CEH Web Application and Injection Attacks — 20 Questions

Question 1

A security analyst notices that the web application returns different response times when a valid username is submitted versus an invalid one during login. Which type of vulnerability is likely being exploited?

Accepted Answer

Time-based SQL injection. Time-based SQL injection involves injecting SQL code that causes the database to pause if a condition is true, allowing an attacker to infer information based on response times. The observed difference in response times for valid vs. invalid usernames is characteristic of this technique.

Answer

Reflected XSS

Answer

Blind boolean-based SQL injection

Answer

CSRF

Question 2

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a widely used open-source tool that automates the process of detecting and exploiting SQL injection flaws in web applications.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 3

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

Accepted Answer

CSRF token. The presence of a SameSite cookie set to Lax does not prevent CSRF for state-changing requests like password change if the attack uses a GET or POST from a top-level navigation. However, the primary missing mitigation is a CSRF token, which is a unique unpredictable value tied to the session and validated by the server.

Answer

SameSite=Strict

Answer

HTTPOnly flag

Answer

Secure flag

Question 4

A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?

Accepted Answer

File upload vulnerability. The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.

Answer

Directory traversal

Answer

Command injection

Answer

Stored XSS

Question 5

An analyst observes the following log entry on a web server: GET /../../etc/passwd HTTP/1.1 200. Which type of attack is indicated?

Accepted Answer

Directory traversal. The log shows a request attempting to traverse directories using '../' to access a sensitive system file (/etc/passwd), which is directory traversal.

Answer

SSRF

Answer

LFI

Answer

Command injection

Question 6

During a penetration test, a tester uses the following payload in a search field: . The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Self-XSS

Question 7

Which of the following is the primary purpose of using a CSRF token in a web application?

Accepted Answer

Prevent cross-site request forgery. CSRF tokens are unique, unpredictable values embedded in forms or requests that validate the request originated from the legitimate application, preventing cross-site request forgery attacks.

Answer

Prevent session hijacking

Answer

Prevent XSS

Answer

Prevent SQL injection

Question 8

A web application uses user input in the following PHP code: include($_GET['page'] . '.php');. An attacker submits the URL: http://example.com/index.php?page=../../../../etc/passwd%00. Which two vulnerabilities are being attempted?

Accepted Answer

LFI and null byte injection. The attacker is using '../' for directory traversal to access files outside the web root, and a null byte injection (%00) to truncate the '.php' extension. This targets LFI (local file inclusion) via directory traversal.

Answer

RFI and command injection

Answer

SQL injection and XSS

Answer

Directory traversal and IDOR

Question 9

Which Burp Suite tool is most appropriate for modifying and re-sending a single HTTP request multiple times with different payloads to test for SQL injection?

Accepted Answer

Intruder. Burp Intruder is designed for automated customized attacks, allowing you to send many requests with varying payloads to a single target endpoint.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 10

A penetration tester finds that a web application accepts XML input and returns the parsed data in the response. The tester submits the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which vulnerability is being exploited?

Accepted Answer

XXE injection. The payload defines an external entity (XXE) that reads a local file, indicating an XML External Entity (XXE) injection vulnerability.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 11

An attacker attempts to log into a web application by trying many common passwords for a list of known usernames. Which type of authentication attack is this?

Accepted Answer

Password spraying. Password spraying involves using a few common passwords against many usernames to avoid account lockouts, as opposed to brute force (many passwords on one account) or credential stuffing (using known username/password pairs).

Answer

Dictionary attack

Answer

Credential stuffing

Answer

Brute force attack

Question 12

A security analyst wants to check if a web application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions would be most effective?

Accepted Answer

Send a request with a URL parameter pointing to an internal IP address. Crafting a request that makes the server fetch an internal IP address (like 127.0.0.1) and observing if the response includes data from that internal resource is a good test for SSRF.

Answer

Submit a base64-encoded payload in a cookie

Answer

Use SQLMap with a time-based payload

Answer

Modify the Host header to point to localhost

Question 13

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Using SameSite cookies. CSRF tokens and SameSite cookies are standard defenses. The other options do not prevent CSRF: input validation does not; anti-CSRF tokens are synonymous; referer header validation is weak.

Answer

Input validation

Answer

Using anti-CSRF tokens

Answer

Using HTTPOnly cookies

Question 14

A web application is vulnerable to SQL injection. Which THREE of the following techniques can be used to extract data from the database using blind SQL injection?

Accepted Answer

Time-based. Boolean-based, time-based, and out-of-band are all types of blind SQL injection. Error-based and union-based are in-band techniques, not blind.

Answer

Error-based

Answer

Union-based

Question 15

Which TWO of the following are characteristics of stored (persistent) XSS?

Accepted Answer

The malicious script is stored on the server (e.g., in a database). Stored XSS involves malicious script being permanently stored on the server and executed whenever the stored content is accessed. It does not require a crafted link, and it can affect multiple users.

Answer

The attack requires the victim to click a crafted link

Answer

The payload is reflected immediately in the response

Answer

The attack only works if the victim is logged in

Question 16

A security analyst observes that after a user submits a comment on a blog, the comment is displayed immediately on the page without sanitization. Another user visits the page and the comment's JavaScript executes in their browser. Which type of XSS attack is this?

Accepted Answer

Stored XSS. The comment is stored on the server and executed when other users view the page, which is the definition of stored (persistent) XSS.

Answer

DOM-based XSS

Answer

Reflected XSS

Answer

Self-XSS

Question 17

Which of the following tools is primarily used for automated SQL injection exploitation and database fingerprinting?

Accepted Answer

SQLMap. SQLMap is the industry-standard tool for automating SQL injection detection and exploitation.

Answer

Nmap

Answer

Burp Suite

Answer

John the Ripper

Question 18

A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automating parameterized attacks, such as brute-forcing login credentials, by allowing the tester to define payload positions and iterate through a list of values (e.g., passwords) against a target endpoint. Unlike other tools in Burp Suite, Intruder supports multiple attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) and can handle rate limiting and session handling, making it ideal for password guessing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 19

A web application uses a parameter 'file' to include server-side files. The following request is intercepted: GET /page.php?file=../../../etc/passwd HTTP/1.1. The response contains the contents of /etc/passwd. This vulnerability is most likely which of the following?

Accepted Answer

Directory Traversal. The request uses path traversal sequences (../) to include a file outside the web root, which is a classic path traversal (directory traversal) vulnerability.

Answer

Local File Inclusion (LFI)

Answer

Command Injection

Answer

Remote File Inclusion (RFI)

Question 20

Which of the following is a recommended defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Implementing CSRF tokens in forms. CSRF tokens are unique per request and verified by the server, making forged requests invalid without the token.

Answer

Enabling directory listing on the web server

Answer

Using a same-origin policy with CORS headers

Answer

Setting the HttpOnly flag on cookies