CEH Web Application and Injection Attacks — 40 Questions

Question 1

A web application uses a parameter 'file' to include server-side files. The following request is intercepted: GET /page.php?file=../../../etc/passwd HTTP/1.1. The response contains the contents of /etc/passwd. This vulnerability is most likely which of the following?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Local File Inclusion (LFI). The request uses path traversal sequences (../) to access a file outside the web root. Since the application then *includes* and displays the contents of this local file (`/etc/passwd`), this is a classic example of a Local File Inclusion (LFI) vulnerability.

Answer

Directory Traversal

Answer

Command Injection

Answer

Remote File Inclusion (RFI)

Question 2

An attacker sends a request to a web server with the following header: X-Forwarded-For: 127.0.0.1. The server processes the request as if it came from localhost and grants administrative access. This is an example of:

Accepted Answer

Server-Side Request Forgery (SSRF). The attacker manipulates the X-Forwarded-For header to spoof the client IP address as 127.0.0.1, making the server believe the request originates from localhost. This bypasses IP-based access controls and can be used to trick the server into making requests to internal resources or granting unauthorized access. This is a classic example of Server-Side Request Forgery (SSRF), where the attacker exploits the server's trust in header-derived IP addresses to access internal systems or functions.

Answer

HTTP request smuggling

Answer

IDOR (Insecure Direct Object Reference)

Answer

Clickjacking

Question 3

Which THREE of the following are common indicators of an ongoing brute-force attack against a web application?

Accepted Answer

A single user account being locked out repeatedly. Multiple failed logins from the same IP, high frequency of login requests, and many different usernames tried from one source are typical signs of brute-force.

Answer

Successful logins from unusual geographic locations

Question 4

Which of the following is the BEST defense against brute-force attacks on a login form?

Accepted Answer

Rate limiting on the login endpoint. Rate limiting is the best defense because it proactively limits the number of login attempts from any source, making brute-force attacks impractical. CAPTCHA can be bypassed by automated solvers, account lockout can be circumvented via distributed IP attacks, and complex password policies do not prevent repeated attempts.

Answer

CAPTCHA

Answer

Complex password policy

Answer

Account lockout after 5 failed attempts

Question 5

A security analyst identifies a vulnerability where an attacker can include a local file such as '/etc/passwd' by manipulating the 'page' parameter in the URL: http://example.com/index.php?page=../../../../etc/passwd. What type of attack is this?

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) is a vulnerability that allows an attacker to include local files on the server by manipulating input parameters. The example provided, where an attacker uses '..' sequences to access and include '/etc/passwd', is a classic demonstration of LFI. Directory traversal is the specific technique used to navigate the file system outside the web root in this LFI attack, but the overall 'type of attack' that results in including a local file is LFI.

Answer

Command injection

Answer

Directory traversal

Answer

Remote File Inclusion (RFI)

Question 6

An application uses the SameSite cookie attribute. Which THREE of the following are valid values for this attribute and their purposes? (Select three)

Accepted Answer

Lax - Cookie is sent for top-level navigations with safe methods. SameSite can be set to 'Lax' (default) which allows cookies for top-level navigations, or 'Strict' which prevents cookies on cross-site requests. 'None' requires Secure flag but is used for cross-site.

Answer

Secure - Cookie is sent only over HTTPS

Answer

HttpOnly - Cookie is inaccessible to JavaScript

Question 7

Which TWO of the following are common indicators of a command injection vulnerability? (Select 2)

Accepted Answer

The application allows input of shell metacharacters like ;, &&, or |. Command injection vulnerabilities occur when an application passes user-supplied input directly to a system command interpreter. A strong indicator is accepting shell metacharacters such as ;, &&, or | in input (A), because these characters can be used to chain additional OS commands. Another indicator is an application feature that executes system commands and returns their output (E); if that execution path includes unsanitized user input, it creates a direct avenue for command injection. The vulnerability can be confirmed by injecting benign commands like `sleep` to observe time delays or `whoami` to see command output. Options B and C suggest XSS and SQL injection respectively, while D is a SQL injection defense, not command injection.

Answer

The application reflects user input in the page without encoding

Answer

The application returns database error messages

Answer

The application uses parameterized queries for database access

Question 8

Which of the following is a primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Using SameSite cookies. CSRF tokens are unique, unpredictable values validated server-side, making them a strong primary defense. SameSite cookies are also a recognized primary defense against CSRF by restricting cross-site cookie transmission. CAPTCHA is a user-interaction control but not a standard primary defense for all forms; input validation/output encoding do not prevent CSRF.

Answer

Input validation and output encoding

Answer

Enforcing CAPTCHA on all forms

Question 9

A penetration tester is assessing a web application and wants to manually test for SQL injection vulnerabilities. Which TWO tools or techniques are best suited for this task?

Accepted Answer

Burp Suite. {"C":"OWASP ZAP, like Burp Suite, provides an intercepting proxy that allows testers to manually modify requests and inject SQL payloads, making it suitable for manual SQL injection testing."}

Answer

SQLMap

Answer

Nikto

Answer

Nmap

Question 10

Which TWO of the following are common types of SQL injection attacks?

Accepted Answer

Blind SQL injection (boolean-based). In-band SQLi (union-based) uses the same channel to inject and retrieve data. Blind SQLi (boolean-based or time-based) does not return data directly but infers information from behavior. These two are widely considered the most common and fundamental types of SQL injection. NoSQL injection is a separate category targeting NoSQL databases. Heap-based is not a recognized SQLi type. Out-of-band SQL injection is a recognized category, but it is generally considered less common than In-band and Blind SQL injection, which are the primary two categories.

Answer

Out-of-band SQL injection

Answer

Heap-based SQL injection

Answer

NoSQL injection

Question 11

During a web application penetration test, a tester uses Burp Suite's Intruder tool to automate a series of login attempts using a list of common passwords. Which attack type is being performed?

Accepted Answer

Dictionary attack. A dictionary attack involves using a list of common passwords (a 'dictionary') against a specific account. In this scenario, the tester uses Burp Suite's Intruder with a password list against a login form, which is exactly a dictionary attack. Credential stuffing (A) requires known username-password pairs from breaches, not just a password list. Brute force (B) tries all possible combinations, not just a list. Password spraying (D) uses a few passwords against many accounts, not many passwords against one account.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Password spraying

Question 12

An attacker exploits an application by uploading a file that contains server-side script code, leading to arbitrary command execution on the web server. Which best describes this attack?

Accepted Answer

Command injection. The attack described is a malicious/unrestricted file upload that leads to Remote Code Execution (RCE) by executing an uploaded server-side script. It is not command injection, which is the execution of OS commands via untrusted input passed to an interpreter. Among the options provided, 'Command injection' is only the closest available because it also results in arbitrary command execution on the server; the underlying vector is not the same.

Answer

File inclusion (LFI)

Answer

XSS

Answer

Directory traversal

Question 13

Which TWO of the following are common methods to detect SQL injection vulnerabilities in a web application? (Select 2)

Accepted Answer

Submitting a single quote (') and observing error messages. Using single quotes to cause errors (error-based SQLi) and observing page content differences with boolean-based payloads (boolean-based blind SQLi) are classic SQLi detection techniques.

Answer

Reviewing the robots.txt file for hidden directories

Answer

Scanning with a vulnerability scanner like Nikto

Answer

Checking for XSS payloads in input fields

Question 14

A web application uses cookies for session management. The application is vulnerable to CSRF. Which THREE of the following are effective mitigation techniques? (Choose THREE.)

Accepted Answer

Setting SameSite cookies to Lax or Strict. SameSite cookies restrict cross-origin requests. CSRF tokens provide a unique per-request secret. Validating the Origin or Referer header ensures the request originates from an expected domain. MFA does not prevent CSRF.

Answer

Implementing Multi-Factor Authentication (MFA)

Answer

Using HTTP GET requests for state-changing operations

Question 15

A security analyst notices that the web application returns different response times when a valid username is submitted versus an invalid one during login. Which type of vulnerability is likely being exploited?

Accepted Answer

Time-based SQL injection. Time-based SQL injection involves injecting SQL code that causes the database to pause if a condition is true, allowing an attacker to infer information based on response times. The observed difference in response times for valid vs. invalid usernames is characteristic of this technique.

Answer

Reflected XSS

Answer

Blind boolean-based SQL injection

Answer

CSRF

Question 16

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a dedicated, open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. It supports a wide range of database management systems (e.g., MySQL, Oracle, PostgreSQL) and injection techniques (e.g., boolean-based blind, time-based blind, UNION query, stacked queries), making it the standard choice for this specific task.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 17

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

Accepted Answer

CSRF token. The presence of a SameSite cookie set to Lax does not prevent CSRF for state-changing requests like password change if the attack uses a GET or POST from a top-level navigation. However, the primary missing mitigation is a CSRF token, which is a unique unpredictable value tied to the session and validated by the server.

Answer

SameSite=Strict

Answer

HTTPOnly flag

Answer

Secure flag

Question 18

A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?

Accepted Answer

File upload vulnerability. The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.

Answer

Directory traversal

Answer

Command injection

Answer

Stored XSS

Question 19

An analyst observes the following log entry on a web server: GET /../../etc/passwd HTTP/1.1 200. Which type of attack is indicated?

Accepted Answer

Directory traversal. The log shows a request attempting to traverse directories using '../' to access a sensitive system file (/etc/passwd), which is directory traversal.

Answer

SSRF

Answer

LFI

Answer

Command injection

Question 20

During a penetration test, a tester uses the following payload in a search field: . The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Self-XSS