CEH Web Application and Injection Attacks Practice Test 4 — 15 Questions

Question 1

A penetration tester discovers that a web application includes the following code: 'include($_GET['page'] . '.php');' and the application is running on a Linux server. The tester attempts to exploit this by accessing 'index.php?page=../../etc/passwd'. What type of attack is this, and will it succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Local File Inclusion (LFI); it will not succeed because the '.php' extension is appended. This is a Local File Inclusion (LFI) vulnerability. The appended '.php' extension prevents reading '/etc/passwd' because the file would be interpreted as '/etc/passwd.php', which does not exist.

Answer

Directory traversal; it will succeed because '../' bypasses restrictions

Answer

Remote File Inclusion (RFI); it will succeed because the parameter is not filtered

Answer

Command injection; it will succeed if the server interprets PHP code

Question 2

An attacker wants to perform a CSRF attack against a banking application. The application uses SameSite cookies set to 'Strict'. The attacker hosts a malicious page on their own domain. When the victim visits the malicious page, which of the following statements is TRUE regarding the CSRF attack?

Accepted Answer

The attack will fail because the browser will not include the session cookie with the cross-origin request.. SameSite=Strict prevents cookies from being sent on cross-site requests, effectively blocking CSRF attacks if the attacker cannot control the origin.

Answer

The attack will succeed because cookies are sent regardless of SameSite settings.

Answer

The attack will succeed because the attacker can bypass SameSite using GET requests.

Answer

The attack will fail because CSRF requires POST requests and the malicious page only uses GET.

Question 3

A web application uses XML to transmit data between client and server. A tester submits the following payload: ']>&xxe;'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.

Answer

SQL injection

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 4

During a web application test, an analyst intercepts a request containing a 'Referer' header that points to a different domain. The analyst modifies the request by removing the 'Referer' header and the action still executes successfully. Which type of attack is the analyst testing?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF protection often relies on checking the Referer header; if it can be removed or spoofed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Clickjacking

Answer

Cross-Site Scripting (XSS)

Question 5

Which of the following is a common indicator of a stored (persistent) Cross-Site Scripting (XSS) attack?

Accepted Answer

A script is permanently stored on the server and executed when users view a page. Stored (persistent) XSS occurs when malicious script is permanently stored on the server (e.g., in a database, comment field, or forum post) and is served to every user who views the affected page. The script executes in the victim's browser without requiring any additional interaction, as it is part of the page's HTML response from the server.

Answer

A script executes in the victim's browser without any server interaction

Answer

A script is executed when a user submits a form with malicious input

Answer

A script executes only after clicking a manipulated URL

Question 6

A web application firewall (WAF) blocks requests containing ' UNION SELECT '. A penetration tester wants to bypass this restriction to perform a union-based SQL injection. Which of the following techniques is MOST likely to succeed?

Accepted Answer

Use inline comments: 'UN/**/ION/**/SE/**/LECT'. Using comments or alternative encoding can bypass WAF rules. Inline comments like '/**/' can break up keywords.

Answer

Use double URL encoding: '%25%35%35%25%34%65%25%34%39...'

Answer

Use hex encoding: '0x554e494f4e2053454c454354'

Answer

Use URL encoding: '%55%4e%49%4f%4e%20%53%45%4c%45%43%54'

Question 7

An organization wants to prevent directory listing on its Apache web server. Which of the following configuration changes would achieve this?

Accepted Answer

Set 'Options -Indexes' in the httpd.conf or .htaccess file. Disabling the Indexes option in the Directory directive prevents Apache from listing directory contents when no index file exists.

Answer

Set 'AllowOverride None'

Answer

Set 'ServerSignature Off'

Answer

Set 'DirectoryIndex disabled'

Question 8

Which TWO of the following are effective mitigations against Clickjacking attacks? (Choose 2)

Accepted Answer

Set Content-Security-Policy: frame-ancestors 'none'. X-Frame-Options header and Content-Security-Policy frame-ancestors directive are both effective against clickjacking.

Answer

Enable HTTP Strict-Transport-Security (HSTS)

Answer

Use CSRF tokens

Answer

Set SameSite cookies to Strict

Question 9

Which THREE of the following are types of SQL injection attacks? (Choose 3)

Accepted Answer

Out-of-band SQLi (e.g., DNS or HTTP exfiltration). Out-of-band SQLi (option A) is correct because it uses a different channel (e.g., DNS or HTTP requests) to exfiltrate data when the attacker cannot receive direct responses from the database. This technique is effective when the database server can initiate outbound network connections, allowing data to be sent to an attacker-controlled server via DNS queries or HTTP requests.

Answer

Stored SQLi

Answer

Reflected SQLi

Question 10

Which TWO of the following are common tools used for web application security testing? (Choose 2)

Accepted Answer

Burp Suite. Burp Suite and OWASP ZAP are both widely used web application security testing tools.

Answer

Wireshark

Answer

Nessus

Answer

Metasploit

Question 11

A security analyst notices that a web application returns different page sizes when a valid user ID is submitted versus an invalid one in the URL parameter. Which type of vulnerability is most likely being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). This is a classic indicator of an Insecure Direct Object Reference (IDOR) vulnerability, where an attacker can enumerate valid IDs by observing differences in responses.

Answer

Stored Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Question 12

Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws. It supports a wide range of database backends and injection techniques, making it the go-to tool for this specific task.

Answer

Burp Suite

Answer

Metasploit

Answer

Nmap

Question 13

During a web application penetration test, a tester submits a comment containing '' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?

Accepted Answer

Stored (persistent) XSS. Stored (persistent) XSS occurs when the injected script is permanently stored on the server (e.g., in a database) and executed for every user who accesses that content.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 14

A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:

Accepted Answer

Directory traversal. Directory traversal (also known as path traversal) allows an attacker to access files outside the intended directory by using '../' sequences.

Answer

Command injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 15

Which of the following is the most effective defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are the most effective defense because they are unique, unpredictable values embedded in each form or request that the server validates. Without a valid token, the server rejects the request, preventing an attacker from forging a legitimate user's action even if the victim is authenticated.

Answer

Content Security Policy (CSP)

Answer

Rate limiting

Answer

Input validation