CEH Practice Test 49 — 15 Questions

Question 1

A web application allows users to view documents by specifying a filename in the URL, e.g., /getDocument?file=report.pdf. A tester changes the file parameter to '../../etc/passwd' and retrieves the system password file. Which vulnerability is being exploited?

Accepted Answer

Directory traversal. Directory traversal (path traversal) occurs when user input is used to access files outside the intended directory. The use of '../' sequences indicates directory traversal.

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Answer

Command injection

Question 2

Which Burp Suite tool is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is used for automating customized attacks, including brute force and fuzzing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 3

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection vulnerabilities. Burp Suite is a web proxy and scanner, Nikto is a web server scanner, and Metasploit is a penetration testing framework with broader capabilities.

Answer

Burp Suite

Answer

Nikto

Answer

Metasploit

Question 4

Which Burp Suite tool is specifically designed to intercept and modify HTTP(S) traffic between the browser and the target web application?

Accepted Answer

Proxy. Burp Proxy is the component that intercepts and allows modification of requests/responses in transit.

Answer

Intruder

Answer

Scanner

Answer

Repeater

Question 5

During a web application test, a penetration tester intercepts a request using Burp Suite Proxy, modifies the 'Referer' header, and resends the request. The application processes the request despite the modified header. Which attack is the tester attempting to validate?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF (Cross-Site Request Forgery) attacks often rely on the Referer header for validation. By modifying it, the tester checks if the application validates the header. If the request is processed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 6

A penetration tester is performing a check for HTTP response splitting. Which THREE of the following conditions must be present for this attack to succeed?

Accepted Answer

The application reflects user input in the HTTP response headers. HTTP response splitting requires that attacker input is reflected in the response headers (e.g., via CRLF injection). The application must not sanitize CRLF sequences. The attacker can then inject headers to separate the response into two HTTP responses, enabling cache poisoning or XSS.

Answer

The application reflects user input in the HTTP response body

Answer

The application uses HTTPS exclusively

Question 7

An application allows users to upload XML files for processing. A tester uploads the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which attack is being performed?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read a local file. The server's XML parser processes the entity and reflects the file content, confirming the vulnerability.

Answer

SQL injection

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Question 8

Which TWO of the following are common types of SQL injection attacks?

Accepted Answer

Blind SQL injection (boolean-based). In-band SQLi (union-based) uses the same channel to inject and retrieve data. Blind SQLi (boolean-based or time-based) does not return data directly but infers information from behavior. NoSQL injection is a separate category. Heap-based is not a recognized SQLi type. Out-of-band is a third type but not listed among the options; the question asks for common types.

Answer

Out-of-band SQL injection

Answer

Heap-based SQL injection

Answer

NoSQL injection

Question 9

A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?

Accepted Answer

Exploitation. Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.

Answer

Reconnaissance

Answer

Reporting

Answer

Scanning and enumeration

Question 10

A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?

Accepted Answer

Intruder. Burp Intruder is designed for automated request customization and repetition, allowing fuzzing of parameters for injection flaws, brute-force attacks, and other vulnerability testing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 11

An analyst reviews a web server log and sees the following request: GET /search?q= HTTP/1.1. The response from the server includes the search term inside a

tag without any sanitization. Which type of XSS vulnerability does this indicate?

Accepted Answer

Reflected XSS. This is a typical reflected XSS because the malicious script is injected via a GET parameter and immediately reflected in the response without persistent storage.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Blind XSS

Question 12

An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?

Accepted Answer

Directory traversal. Directory traversal (path traversal) uses ../ sequences to access files outside the web root.

Answer

Command injection

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Question 13

A web server running IIS 8.5 is found to have WebDAV enabled with write permissions. Which attack is MOST likely to be successful against this configuration?

Accepted Answer

File upload leading to remote code execution. WebDAV with write permissions allows attackers to upload files (e.g., web shells) to the server, leading to remote code execution.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL injection

Answer

Directory traversal

Question 14

During a penetration test, a tester finds a web application that reflects user input in the page without sanitization. Which TWO types of XSS are potentially exploitable in this scenario?

Accepted Answer

DOM-based XSS. Reflected XSS occurs when input is immediately returned in the response. DOM-based XSS occurs when client-side scripts process input unsafely. Stored XSS requires persistence on the server, which is not indicated.

Answer

Blind XSS

Answer

Self-XSS

Answer

Stored (persistent) XSS

Question 15

During a web application test, the tester finds that the application includes user-supplied file names in include() statements. Which TWO of the following are indicators of a Remote File Inclusion (RFI) vulnerability? (Choose TWO.)

Accepted Answer

The application includes files from http://attacker.com/shell.txt. RFI allows inclusion of remote files via HTTP/HTTPS URLs. Directory traversal with ../ is more typical of LFI. Inclusion of local files like /etc/passwd indicates LFI, not RFI.

Answer

The application includes files with '..' and '/' sequences

Answer

The application includes /etc/passwd in the response

Answer

The application includes files with .inc extension