CEH Web Application and Injection Attacks — 50 Questions

Question 1

An analyst observes the following log entry on a web server: GET /../../etc/passwd HTTP/1.1 200. Which type of attack is indicated?

Accepted Answer

Directory traversal. The sequence '../..' in the URI path is the classic signature of directory traversal (path traversal), where an attacker uses relative path segments to escape the web root and read files outside it. The HTTP 200 response indicates /etc/passwd was successfully retrieved, confirming the traversal succeeded. This maps directly to MITRE ATT&CK T1083 (File and Directory Discovery) and OWASP A01:2021 Broken Access Control.

Answer

SSRF

Answer

LFI

Answer

Command injection

Question 2

A web application uses user input in the following PHP code: include($_GET['page'] . '.php');. An attacker submits the URL: http://example.com/index.php?page=../../../../etc/passwd%00. Which two vulnerabilities are being attempted?

Accepted Answer

LFI and null byte injection. The attacker is using '../' for directory traversal to access files outside the web root, and a null byte injection (%00) to truncate the '.php' extension. This targets LFI (local file inclusion) via directory traversal.

Answer

RFI and command injection

Answer

SQL injection and XSS

Answer

Directory traversal and IDOR

Question 3

An attacker attempts to log into a web application by trying many common passwords for a list of known usernames. Which type of authentication attack is this?

Accepted Answer

Password spraying. Password spraying involves using a few common passwords against many usernames to avoid account lockouts, as opposed to brute force (many passwords on one account) or credential stuffing (using known username/password pairs).

Answer

Dictionary attack

Answer

Credential stuffing

Answer

Brute force attack

Question 4

A web application is vulnerable to SQL injection. Which THREE of the following techniques can be used to extract data from the database using blind SQL injection?

Accepted Answer

Time-based. Time-based (A) is correct because blind SQL injection can infer data by injecting conditional delays (e.g., WAITFOR DELAY, SLEEP(), or pg_sleep()) and measuring the server's response time to determine true/false conditions. Boolean-based (C) is correct because it extracts data by sending queries that return different application responses depending on whether a condition is true or false, allowing bit-by-bit reconstruction of data without seeing query output. Out-of-band (D) is correct because it uses alternate channels such as DNS or HTTP requests (e.g., via xp_dirtree, UTL_HTTP, or LOAD_FILE) to exfiltrate data when in-band and error responses are unavailable. Error-based (B) is not marked correct because it relies on the database returning error messages containing data, which is not a blind technique. Union-based (E) is not marked correct because it requires the application to reflect query results directly in the response, which is also not blind.

Answer

Error-based

Answer

Union-based

Question 5

A web application uses a parameter 'file' to include server-side files. The following request is intercepted: GET /page.php?file=../../../etc/passwd HTTP/1.1. The response contains the contents of /etc/passwd. This vulnerability is most likely which of the following?

Accepted Answer

Local File Inclusion (LFI). The request uses path traversal sequences (../) to access a file outside the web root. Since the application then *includes* and displays the contents of this local file (`/etc/passwd`), this is a classic example of a Local File Inclusion (LFI) vulnerability.

Answer

Directory Traversal

Answer

Command Injection

Answer

Remote File Inclusion (RFI)

Question 6

Which THREE of the following are common indicators of an ongoing brute-force attack against a web application?

Accepted Answer

A single user account being locked out repeatedly. Multiple failed logins from the same IP, high frequency of login requests, and many different usernames tried from one source are typical signs of brute-force.

Answer

Successful logins from unusual geographic locations

Question 7

During a penetration test, a tester uses SQLMap with the following command: 'sqlmap -u "http://target.com/page?id=1" --os-shell'. The target is a Linux server running MySQL. Which SQL injection technique will SQLMap likely attempt to use to achieve an OS shell?

Accepted Answer

In-band (file write via INTO OUTFILE). SQLMap's --os-shell option attempts to achieve an operating system shell by exploiting the SQL injection to write files to the server. On MySQL, this typically involves using the INTO OUTFILE clause to write a web shell or other executable file to a directory accessible by the web server. This is an in-band technique because the results are returned directly in the HTTP response.

Answer

Error-based injection

Answer

Blind boolean-based injection

Answer

Union-based injection

Question 8

Which OWASP Top 10 (2021) category describes the vulnerability where an application allows an attacker to include a remote file from an external server, leading to code execution or data disclosure?

Accepted Answer

Injection (A03:2021). Injection (A03:2021) is the correct answer because Remote File Inclusion (RFI) is a classic injection flaw where user-supplied input (e.g., a URL parameter) is not properly sanitized, allowing an attacker to include and execute a remote file. The OWASP Top 10 2021 explicitly lists 'Injection' as covering flaws like SQL, NoSQL, OS command, and LDAP injection, but also includes 'Cross-site Scripting' and 'Remote File Inclusion' under this category. RFI leads to code execution or data disclosure, which aligns with the injection category's definition of untrusted data being sent to an interpreter as part of a command or query.

Answer

Security Misconfiguration (A05:2021)

Answer

Broken Access Control (A01:2021)

Answer

Cryptographic Failures (A02:2021)

Question 9

A security analyst identifies a vulnerability where an attacker can include a local file such as '/etc/passwd' by manipulating the 'page' parameter in the URL: http://example.com/index.php?page=../../../../etc/passwd. What type of attack is this?

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) is a vulnerability that allows an attacker to include local files on the server by manipulating input parameters. The example provided, where an attacker uses '..' sequences to access and include '/etc/passwd', is a classic demonstration of LFI. Directory traversal is the specific technique used to navigate the file system outside the web root in this LFI attack, but the overall 'type of attack' that results in including a local file is LFI.

Answer

Command injection

Answer

Directory traversal

Answer

Remote File Inclusion (RFI)

Question 10

During a security assessment, a tester discovers an endpoint that reflects the 'User-Agent' header in the response without sanitization. The tester wants to confirm a reflected XSS vulnerability. Which of the following payloads would be MOST effective to demonstrate the issue in a single request?

Accepted Answer

Set the User-Agent to: . A reflected XSS payload must inject executable script into the response. The payload is the canonical, unambiguous proof — when reflected unsanitized in an HTML context, the browser parses and executes it, popping the alert. This directly demonstrates the vulnerability in a single request without relying on event handlers or additional parsing quirks.

Answer

Set the User-Agent to: <img src=x onerror=alert(1)>

Answer

Set the User-Agent to: ' OR '1'='1

Answer

Set the User-Agent to: ../../../../etc/passwd

Question 11

An application uses the SameSite cookie attribute. Which THREE of the following are valid values for this attribute and their purposes? (Select three)

Accepted Answer

Lax - Cookie is sent for top-level navigations with safe methods. SameSite can be set to 'Lax' (default) which allows cookies for top-level navigations, or 'Strict' which prevents cookies on cross-site requests. 'None' requires Secure flag but is used for cross-site.

Answer

Secure - Cookie is sent only over HTTPS

Answer

HttpOnly - Cookie is inaccessible to JavaScript

Question 12

Which TWO of the following are common indicators of a command injection vulnerability? (Select 2)

Accepted Answer

The application allows input of shell metacharacters like ;, &&, or |. Command injection vulnerabilities occur when an application passes user-supplied input directly to a system command interpreter. A strong indicator is accepting shell metacharacters such as ;, &&, or | in input (A), because these characters can be used to chain additional OS commands. Another indicator is an application feature that executes system commands and returns their output (E); if that execution path includes unsanitized user input, it creates a direct avenue for command injection. The vulnerability can be confirmed by injecting benign commands like `sleep` to observe time delays or `whoami` to see command output. Options B and C suggest XSS and SQL injection respectively, while D is a SQL injection defense, not command injection.

Answer

The application reflects user input in the page without encoding

Answer

The application returns database error messages

Answer

The application uses parameterized queries for database access

Question 13

Which of the following is a primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Using SameSite cookies. CSRF tokens are unique, unpredictable values validated server-side, making them a strong primary defense. SameSite cookies are also a recognized primary defense against CSRF by restricting cross-site cookie transmission. CAPTCHA is a user-interaction control but not a standard primary defense for all forms; input validation/output encoding do not prevent CSRF.

Answer

Input validation and output encoding

Answer

Enforcing CAPTCHA on all forms

Question 14

A penetration tester is assessing a web application and wants to manually test for SQL injection vulnerabilities. Which TWO tools or techniques are best suited for this task?

Accepted Answer

Burp Suite. {"C":"OWASP ZAP, like Burp Suite, provides an intercepting proxy that allows testers to manually modify requests and inject SQL payloads, making it suitable for manual SQL injection testing."}

Answer

SQLMap

Answer

Nikto

Answer

Nmap

Question 15

Which TWO of the following are common types of SQL injection attacks?

Accepted Answer

Blind SQL injection (boolean-based). In-band SQLi (union-based) uses the same channel to inject and retrieve data. Blind SQLi (boolean-based or time-based) does not return data directly but infers information from behavior. These two are widely considered the most common and fundamental types of SQL injection. NoSQL injection is a separate category targeting NoSQL databases. Heap-based is not a recognized SQLi type. Out-of-band SQL injection is a recognized category, but it is generally considered less common than In-band and Blind SQL injection, which are the primary two categories.

Answer

Out-of-band SQL injection

Answer

Heap-based SQL injection

Answer

NoSQL injection

Question 16

During a web application penetration test, a tester uses Burp Suite's Intruder tool to automate a series of login attempts using a list of common passwords. Which attack type is being performed?

Accepted Answer

Dictionary attack. A dictionary attack involves using a list of common passwords (a 'dictionary') against a specific account. In this scenario, the tester uses Burp Suite's Intruder with a password list against a login form, which is exactly a dictionary attack. Credential stuffing (A) requires known username-password pairs from breaches, not just a password list. Brute force (B) tries all possible combinations, not just a list. Password spraying (D) uses a few passwords against many accounts, not many passwords against one account.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Password spraying

Question 17

An attacker exploits an application by uploading a file that contains server-side script code, leading to arbitrary command execution on the web server. Which best describes this attack?

Accepted Answer

Command injection. The attack described is a malicious/unrestricted file upload that leads to Remote Code Execution (RCE) by executing an uploaded server-side script. It is not command injection, which is the execution of OS commands via untrusted input passed to an interpreter. Among the options provided, 'Command injection' is only the closest available because it also results in arbitrary command execution on the server; the underlying vector is not the same.

Answer

File inclusion (LFI)

Answer

XSS

Answer

Directory traversal

Question 18

Which TWO of the following are common methods to detect SQL injection vulnerabilities in a web application? (Select 2)

Accepted Answer

Submitting a single quote (') and observing error messages. Using single quotes to cause errors (error-based SQLi) and observing page content differences with boolean-based payloads (boolean-based blind SQLi) are classic SQLi detection techniques.

Answer

Reviewing the robots.txt file for hidden directories

Answer

Scanning with a vulnerability scanner like Nikto

Answer

Checking for XSS payloads in input fields

Question 19

A pentester uses Burp Suite's Intruder to perform a brute-force attack on a login form. Which TWO of the following Intruder attack types would be appropriate for testing different payload combinations?

Accepted Answer

Pitchfork. Pitchfork (A) is correct because it uses a separate payload set for each defined position and iterates them in parallel, advancing each set one value at a time, which is appropriate when testing matched combinations of usernames and passwords. Cluster bomb (D) is correct because it uses a separate payload set per position and tests every possible permutation of the payload values, making it the right choice for exhaustive combination testing of multiple fields. Sniper (B) is not appropriate here because it places a single payload set into one position at a time while leaving others at their default values, so it does not test combinations across positions. Direct (C) is not a Burp Intruder attack type at all. Battering ram (E) is not appropriate because it uses one payload set inserted into all positions simultaneously, so every position receives the same value rather than distinct combinations.

Answer

Sniper

Answer

Direct

Answer

Battering ram

Question 20

A web application uses cookies for session management. The application is vulnerable to CSRF. Which THREE of the following are effective mitigation techniques? (Choose THREE.)

Accepted Answer

Setting SameSite cookies to Lax or Strict. SameSite cookies restrict cross-origin requests. CSRF tokens provide a unique per-request secret. Validating the Origin or Referer header ensures the request originates from an expected domain. MFA does not prevent CSRF.

Answer

Implementing Multi-Factor Authentication (MFA)

Answer

Using HTTP GET requests for state-changing operations