12

A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF). This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.

Answer

Command injection

Answer

Remote File Inclusion (RFI)

Answer

Directory traversal

Question 13

An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?

Accepted Answer

Trying a few common passwords against many accounts. Password spraying uses a few common passwords against many accounts to avoid account lockout.

Answer

Using a list of compromised credentials from a data breach

Answer

Trying many passwords for a single account

Answer

Using automated tools to bypass CAPTCHA

Question 14

Which of the following tools is specifically designed to automate the exploitation of SQL injection vulnerabilities and retrieve data from databases?

Accepted Answer

SQLMap. SQLMap is an open-source tool that automates detection and exploitation of SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 15

A penetration tester identifies a web page that reflects user input in the response without proper encoding. The input is submitted via a GET parameter. Which type of cross-site scripting (XSS) is MOST likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization, typically via GET parameters.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS