CEH Web Application and Injection Attacks Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are characteristics of stored (persistent) XSS?

Accepted Answer

The malicious script is stored on the server (e.g., in a database). Stored XSS involves malicious script being permanently stored on the server (e.g., in a database) and executed whenever the stored content is accessed. It does not require a crafted link, and it can affect multiple users without direct interaction.

Answer

The attack requires the victim to click a crafted link

Answer

The payload is reflected immediately in the response

Answer

The attack only works if the victim is logged in

Question 2

A security analyst observes that after a user submits a comment on a blog, the comment is displayed immediately on the page without sanitization. Another user visits the page and the comment's JavaScript executes in their browser. Which type of XSS attack is this?

Accepted Answer

Stored XSS. The comment is stored on the server and executed when other users view the page, which is the definition of stored (persistent) XSS.

Answer

DOM-based XSS

Answer

Reflected XSS

Answer

Self-XSS

Question 3

Which of the following tools is primarily used for automated SQL injection exploitation and database fingerprinting?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool specifically designed to automate the detection and exploitation of SQL injection flaws and database server fingerprinting. It supports a wide range of database management systems (MySQL, Oracle, PostgreSQL, Microsoft SQL Server, etc.) and can automate tasks such as retrieving data, accessing the file system, and executing commands. Its core purpose aligns exactly with automated SQL injection exploitation and database fingerprinting.

Answer

Nmap

Answer

Burp Suite

Answer

John the Ripper

Question 4

A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automating parameterized attacks, such as brute-forcing login credentials, by allowing the tester to define payload positions and iterate through a list of values (e.g., passwords) against a target endpoint. Unlike other tools in Burp Suite, Intruder supports multiple attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) and can handle rate limiting and session handling, making it ideal for password guessing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 5

Which of the following is a recommended defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Implementing CSRF tokens in forms. CSRF tokens are the canonical defense: the server issues a unique, unpredictable token tied to the user's session and requires it on state-changing requests. An attacker's forged request from a malicious site cannot read or guess the token due to same-origin policy, so the request is rejected. This directly defeats CSRF.

Answer

Enabling directory listing on the web server

Answer

Using a same-origin policy with CORS headers

Answer

Setting the HttpOnly flag on cookies

Question 6

A tester sends the following payload to a web application: %3Cscript%3Ealert('XSS')%3C/script%3E. The application echoes back the decoded payload in the response without sanitization. This behavior is typical of which type of vulnerability?

Accepted Answer

Reflected XSS. Reflected XSS occurs when an application immediately echoes user-supplied input in the response without proper sanitization. The payload is not stored on the server but reflected back to the user, executing in the victim's browser. The given payload is URL-encoded and decoded by the server, then echoed, which is typical of reflected XSS.

Answer

HTTP Response Splitting

Answer

DOM-based XSS

Answer

Stored XSS

Question 7

An attacker discovers that a web application's login form allows unlimited login attempts. The attacker uses a list of usernames and passwords obtained from a previous breach to gain access. This attack is known as:

Accepted Answer

Credential stuffing. Credential stuffing (option D) is correct because the attacker uses a list of known username/password pairs from a previous breach to automate login attempts against the web application. This attack exploits password reuse across services, not the weakness of the passwords themselves, and relies on the application's lack of rate limiting or account lockout mechanisms.

Answer

Password spraying

Answer

Brute force attack

Answer

Dictionary attack

Question 8

A penetration tester is assessing a web application and notices that the application reflects the User-Agent header in the response body without sanitization. What attack could be performed using this behavior?

Accepted Answer

Cross-Site Scripting (XSS). Reflecting unsanitized input in HTTP headers can lead to reflected XSS.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 9

An attacker sends a request to a web server with the following header: X-Forwarded-For: 127.0.0.1. The server processes the request as if it came from localhost and grants administrative access. This is an example of:

Accepted Answer

Server-Side Request Forgery (SSRF). The scenario describes spoofing the X-Forwarded-For header to bypass IP-based access controls. This is not SSRF; SSRF involves the server making outbound requests to internal resources based on user input. None of the listed options correctly identifies this attack.

Answer

HTTP request smuggling

Answer

IDOR (Insecure Direct Object Reference)

Answer

Clickjacking

Question 10

Which of the following is a symptom of a successful command injection attack?

Accepted Answer

The output of the 'id' command appears in the response. In a successful command injection attack, the attacker injects operating system commands into a vulnerable input field, and the web application passes them to a shell for execution. If the application returns the command output in the HTTP response, seeing the result of the 'id' command (e.g., 'uid=33(www-data) gid=33(www-data) groups=33(www-data)') is a definitive symptom that the injection succeeded and the server executed the attacker's command.

Answer

The server returns a 404 error

Answer

The HTTP response header contains 'Server: Apache'

Answer

The page loads slower than usual

Question 11

A web developer wants to mitigate CSRF attacks. Which of the following configurations for cookies is most effective when combined with CSRF tokens?

Accepted Answer

SameSite=Strict. SameSite=Strict prevents the browser from sending cookies for cross-site requests, which blocks CSRF attacks.

Answer

HttpOnly flag

Answer

Domain attribute

Answer

Secure flag

Question 12

During an assessment, a tester discovers that the web application accepts XML input and returns the parsed data. The tester submits the following payload: ]>&xxe;. The response contains the contents of /etc/passwd. This vulnerability is known as:

Accepted Answer

XML External Entity (XXE) Injection. The payload defines an external entity that reads a local file, a classic XXE (XML External Entity) injection.

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 13

Which TWO of the following are effective defenses against SQL injection attacks?

Accepted Answer

Using an ORM that generates parameterized queries. Option C is correct because ORMs that generate parameterized queries separate SQL code from user-supplied data, so input is bound as data rather than concatenated into the statement, which prevents injection payloads from altering query structure. Option D is correct because prepared statements with parameterized queries send the SQL template to the database first and bind parameters afterward, ensuring untrusted input cannot change the query's logic. Option A is not effective because stored procedures that build dynamic SQL internally still concatenate user input, reintroducing the injection risk. Option B is not a defense because hiding error messages only reduces information disclosure; it does not stop malicious SQL from executing. Option E is not reliable because addslashes() is a weak, context-unaware escaping function that fails against many encodings and database-specific syntax, so it should not be used as a primary SQL injection defense.

Answer

Implementing stored procedures with dynamic SQL

Answer

Disabling error messages

Answer

Escaping user input with addslashes()

Question 14

Which THREE of the following are valid methods to exploit or test for Server-Side Request Forgery (SSRF)?

Accepted Answer

Using the file:// protocol to read local files. SSRF (Server-Side Request Forgery) can be exploited by making the server fetch internal resources. Common techniques include using the file:// protocol to read local files (e.g., /etc/passwd), accessing internal services via localhost (e.g., http://127.0.0.1/admin), and targeting cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). Options B, C, and E are all valid SSRF techniques.

Answer

Injecting SQL commands into input fields

Answer

Sending a payload that includes

Question 15

A security analyst notices that after submitting a form on a web application, the URL changes to include the user's ID parameter, e.g., 'user?id=123'. The analyst modifies the ID in the URL and accesses another user's profile without authorization. Which type of vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). The vulnerability is Insecure Direct Object Reference (IDOR), which occurs when an application exposes a direct reference to an internal object, such as a user ID in a URL, without verifying that the requester is authorized to access that object. By changing 'id=123' to another value, the analyst accesses another user's profile because the application trusts the client-supplied identifier. This is a classic access control flaw, not an injection or scripting issue.

Answer

Reflected Cross-Site Scripting (XSS)

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)