CEH Web Application and Injection Attacks Practice Test 10 — 15 Questions

Question 1

An analyst reviews a web server log and sees the following request: GET /search?q= HTTP/1.1. The response from the server includes the search term inside a

tag without any sanitization. Which type of XSS vulnerability does this indicate?

Accepted Answer

Reflected XSS. This is a typical reflected XSS because the malicious script is injected via a GET parameter and immediately reflected in the response without persistent storage.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Blind XSS

Question 2

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page?id=1' --batch --dbs. Which of the following best describes what this command will do?

Accepted Answer

Enumerate all database names in non-interactive mode. --dbs enumerates database names; --batch uses default options without interactive input.

Answer

Dump the entire contents of the current database

Answer

Perform a time-based blind SQL injection to extract data

Answer

Enumerate all tables in all databases

Question 3

An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when an attacker can induce the server to make requests to internal resources.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 4

A security analyst notices that a web application uses sequential numeric IDs for user accounts (e.g., /profile?id=1001). By changing the ID to 1002, the analyst can view another user's profile. Which vulnerability is present?

Accepted Answer

IDOR. This is an IDOR (Insecure Direct Object Reference) vulnerability, where direct access to objects is not properly restricted.

Answer

SQL injection

Answer

Directory traversal

Answer

CSRF

Question 5

During a web application penetration test, a tester uses Burp Suite's Intruder tool to automate a series of login attempts using a list of common passwords. Which attack type is being performed?

Accepted Answer

Credential stuffing. Credential stuffing uses a list of known passwords, while password spraying uses a few passwords against many accounts. Brute force is typically many passwords per account. The description best matches credential stuffing.

Answer

Brute force attack

Answer

Dictionary attack

Answer

Password spraying

Question 6

An analyst reviews the following HTTP response: HTTP/1.1 200 OK Set-Cookie: sessionid=abc123; SameSite=None; Secure ...

Welcome back!

. What possible vulnerability exists if the application does not use CSRF tokens?

Accepted Answer

Cross-site request forgery (CSRF). SameSite=None allows cross-site requests to include cookies, making CSRF possible if no CSRF tokens are used. SameSite=Lax or Strict would block some CSRF attacks.

Answer

Clickjacking

Answer

Cross-site scripting (XSS)

Answer

Session fixation

Question 7

Which of the following is the most effective defense against SQL injection attacks?

Accepted Answer

Parameterized queries. Parameterized queries (prepared statements) ensure user input is treated as data, not executable code, preventing SQL injection.

Answer

Escaping all user input

Answer

Input validation using blacklists

Answer

Stored procedures

Question 8

An attacker exploits an application by uploading a file that contains server-side script code, leading to arbitrary command execution on the web server. Which best describes this attack?

Accepted Answer

Command injection. File upload vulnerability allowing arbitrary code execution is a form of command injection or remote code execution (RCE).

Answer

File inclusion (LFI)

Answer

XSS

Answer

Directory traversal

Question 9

A security engineer observes that an internal web application uses XML to transmit data between systems. The engineer discovers that by sending a crafted XML payload, they can read sensitive files from the server's filesystem. Which attack is being performed?

Accepted Answer

XXE injection. XXE (XML External Entity) injection allows reading files via external entities in XML.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 10

Which Burp Suite tool is specifically designed to intercept and modify HTTP(S) traffic between the browser and the target web application?

Accepted Answer

Proxy. Burp Proxy is the component that intercepts and allows modification of requests/responses in transit.

Answer

Intruder

Answer

Scanner

Answer

Repeater

Question 11

A web application allows users to submit feedback that is stored in a database and later displayed to administrators. An attacker submits feedback containing . When an admin views the feedback page, the script executes. Which type of XSS is this?

Accepted Answer

Stored XSS. Stored (persistent) XSS occurs when the payload is stored on the server and served to other users later.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 12

An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?

Accepted Answer

Directory traversal. Directory traversal (path traversal) uses ../ sequences to access files outside the web root.

Answer

Command injection

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Question 13

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Setting SameSite cookies to Lax or Strict. CSRF tokens ensure the request originates from the legitimate site; SameSite cookies prevent the browser from sending cookies on cross-site requests.

Answer

Input validation

Answer

Using CAPTCHA

Answer

Using HTTPS only

Question 14

Which THREE of the following are common indicators of a Server-Side Request Forgery (SSRF) vulnerability? (Select 3)

Accepted Answer

The server returns data from internal services like http://localhost/ or http://192.168.x.x/. SSRF often involves requests to internal IPs or services, use of URL schemas like file://, and responses including internal data.

Answer

The application reflects user input in the page source without encoding

Answer

The server responds with a different delay when a URL is provided versus a non-URL input

Question 15

Which TWO of the following are common methods to detect SQL injection vulnerabilities in a web application? (Select 2)

Accepted Answer

Submitting a single quote (') and observing error messages. Using single quotes to cause errors and timing delays are classic SQLi detection techniques.

Answer

Reviewing the robots.txt file for hidden directories

Answer

Scanning with a vulnerability scanner like Nikto

Answer

Checking for XSS payloads in input fields