CEH Web Application and Injection Attacks Practice Test 2 — 15 Questions

Question 1

During a web application penetration test, a tester uses Burp Suite's Intruder tool to automate a series of login attempts using a list of common passwords. Which attack type is being performed?

Accepted Answer

Dictionary attack. A dictionary attack involves using a list of common passwords (a 'dictionary') against a specific account. In this scenario, the tester uses Burp Suite's Intruder with a password list against a login form, which is exactly a dictionary attack. Credential stuffing (A) requires known username-password pairs from breaches, not just a password list. Brute force (B) tries all possible combinations, not just a list. Password spraying (D) uses a few passwords against many accounts, not many passwords against one account.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Password spraying

Question 2

An attacker exploits an application by uploading a file that contains server-side script code, leading to arbitrary command execution on the web server. Which best describes this attack?

Accepted Answer

Command injection. The attack described is a malicious/unrestricted file upload that leads to Remote Code Execution (RCE) by executing an uploaded server-side script. It is not command injection, which is the execution of OS commands via untrusted input passed to an interpreter. Among the options provided, 'Command injection' is only the closest available because it also results in arbitrary command execution on the server; the underlying vector is not the same.

Answer

File inclusion (LFI)

Answer

XSS

Answer

Directory traversal

Question 3

Which TWO of the following are common methods to detect SQL injection vulnerabilities in a web application? (Select 2)

Accepted Answer

Submitting a single quote (') and observing error messages. Using single quotes to cause errors (error-based SQLi) and observing page content differences with boolean-based payloads (boolean-based blind SQLi) are classic SQLi detection techniques.

Answer

Reviewing the robots.txt file for hidden directories

Answer

Scanning with a vulnerability scanner like Nikto

Answer

Checking for XSS payloads in input fields

Question 4

A pentester uses Burp Suite's Intruder to perform a brute-force attack on a login form. Which TWO of the following Intruder attack types would be appropriate for testing different payload combinations?

Accepted Answer

Pitchfork. Pitchfork (A) is correct because it uses a separate payload set for each defined position and iterates them in parallel, advancing each set one value at a time, which is appropriate when testing matched combinations of usernames and passwords. Cluster bomb (D) is correct because it uses a separate payload set per position and tests every possible permutation of the payload values, making it the right choice for exhaustive combination testing of multiple fields. Sniper (B) is not appropriate here because it places a single payload set into one position at a time while leaving others at their default values, so it does not test combinations across positions. Direct (C) is not a Burp Intruder attack type at all. Battering ram (E) is not appropriate because it uses one payload set inserted into all positions simultaneously, so every position receives the same value rather than distinct combinations.

Answer

Sniper

Answer

Direct

Answer

Battering ram

Question 5

A web application uses cookies for session management. The application is vulnerable to CSRF. Which THREE of the following are effective mitigation techniques? (Choose THREE.)

Accepted Answer

Setting SameSite cookies to Lax or Strict. SameSite cookies restrict cross-origin requests. CSRF tokens provide a unique per-request secret. Validating the Origin or Referer header ensures the request originates from an expected domain. MFA does not prevent CSRF.

Answer

Implementing Multi-Factor Authentication (MFA)

Answer

Using HTTP GET requests for state-changing operations

Question 6

A security analyst notices that the web application returns different response times when a valid username is submitted versus an invalid one during login. Which type of vulnerability is likely being exploited?

Accepted Answer

Time-based SQL injection. Time-based SQL injection involves injecting SQL code that causes the database to pause if a condition is true, allowing an attacker to infer information based on response times. The observed difference in response times for valid vs. invalid usernames is characteristic of this technique.

Answer

Reflected XSS

Answer

Blind boolean-based SQL injection

Answer

CSRF

Question 7

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a dedicated, open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. It supports a wide range of database management systems (e.g., MySQL, Oracle, PostgreSQL) and injection techniques (e.g., boolean-based blind, time-based blind, UNION query, stacked queries), making it the standard choice for this specific task.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 8

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

Accepted Answer

CSRF token. The request shows a session cookie with SameSite=Lax but no anti-CSRF token, and the tester successfully forged a cross-site POST. A CSRF token is the standard defense that binds the request to the user's session and cannot be predicted by an attacker, so its absence is the missing mitigation.

Answer

SameSite=Strict

Answer

HTTPOnly flag

Answer

Secure flag

Question 9

A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?

Accepted Answer

File upload vulnerability. The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.

Answer

Directory traversal

Answer

Command injection

Answer

Stored XSS

Question 10

During a penetration test, a tester uses the following payload in a search field: . The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Self-XSS

Question 11

Which of the following is the primary purpose of using a CSRF token in a web application?

Accepted Answer

Prevent cross-site request forgery. CSRF tokens are unique, unpredictable values embedded in forms or requests that validate the request originated from the legitimate application, preventing cross-site request forgery attacks.

Answer

Prevent session hijacking

Answer

Prevent XSS

Answer

Prevent SQL injection

Question 12

Which Burp Suite tool is most appropriate for modifying and re-sending a single HTTP request multiple times with different payloads to test for SQL injection?

Accepted Answer

Intruder. Burp Intruder is designed for automated customized attacks, allowing you to send many requests with varying payloads to a single target endpoint.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 13

A penetration tester finds that a web application accepts XML input and returns the parsed data in the response. The tester submits the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which vulnerability is being exploited?

Accepted Answer

XXE injection. The payload defines an external entity (XXE) that reads a local file, indicating an XML External Entity (XXE) injection vulnerability.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 14

A security analyst wants to check if a web application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions would be most effective?

Accepted Answer

Send a request with a URL parameter pointing to an internal IP address. Crafting a request that makes the server fetch an internal IP address (like 127.0.0.1) and observing if the response includes data from that internal resource is a good test for SSRF.

Answer

Submit a base64-encoded payload in a cookie

Answer

Use SQLMap with a time-based payload

Answer

Modify the Host header to point to localhost

Question 15

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Using SameSite cookies. SameSite cookies (option A) are effective against CSRF because they restrict the browser from sending cookies on cross-origin requests, preventing forged requests from carrying authentication credentials. CSRF tokens (option E) are also effective because they require a unique token in each request that the attacker cannot predict. Option C (anti-CSRF tokens) is essentially the same technique as option E, so it is not considered a distinct mitigation; thus, only options A and E are correct.

Answer

Input validation

Answer

Using anti-CSRF tokens

Answer

Using HTTPOnly cookies