CEH Web Application and Injection Attacks Practice Test 3 — 15 Questions

Question 1

Which of the following tools is primarily used for automated SQL injection exploitation and database fingerprinting?

Accepted Answer

SQLMap. SQLMap is the industry-standard tool for automating SQL injection detection and exploitation.

Answer

Nmap

Answer

Burp Suite

Answer

John the Ripper

Question 2

A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automating parameterized attacks, such as brute-forcing login credentials, by allowing the tester to define payload positions and iterate through a list of values (e.g., passwords) against a target endpoint. Unlike other tools in Burp Suite, Intruder supports multiple attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) and can handle rate limiting and session handling, making it ideal for password guessing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 3

Which of the following is a recommended defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Implementing CSRF tokens in forms. CSRF tokens are unique per request and verified by the server, making forged requests invalid without the token.

Answer

Enabling directory listing on the web server

Answer

Using a same-origin policy with CORS headers

Answer

Setting the HttpOnly flag on cookies

Question 4

A tester sends the following payload to a web application: %3Cscript%3Ealert('XSS')%3C/script%3E. The application echoes back the decoded payload in the response without sanitization. This behavior is typical of which type of vulnerability?

Accepted Answer

Reflected XSS. The payload is URL-encoded HTML and is decoded and reflected, indicating reflected XSS.

Answer

HTTP Response Splitting

Answer

DOM-based XSS

Answer

Stored XSS

Question 5

An attacker discovers that a web application's login form allows unlimited login attempts. The attacker uses a list of usernames and passwords obtained from a previous breach to gain access. This attack is known as:

Accepted Answer

Credential stuffing. Credential stuffing (option D) is correct because the attacker uses a list of known username/password pairs from a previous breach to automate login attempts against the web application. This attack exploits password reuse across services, not the weakness of the passwords themselves, and relies on the application's lack of rate limiting or account lockout mechanisms.

Answer

Password spraying

Answer

Brute force attack

Answer

Dictionary attack

Question 6

A penetration tester is assessing a web application and notices that the application reflects the User-Agent header in the response body without sanitization. What attack could be performed using this behavior?

Accepted Answer

Cross-Site Scripting (XSS). Reflecting unsanitized input in HTTP headers can lead to reflected XSS.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 7

Which of the following is a symptom of a successful command injection attack?

Accepted Answer

The output of the 'id' command appears in the response. In a successful command injection attack, the attacker injects operating system commands into a vulnerable input field, and the web application passes them to a shell for execution. If the application returns the command output in the HTTP response, seeing the result of the 'id' command (e.g., 'uid=33(www-data) gid=33(www-data) groups=33(www-data)') is a definitive symptom that the injection succeeded and the server executed the attacker's command.

Answer

The server returns a 404 error

Answer

The HTTP response header contains 'Server: Apache'

Answer

The page loads slower than usual

Question 8

A web developer wants to mitigate CSRF attacks. Which of the following configurations for cookies is most effective when combined with CSRF tokens?

Accepted Answer

SameSite=Strict. SameSite=Strict prevents the browser from sending cookies for cross-site requests, which blocks CSRF attacks.

Answer

HttpOnly flag

Answer

Domain attribute

Answer

Secure flag

Question 9

During an assessment, a tester discovers that the web application accepts XML input and returns the parsed data. The tester submits the following payload: ]>&xxe;. The response contains the contents of /etc/passwd. This vulnerability is known as:

Accepted Answer

XML External Entity (XXE) Injection. The payload defines an external entity that reads a local file, a classic XXE (XML External Entity) injection.

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 10

Which TWO of the following are effective defenses against SQL injection attacks?

Accepted Answer

Using an ORM that generates parameterized queries. Prepared statements (parameterized queries) and stored procedures (if properly parameterized) prevent SQL injection by separating data from code.

Answer

Implementing stored procedures with dynamic SQL

Answer

Disabling error messages

Answer

Escaping user input with addslashes()

Question 11

Which THREE of the following are valid methods to exploit or test for Server-Side Request Forgery (SSRF)?

Accepted Answer

Using the file:// protocol to read local files. SSRF (Server-Side Request Forgery) can be exploited by making the server fetch internal resources. Common techniques include using the file:// protocol to read local files (e.g., /etc/passwd), accessing internal services via localhost (e.g., http://127.0.0.1/admin), and targeting cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). Options B, C, and E are all valid SSRF techniques.

Answer

Injecting SQL commands into input fields

Answer

Sending a payload that includes

Question 12

A security analyst notices that after submitting a form on a web application, the URL changes to include the user's ID parameter, e.g., 'user?id=123'. The analyst modifies the ID in the URL and accesses another user's profile without authorization. Which type of vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). This is an Insecure Direct Object Reference (IDOR) vulnerability, where the application exposes internal object references (like user IDs) without proper access control checks.

Answer

Reflected Cross-Site Scripting (XSS)

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 13

Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is the tool for automating customized attacks like brute-forcing and fuzzing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 14

During a penetration test, a tester uses SQLMap with the following command: 'sqlmap -u "http://target.com/page?id=1" --os-shell'. The target is a Linux server running MySQL. Which SQL injection technique will SQLMap likely attempt to use to achieve an OS shell?

Accepted Answer

In-band (file write via INTO OUTFILE). SQLMap's --os-shell option typically uses the 'INTO OUTFILE' clause to write a backdoor webshell onto the server, requiring file write privileges. This is an in-band technique.

Answer

Error-based injection

Answer

Blind boolean-based injection

Answer

Union-based injection

Question 15

A web application allows users to upload profile pictures. The application uses the filename provided by the user to save the file on the server. An attacker uploads a file named 'malicious.php%00.png' and the server saves it as 'malicious.php'. Which vulnerability is being exploited?

Accepted Answer

Null byte injection. This is a null byte injection attack, where the %00 (null byte) terminates the string, bypassing extension checks to upload a PHP file.

Answer

Directory traversal

Answer

Command injection

Answer

Cross-Site Scripting (XSS)