CEH Web Application and Injection Attacks Practice Test 2 — 15 Questions

Question 1

A security analyst observes that after a user submits a comment on a blog, the comment is displayed immediately on the page without sanitization. Another user visits the page and the comment's JavaScript executes in their browser. Which type of XSS attack is this?

Accepted Answer

Stored XSS. The comment is stored on the server and executed when other users view the page, which is the definition of stored (persistent) XSS.

Answer

DOM-based XSS

Answer

Reflected XSS

Answer

Self-XSS

Question 2

Which of the following tools is primarily used for automated SQL injection exploitation and database fingerprinting?

Accepted Answer

SQLMap. SQLMap is the industry-standard tool for automating SQL injection detection and exploitation.

Answer

Nmap

Answer

Burp Suite

Answer

John the Ripper

Question 3

A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automating parameterized attacks, such as brute-forcing login credentials, by allowing the tester to define payload positions and iterate through a list of values (e.g., passwords) against a target endpoint. Unlike other tools in Burp Suite, Intruder supports multiple attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) and can handle rate limiting and session handling, making it ideal for password guessing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 4

A web application uses a parameter 'file' to include server-side files. The following request is intercepted: GET /page.php?file=../../../etc/passwd HTTP/1.1. The response contains the contents of /etc/passwd. This vulnerability is most likely which of the following?

Accepted Answer

Directory Traversal. The request uses path traversal sequences (../) to include a file outside the web root, which is a classic path traversal (directory traversal) vulnerability.

Answer

Local File Inclusion (LFI)

Answer

Command Injection

Answer

Remote File Inclusion (RFI)

Question 5

Which of the following is a recommended defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Implementing CSRF tokens in forms. CSRF tokens are unique per request and verified by the server, making forged requests invalid without the token.

Answer

Enabling directory listing on the web server

Answer

Using a same-origin policy with CORS headers

Answer

Setting the HttpOnly flag on cookies

Question 6

A tester sends the following payload to a web application: %3Cscript%3Ealert('XSS')%3C/script%3E. The application echoes back the decoded payload in the response without sanitization. This behavior is typical of which type of vulnerability?

Accepted Answer

Reflected XSS. The payload is URL-encoded HTML and is decoded and reflected, indicating reflected XSS.

Answer

HTTP Response Splitting

Answer

DOM-based XSS

Answer

Stored XSS

Question 7

An attacker discovers that a web application's login form allows unlimited login attempts. The attacker uses a list of usernames and passwords obtained from a previous breach to gain access. This attack is known as:

Accepted Answer

Credential stuffing. Credential stuffing (option D) is correct because the attacker uses a list of known username/password pairs from a previous breach to automate login attempts against the web application. This attack exploits password reuse across services, not the weakness of the passwords themselves, and relies on the application's lack of rate limiting or account lockout mechanisms.

Answer

Password spraying

Answer

Brute force attack

Answer

Dictionary attack

Question 8

A penetration tester is assessing a web application and notices that the application reflects the User-Agent header in the response body without sanitization. What attack could be performed using this behavior?

Accepted Answer

Cross-Site Scripting (XSS). Reflecting unsanitized input in HTTP headers can lead to reflected XSS.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 9

An attacker sends a request to a web server with the following header: X-Forwarded-For: 127.0.0.1. The server processes the request as if it came from localhost and grants administrative access. This is an example of:

Accepted Answer

Server-Side Request Forgery (SSRF). The attacker manipulates the X-Forwarded-For header to spoof the client IP, which can lead to SSRF or IP-based access control bypass.

Answer

HTTP request smuggling

Answer

IDOR (Insecure Direct Object Reference)

Answer

Clickjacking

Question 10

Which of the following is a symptom of a successful command injection attack?

Accepted Answer

The output of the 'id' command appears in the response. Command injection allows execution of system commands; using 'id' is a common test to confirm.

Answer

The server returns a 404 error

Answer

The HTTP response header contains 'Server: Apache'

Answer

The page loads slower than usual

Question 11

A web developer wants to mitigate CSRF attacks. Which of the following configurations for cookies is most effective when combined with CSRF tokens?

Accepted Answer

SameSite=Strict. SameSite=Strict prevents the browser from sending cookies for cross-site requests, which blocks CSRF attacks.

Answer

HttpOnly flag

Answer

Domain attribute

Answer

Secure flag

Question 12

During an assessment, a tester discovers that the web application accepts XML input and returns the parsed data. The tester submits the following payload: ]>&xxe;. The response contains the contents of /etc/passwd. This vulnerability is known as:

Accepted Answer

XML External Entity (XXE) Injection. The payload defines an external entity that reads a local file, a classic XXE (XML External Entity) injection.

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 13

Which TWO of the following are effective defenses against SQL injection attacks?

Accepted Answer

Using an ORM that generates parameterized queries. Prepared statements (parameterized queries) and stored procedures (if properly parameterized) prevent SQL injection by separating data from code.

Answer

Implementing stored procedures with dynamic SQL

Answer

Disabling error messages

Answer

Escaping user input with addslashes()

Question 14

Which THREE of the following are common indicators of an ongoing brute-force attack against a web application?

Accepted Answer

Login requests arriving at an unusually high frequency. Multiple failed logins from the same IP, high frequency of login requests, and many different usernames tried from one source are typical signs of brute-force.

Answer

A single user account being locked out repeatedly

Answer

Successful logins from unusual geographic locations

Question 15

Which TWO of the following are valid methods to exploit or test for Server-Side Request Forgery (SSRF)?

Accepted Answer

Submitting a URL pointing to http://127.0.0.1/admin. SSRF can be tested by making the server fetch internal resources like localhost or cloud metadata endpoints (e.g., AWS).

Answer

Injecting SQL commands into input fields

Answer

Using the file:// protocol to read local files

Answer

Sending a payload that includes