CEH Web Application and Injection Attacks Practice Test 11 — 15 Questions

Question 1

Which THREE of the following are common indicators of a Server-Side Request Forgery (SSRF) vulnerability? (Select 3)

Accepted Answer

The server returns data from internal services like http://localhost/ or http://192.168.x.x/. SSRF often involves requests to internal IPs or services, use of URL schemas like file://, and responses including internal data.

Answer

The application reflects user input in the page source without encoding

Answer

The server responds with a different delay when a URL is provided versus a non-URL input

Question 2

A security analyst observes a web application returning database error messages containing table names and column names in the HTTP response. Which type of SQL injection is MOST likely being exploited?

Accepted Answer

Error-based SQL injection. Error-based SQL injection (in-band) relies on error messages from the database to extract information. The presence of database details in errors indicates error-based injection.

Answer

Blind SQL injection (boolean-based)

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 3

During a web application test, a penetration tester intercepts a request using Burp Suite Proxy, modifies the 'Referer' header, and resends the request. The application processes the request despite the modified header. Which attack is the tester attempting to validate?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF (Cross-Site Request Forgery) attacks often rely on the Referer header for validation. By modifying it, the tester checks if the application validates the header. If the request is processed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 4

A web application allows users to view documents by specifying a filename in the URL, e.g., /getDocument?file=report.pdf. A tester changes the file parameter to '../../etc/passwd' and retrieves the system password file. Which vulnerability is being exploited?

Accepted Answer

Directory traversal. Directory traversal (path traversal) occurs when user input is used to access files outside the intended directory. The use of '../' sequences indicates directory traversal.

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Answer

Command injection

Question 5

A penetration tester uses SQLMap with the option '--technique=T --dbms=MySQL --level=5 --risk=3' against a login form. The tool returns results after a delay of several seconds per request. Which SQL injection technique is being used?

Accepted Answer

Time-based blind SQL injection. The 'T' in --technique stands for Time-based blind SQL injection. The delay indicates time-based injection where the database sleeps to cause a response delay.

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Answer

Boolean-based blind SQL injection

Question 6

A security team deployed a web application firewall (WAF) that blocks requests containing SQL keywords like 'SELECT', 'UNION', and 'DROP'. An attacker bypasses the WAF by encoding the payload in base64 and using a SQL injection tool that decodes it server-side. Which mitigation would be MOST effective against this?

Accepted Answer

Implement prepared statements with parameterized queries. Prepared statements (parameterized queries) prevent SQL injection by separating query structure from data, regardless of encoding. WAF bypasses are mitigated by using proper coding practices.

Answer

Increase WAF sensitivity to block base64-encoded strings

Answer

Disable error messages to hide database errors

Answer

Use a more restrictive input validation regex

Question 7

Which Burp Suite tool is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is used for automating customized attacks, including brute force and fuzzing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 8

A penetration tester discovers that a web application's login page does not enforce rate limiting and several usernames are known from a prior data breach. The tester wants to try a few common passwords across many accounts to avoid account lockouts. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying involves trying a small number of common passwords against many user accounts to avoid account lockout. This contrasts with credential stuffing (using many passwords per account) and brute force (many passwords per user).

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 9

A web server running IIS 8.5 is found to have WebDAV enabled with write permissions. Which attack is MOST likely to be successful against this configuration?

Accepted Answer

File upload leading to remote code execution. WebDAV with write permissions allows attackers to upload files (e.g., web shells) to the server, leading to remote code execution.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL injection

Answer

Directory traversal

Question 10

An attacker crafts a link that, when clicked by an authenticated user, performs an unintended action on a web application where the user is logged in, such as changing their email address. The application uses a session cookie for authentication but does not include any anti-forgery tokens in forms. Which attack is this?

Accepted Answer

Cross-Site Request Forgery (CSRF). The description matches Cross-Site Request Forgery (CSRF), where a malicious link triggers actions on a site where the victim is authenticated.

Answer

Cross-Site Scripting (XSS)

Answer

Clickjacking

Answer

Server-Side Request Forgery (SSRF)

Question 11

A security analyst identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are effective mitigation techniques for SSRF?

Accepted Answer

Disable unnecessary URL schemas (e.g., file://, dict://). Whitelisting allowed domains prevents requests to arbitrary targets. Disabling unused URL schemas (e.g., file://) reduces attack surface. Input validation alone is insufficient.

Answer

Use a blacklist to block private IP ranges

Answer

Increase the timeout for HTTP requests

Answer

Encode user input in base64 before passing to URL functions

Question 12

During a penetration test, a tester finds a web application that reflects user input in the page without sanitization. Which TWO types of XSS are potentially exploitable in this scenario?

Accepted Answer

DOM-based XSS. Reflected XSS occurs when input is immediately returned in the response. DOM-based XSS occurs when client-side scripts process input unsafely. Stored XSS requires persistence on the server, which is not indicated.

Answer

Blind XSS

Answer

Self-XSS

Answer

Stored (persistent) XSS

Question 13

An attacker is attempting to perform an Insecure Direct Object Reference (IDOR) attack on a web application. Which TWO conditions are necessary for this attack to succeed?

Accepted Answer

The application exposes direct references to internal objects (e.g., user IDs in URLs). IDOR exploits direct references to objects without proper authorization checks. The application must expose direct references (e.g., IDs in URLs) and fail to verify the user's permission to access the object.

Answer

The application uses indirect object references (e.g., random tokens)

Answer

The application has a CSRF vulnerability

Answer

The application implements strong access controls on every object

Question 14

A pentester uses Burp Suite's Intruder to perform a brute-force attack on a login form. Which TWO of the following Intruder attack types would be appropriate for testing different payload combinations?

Accepted Answer

Pitchfork. For testing different payload combinations, you need multiple payload sets. Pitchfork uses multiple payload sets and pairs them position-by-position, testing different combinations where each set provides distinct values. Cluster bomb uses multiple payload sets and tests every possible combination across all positions, which is ideal for brute-force attacks on login forms. Sniper and Battering ram use a single payload set and are not appropriate for testing different combinations.

Answer

Sniper

Answer

Direct

Answer

Battering ram

Question 15

A web application is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are potential impacts of successfully exploiting an XXE vulnerability?

Accepted Answer

Arbitrary file read on the server. XXE can be used for reading local files (e.g., /etc/passwd), performing SSRF by making the server issue requests, and causing denial of service (e.g., billion laughs attack).

Answer

SQL injection

Answer

Remote code execution via command injection