CEH Web Application and Injection Attacks Practice Test 11 — 15 Questions

Question 1

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Setting SameSite cookies to Lax or Strict. CSRF tokens ensure the request originates from the legitimate site; SameSite cookies prevent the browser from sending cookies on cross-site requests.

Answer

Input validation

Answer

Using CAPTCHA

Answer

Using HTTPS only

Question 2

Which THREE of the following are common indicators of a Server-Side Request Forgery (SSRF) vulnerability? (Select 3)

Accepted Answer

The server returns data from internal services like http://localhost/ or http://192.168.x.x/. SSRF often involves requests to internal IPs or services, use of URL schemas like file://, and responses including internal data.

Answer

The application reflects user input in the page source without encoding

Answer

The server responds with a different delay when a URL is provided versus a non-URL input

Question 3

A security analyst observes a web application returning database error messages containing table names and column names in the HTTP response. Which type of SQL injection is MOST likely being exploited?

Accepted Answer

Error-based SQL injection. Error-based SQL injection is correct because the attacker deliberately causes the database to throw errors that are reflected in the HTTP response, revealing schema details like table and column names. This technique relies on verbose error messages from the DBMS (e.g., MySQL, MSSQL) to extract information directly. Unlike blind or out-of-band methods, error-based injection provides immediate feedback in the application's output.

Answer

Blind SQL injection (boolean-based)

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 4

During a web application test, a penetration tester intercepts a request using Burp Suite Proxy, modifies the 'Referer' header, and resends the request. The application processes the request despite the modified header. Which attack is the tester attempting to validate?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF (Cross-Site Request Forgery) attacks often rely on the Referer header for validation. By modifying it, the tester checks if the application validates the header. If the request is processed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 5

A web application allows users to view documents by specifying a filename in the URL, e.g., /getDocument?file=report.pdf. A tester changes the file parameter to '../../etc/passwd' and retrieves the system password file. Which vulnerability is being exploited?

Accepted Answer

Directory traversal. The tester manipulated the 'file' parameter with '../' sequences to escape the intended directory and read /etc/passwd, which is classic directory traversal (path traversal). The vulnerability arises because the application fails to sanitize user-supplied file paths, allowing access to files outside the web root.

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Answer

Command injection

Question 6

A penetration tester uses SQLMap with the option '--technique=T --dbms=MySQL --level=5 --risk=3' against a login form. The tool returns results after a delay of several seconds per request. Which SQL injection technique is being used?

Accepted Answer

Time-based blind SQL injection. The 'T' in --technique stands for Time-based blind SQL injection. The delay indicates time-based injection where the database sleeps to cause a response delay.

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Answer

Boolean-based blind SQL injection

Question 7

A security team deployed a web application firewall (WAF) that blocks requests containing SQL keywords like 'SELECT', 'UNION', and 'DROP'. An attacker bypasses the WAF by encoding the payload in base64 and using a SQL injection tool that decodes it server-side. Which mitigation would be MOST effective against this?

Accepted Answer

Implement prepared statements with parameterized queries. Prepared statements (parameterized queries) prevent SQL injection by separating query structure from data, regardless of encoding. WAF bypasses are mitigated by using proper coding practices.

Answer

Increase WAF sensitivity to block base64-encoded strings

Answer

Disable error messages to hide database errors

Answer

Use a more restrictive input validation regex

Question 8

Which Burp Suite tool is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials, fuzzing parameters, and enumerating identifiers. It allows testers to configure payloads, attack types, and grep-match rules to analyze responses. This makes it the correct tool for automating repetitive attacks.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 9

A penetration tester discovers that a web application's login page does not enforce rate limiting and several usernames are known from a prior data breach. The tester wants to try a few common passwords across many accounts to avoid account lockouts. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying involves trying a small number of common passwords against many user accounts to avoid account lockout. This contrasts with credential stuffing (using many passwords per account) and brute force (many passwords per user).

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 10

A web server running IIS 8.5 is found to have WebDAV enabled with write permissions. Which attack is MOST likely to be successful against this configuration?

Accepted Answer

File upload leading to remote code execution. WebDAV (Web Distributed Authoring and Versioning) is an extension to HTTP that allows clients to author and modify content on a web server. When enabled with write permissions on IIS 8.5, it permits HTTP methods like PUT, which can be used to upload files directly to the server. If the server also allows execution of uploaded files (e.g., .asp or .aspx), an attacker can upload a malicious script and execute arbitrary code, achieving remote code execution. This is the most direct and likely attack given the configuration.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL injection

Answer

Directory traversal

Question 11

An attacker crafts a link that, when clicked by an authenticated user, performs an unintended action on a web application where the user is logged in, such as changing their email address. The application uses a session cookie for authentication but does not include any anti-forgery tokens in forms. Which attack is this?

Accepted Answer

Cross-Site Request Forgery (CSRF). The description matches Cross-Site Request Forgery (CSRF), where a malicious link triggers actions on a site where the victim is authenticated.

Answer

Cross-Site Scripting (XSS)

Answer

Clickjacking

Answer

Server-Side Request Forgery (SSRF)

Question 12

A security analyst identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are effective mitigation techniques for SSRF?

Accepted Answer

Disable unnecessary URL schemas (e.g., file://, dict://). Option A is correct because restricting or disabling dangerous URL schemas such as file://, dict://, gopher://, and ftp:// prevents an attacker from abusing the server's URL-fetching functionality to read local files or interact with non-HTTP services, which is a core SSRF exploitation vector. Option D is correct because an allowlist (positive validation) of permitted domains, URLs, or IP addresses ensures the application only makes requests to explicitly trusted destinations, which is the most robust defense against SSRF since it rejects all unapproved targets by default. Option B is not ideal because blacklisting private IP ranges is easily bypassed using techniques such as decimal/octal/hex IP encoding, DNS rebinding, IPv6-mapped addresses, or redirects, so it is considered a weak mitigation rather than an effective one. Option C is incorrect because increasing HTTP request timeouts only affects how long the server waits for a response and does nothing to prevent SSRF requests from being made. Option E is incorrect because base64-encoding user input does not validate or restrict the destination; the server would still decode and process the URL, so the SSRF vulnerability remains exploitable.

Answer

Use a blacklist to block private IP ranges

Answer

Increase the timeout for HTTP requests

Answer

Encode user input in base64 before passing to URL functions

Question 13

During a penetration test, a tester finds a web application that reflects user input in the page without sanitization. Which TWO types of XSS are potentially exploitable in this scenario?

Accepted Answer

DOM-based XSS. Reflected XSS occurs when input is immediately returned in the response. DOM-based XSS occurs when client-side scripts process input unsafely. Stored XSS requires persistence on the server, which is not indicated.

Answer

Blind XSS

Answer

Self-XSS

Answer

Stored (persistent) XSS

Question 14

An attacker is attempting to perform an Insecure Direct Object Reference (IDOR) attack on a web application. Which TWO conditions are necessary for this attack to succeed?

Accepted Answer

The application exposes direct references to internal objects (e.g., user IDs in URLs). Option B is correct because IDOR fundamentally requires the application to expose direct references to internal objects, such as sequential user IDs, file names, or database keys in URLs or parameters, giving the attacker a manipulable identifier to tamper with. Option C is correct because even with exposed direct references, the attack only succeeds if the application fails to validate that the authenticated user is authorized to access the requested object, allowing horizontal or vertical privilege escalation. Option A is incorrect because indirect references using random or hashed tokens are actually a mitigation that makes object identifiers unpredictable and thus harder to enumerate or manipulate. Option D is incorrect because CSRF is a separate vulnerability class that forces a victim's browser to send unintended authenticated requests; it is not a prerequisite for IDOR. Option E is incorrect because strong access controls on every object would prevent IDOR by ensuring authorization checks are enforced, directly defeating the attack rather than enabling it.

Answer

The application uses indirect object references (e.g., random tokens)

Answer

The application has a CSRF vulnerability

Answer

The application implements strong access controls on every object

Question 15

A web application is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are potential impacts of successfully exploiting an XXE vulnerability?

Accepted Answer

Arbitrary file read on the server. Option B (Arbitrary file read on the server) is correct because XXE payloads can define an external entity whose SYSTEM identifier points to a local file (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd">), causing the parser to embed the file's contents in the response. Option C (Denial of Service) is correct because entities can be nested or recursively referenced (the 'billion laughs' attack) or point to large/blocking resources, exhausting parser memory or CPU and rendering the service unavailable. Option D (Server-Side Request Forgery) is correct because an external entity with an HTTP/FTP SYSTEM URL forces the vulnerable server to make outbound requests to internal or external hosts, enabling SSRF and potential access to internal services or cloud metadata endpoints. Option A (SQL injection) is not a direct XXE impact — XXE abuses the XML parser, not a database query interface, so any SQLi would be a separate vulnerability. Option E (Remote code execution via command injection) is not a standard XXE consequence; XXE does not invoke OS commands, and RCE typically requires additional flaws such as insecure deserialization or PHP expect:// wrappers in specific misconfigurations.

Answer

SQL injection

Answer

Remote code execution via command injection