CEH Practice Test 47 — 15 Questions

Question 1

A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization. The script executes once and is not stored, distinguishing it from stored XSS. DOM-based XSS would involve client-side JavaScript manipulation without server reflection.

Answer

Blind XSS

Answer

Stored (persistent) XSS

Answer

DOM-based XSS

Question 2

A security analyst observes that a web application allows users to submit feedback, and after submission, the feedback is displayed on a public page. An attacker submits feedback containing the script: . When an admin views the public page, the script executes. Which type of attack occurred?

Accepted Answer

Stored XSS. The script is stored on the server (feedback) and executed when the admin views the page. This is persistent (stored) XSS.

Answer

Reflected XSS

Answer

Cross-site request forgery (CSRF)

Answer

DOM-based XSS

Question 3

A security analyst is reviewing a web application log and sees the following request: GET /page?file=../../../etc/passwd HTTP/1.1. Which TWO vulnerabilities are most likely being attempted? (Select two)

Accepted Answer

Directory traversal. The request uses '../' to traverse directories (directory traversal) and attempts to read the /etc/passwd file, which is also a local file inclusion (LFI) attempt if the application includes files.

Answer

Remote file inclusion (RFI)

Answer

SQL injection

Answer

Command injection

Question 4

Which of the following is the BEST defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are unique, unpredictable tokens that validate that requests originate from the legitimate site, effectively mitigating CSRF.

Answer

SameSite cookies

Answer

Input validation

Answer

Output encoding

Question 5

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page.php?id=1' --batch --dbs. Which database enumeration technique is SQLMap using by default?

Accepted Answer

In-band SQL injection. Without specifying a technique, SQLMap defaults to using in-band (UNION) and error-based techniques, which are all in-band.

Answer

Out-of-band SQL injection

Answer

Blind SQL injection

Answer

Time-based SQL injection

Question 6

A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?

Accepted Answer

Remote File Inclusion (RFI). Including a remote file from an attacker-controlled server is Remote File Inclusion (RFI).

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 7

Which TWO of the following are commonly used to mitigate SQL injection vulnerabilities? (Select 2)

Accepted Answer

Stored procedures. Parameterized queries and stored procedures (when used correctly) prevent SQL injection by separating SQL logic from data.

Answer

Output encoding

Answer

Input validation

Answer

HTTPS encryption

Question 8

During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR occurs when an application exposes a direct reference to an internal object (like a user ID) without proper authorization checks, allowing unauthorized access.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 9

Which TWO of the following are common indicators of a command injection vulnerability? (Select 2)

Accepted Answer

The application allows input of shell metacharacters like ;, &&, or |. Command injection typically involves injecting shell metacharacters (;, &&, |) and can be confirmed by observing time delays with sleep commands.

Answer

The application reflects user input in the page without encoding

Answer

The application returns database error messages

Answer

The application uses parameterized queries for database access

Question 10

A security analyst observes that a web application's login page responds with different HTTP status codes and response times for valid versus invalid usernames. This information leakage could be used to perform which type of authentication attack?

Accepted Answer

Username enumeration. Username enumeration occurs when an application reveals whether a username exists, often through differing error messages or response times. This information can be leveraged for brute force or password spraying attacks by focusing on valid usernames.

Answer

Credential stuffing

Answer

Password spraying

Answer

Brute force attack

Question 11

A penetration tester is assessing a web application and wants to manually test for SQL injection vulnerabilities. Which TWO tools or techniques are best suited for this task?

Accepted Answer

Burp Suite. Burp Suite allows manual intercept and modification of requests to inject SQL payloads. SQLMap automates SQL injection detection and exploitation. Nikto is a web server scanner, not specific to SQLi. Nmap is a network scanner. OWASP ZAP is a web app scanner similar to Burp but less manual.

Answer

OWASP ZAP

Answer

Nikto

Answer

Nmap

Question 12

An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when an attacker can induce the server to make requests to internal resources.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 13

A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?

Accepted Answer

To mitigate cross-site request forgery (CSRF) attacks. SameSite=Lax prevents the browser from sending the cookie in cross-site requests initiated by third-party websites, mitigating CSRF attacks.

Answer

To enforce HTTPS for cookie transmission

Answer

To prevent the cookie from being accessed by JavaScript

Answer

To ensure the cookie is only sent over HTTP and not FTP

Question 14

During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references (e.g., database keys) and fails to enforce proper access controls, allowing users to manipulate them to access unauthorized data.

Answer

SQL injection

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Request Forgery (CSRF)

Question 15

A security analyst notices that a web application uses sequential numeric IDs for user accounts (e.g., /profile?id=1001). By changing the ID to 1002, the analyst can view another user's profile. Which vulnerability is present?

Accepted Answer

IDOR. This is an IDOR (Insecure Direct Object Reference) vulnerability, where direct access to objects is not properly restricted.

Answer

SQL injection

Answer

Directory traversal

Answer

CSRF