CEH Web Application and Injection Attacks Practice Test 3 — 15 Questions

Question 1

A security analyst notices that after submitting a form on a web application, the URL changes to include the user's ID parameter, e.g., 'user?id=123'. The analyst modifies the ID in the URL and accesses another user's profile without authorization. Which type of vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). This is an Insecure Direct Object Reference (IDOR) vulnerability, where the application exposes internal object references (like user IDs) without proper access control checks.

Answer

Reflected Cross-Site Scripting (XSS)

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 2

Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is the tool for automating customized attacks like brute-forcing and fuzzing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 3

During a penetration test, a tester uses SQLMap with the following command: 'sqlmap -u "http://target.com/page?id=1" --os-shell'. The target is a Linux server running MySQL. Which SQL injection technique will SQLMap likely attempt to use to achieve an OS shell?

Accepted Answer

In-band (file write via INTO OUTFILE). SQLMap's --os-shell option typically uses the 'INTO OUTFILE' clause to write a backdoor webshell onto the server, requiring file write privileges. This is an in-band technique.

Answer

Error-based injection

Answer

Blind boolean-based injection

Answer

Union-based injection

Question 4

A web application allows users to upload profile pictures. The application uses the filename provided by the user to save the file on the server. An attacker uploads a file named 'malicious.php%00.png' and the server saves it as 'malicious.php'. Which vulnerability is being exploited?

Accepted Answer

Null byte injection. This is a null byte injection attack, where the %00 (null byte) terminates the string, bypassing extension checks to upload a PHP file.

Answer

Directory traversal

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 5

Which of the following is the BEST defense against brute-force attacks on a login form?

Accepted Answer

Rate limiting on the login endpoint. Rate limiting on the login endpoint is the best defense because it directly restricts the number of requests an attacker can send over a given time window, making brute-force attacks impractical. Unlike reactive measures like account lockout, rate limiting proactively throttles traffic at the network or application layer, preventing the attacker from even attempting many guesses. This approach is effective against distributed brute-force attacks where lockout policies can be bypassed by rotating IP addresses.

Answer

Complex password policy

Question 6

A penetration tester discovers that a web application includes the following code: 'include($_GET['page'] . '.php');' and the application is running on a Linux server. The tester attempts to exploit this by accessing 'index.php?page=../../etc/passwd'. What type of attack is this, and will it succeed?

Accepted Answer

Local File Inclusion (LFI); it will not succeed because the '.php' extension is appended. This is a Local File Inclusion (LFI) vulnerability. The appended '.php' extension prevents reading '/etc/passwd' because the file would be interpreted as '/etc/passwd.php', which does not exist.

Answer

Directory traversal; it will succeed because '../' bypasses restrictions

Answer

Remote File Inclusion (RFI); it will succeed because the parameter is not filtered

Answer

Command injection; it will succeed if the server interprets PHP code

Question 7

An attacker wants to perform a CSRF attack against a banking application. The application uses SameSite cookies set to 'Strict'. The attacker hosts a malicious page on their own domain. When the victim visits the malicious page, which of the following statements is TRUE regarding the CSRF attack?

Accepted Answer

The attack will fail because the browser will not include the session cookie with the cross-origin request.. SameSite=Strict prevents cookies from being sent on cross-site requests, effectively blocking CSRF attacks if the attacker cannot control the origin.

Answer

The attack will succeed because cookies are sent regardless of SameSite settings.

Answer

The attack will succeed because the attacker can bypass SameSite using GET requests.

Answer

The attack will fail because CSRF requires POST requests and the malicious page only uses GET.

Question 8

A web application uses XML to transmit data between client and server. A tester submits the following payload: ']>&xxe;'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.

Answer

SQL injection

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 9

During a web application test, an analyst intercepts a request containing a 'Referer' header that points to a different domain. The analyst modifies the request by removing the 'Referer' header and the action still executes successfully. Which type of attack is the analyst testing?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF protection often relies on checking the Referer header; if it can be removed or spoofed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Clickjacking

Answer

Cross-Site Scripting (XSS)

Question 10

Which of the following is a common indicator of a stored (persistent) Cross-Site Scripting (XSS) attack?

Accepted Answer

A script is permanently stored on the server and executed when users view a page. Option B is correct because stored (persistent) XSS occurs when malicious script is permanently stored on the server (e.g., in a database, comment field, or forum post) and is served to every user who views the affected page. The script executes in the victim's browser without requiring any additional interaction, as it is part of the page's HTML response from the server.

Answer

A script executes in the victim's browser without any server interaction

Answer

A script is executed when a user submits a form with malicious input

Answer

A script executes only after clicking a manipulated URL

Question 11

A web application firewall (WAF) blocks requests containing ' UNION SELECT '. A penetration tester wants to bypass this restriction to perform a union-based SQL injection. Which of the following techniques is MOST likely to succeed?

Accepted Answer

Use inline comments: 'UN/**/ION/**/SE/**/LECT'. Using comments or alternative encoding can bypass WAF rules. Inline comments like '/**/' can break up keywords.

Answer

Use double URL encoding: '%25%35%35%25%34%65%25%34%39...'

Answer

Use hex encoding: '0x554e494f4e2053454c454354'

Answer

Use URL encoding: '%55%4e%49%4f%4e%20%53%45%4c%45%43%54'

Question 12

An organization wants to prevent directory listing on its Apache web server. Which of the following configuration changes would achieve this?

Accepted Answer

Set 'Options -Indexes' in the httpd.conf or .htaccess file. Disabling the Indexes option in the Directory directive prevents Apache from listing directory contents when no index file exists.

Answer

Set 'AllowOverride None'

Answer

Set 'ServerSignature Off'

Answer

Set 'DirectoryIndex disabled'

Question 13

Which TWO of the following are effective mitigations against Clickjacking attacks? (Choose 2)

Accepted Answer

Set Content-Security-Policy: frame-ancestors 'none'. X-Frame-Options header and Content-Security-Policy frame-ancestors directive are both effective against clickjacking.

Answer

Enable HTTP Strict-Transport-Security (HSTS)

Answer

Use CSRF tokens

Answer

Set SameSite cookies to Strict

Question 14

Which THREE of the following are types of SQL injection attacks? (Choose 3)

Accepted Answer

Out-of-band SQLi (e.g., DNS or HTTP exfiltration). Out-of-band SQLi (option A) is correct because it uses a different channel (e.g., DNS or HTTP requests) to exfiltrate data when the attacker cannot receive direct responses from the database. This technique is effective when the database server can initiate outbound network connections, allowing data to be sent to an attacker-controlled server via DNS queries or HTTP requests.

Answer

Stored SQLi

Answer

Reflected SQLi

Question 15

Which TWO of the following are common tools used for web application security testing? (Choose 2)

Accepted Answer

Burp Suite. Burp Suite and OWASP ZAP are both widely used web application security testing tools.

Answer

Wireshark

Answer

Nessus

Answer

Metasploit