CEH Web Application and Injection Attacks Practice Test 4 — 15 Questions

Question 1

A security analyst notices that a web application returns different page sizes when a valid user ID is submitted versus an invalid one in the URL parameter. Which type of vulnerability is most likely being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). This is a classic indicator of an Insecure Direct Object Reference (IDOR) vulnerability, where an attacker can enumerate valid IDs by observing differences in responses.

Answer

Stored Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Question 2

Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws. It supports a wide range of database backends and injection techniques, making it the go-to tool for this specific task.

Answer

Burp Suite

Answer

Metasploit

Answer

Nmap

Question 3

During a web application penetration test, a tester submits a comment containing '' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?

Accepted Answer

Stored (persistent) XSS. Stored (persistent) XSS occurs when the injected script is permanently stored on the server (e.g., in a database) and executed for every user who accesses that content.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 4

A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:

Accepted Answer

Directory traversal. Directory traversal (also known as path traversal) allows an attacker to access files outside the intended directory by using '../' sequences.

Answer

Command injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 5

Which of the following is the most effective defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are the most effective defense because they are unique, unpredictable values embedded in each form or request that the server validates. Without a valid token, the server rejects the request, preventing an attacker from forging a legitimate user's action even if the victim is authenticated.

Answer

Content Security Policy (CSP)

Answer

Rate limiting

Answer

Input validation

Question 6

An attacker intercepts a request and notices that the server reflects the value of the 'User-Agent' header in the response without sanitization. The attacker crafts a payload that triggers an alert box. This is an example of:

Accepted Answer

Reflected XSS. Reflected XSS occurs when the application immediately returns the user input in the response; here, the User-Agent header is reflected.

Answer

HTTP header injection

Answer

DOM-based XSS

Answer

Stored XSS

Question 7

In Burp Suite, which tool is used to modify and resend individual HTTP requests to observe responses, allowing manual testing of input validation and parameter manipulation?

Accepted Answer

Repeater. Burp Repeater is designed for manually crafting and resending requests to see individual responses, ideal for testing parameter handling.

Answer

Proxy

Answer

Scanner

Answer

Intruder

Question 8

A penetration tester finds that a web application allows uploading a file with the name '../../var/www/html/shell.php'. The file is successfully written to the server. Which combination of vulnerabilities does this exploit?

Accepted Answer

Directory traversal and unrestricted file upload. Directory traversal allows moving up directories, and unrestricted file upload allows writing a PHP shell, leading to remote code execution.

Answer

Cross-Site Scripting (XSS) and CSRF

Answer

Local File Inclusion (LFI) and Remote File Inclusion (RFI)

Answer

SQL injection and command injection

Question 9

Which of the following best describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker tricks the server into making requests to internal or external resources. A Server-Side Request Forgery (SSRF) attack occurs when an attacker manipulates a vulnerable server into making HTTP requests to arbitrary destinations, often bypassing network segmentation to access internal resources (e.g., 127.0.0.1, RFC 1918 addresses) or external services. The server acts as a proxy, allowing the attacker to interact with systems that are not directly reachable, such as cloud metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/) or internal databases.

Answer

An attacker sends a malicious script that executes in a user's browser

Answer

An attacker forges HTTP requests to perform actions on behalf of an authenticated user

Answer

An attacker injects SQL commands into a database query

Question 10

A web application uses XML to transfer data. An attacker submits the following payload: ']>&xxe;'. What vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read local files.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Question 11

Which of the following is a common defense against clickjacking attacks?

Accepted Answer

Content Security Policy (CSP) with 'frame-ancestors' directive. The X-Frame-Options header (e.g., DENY or SAMEORIGIN) prevents the page from being displayed in a frame, mitigating clickjacking.

Answer

CSRF tokens

Answer

SameSite cookies

Answer

Input validation

Question 12

A security analyst observes the following in Apache access logs: 'GET /cgi-bin/test.cgi?cmd=id HTTP/1.1' 200. This is most likely an attempt at which attack?

Accepted Answer

Command injection. The 'cmd' parameter in a CGI script is a common indicator of command injection, where the attacker tries to execute system commands.

Answer

Local File Inclusion (LFI)

Answer

SQL injection

Answer

Directory traversal

Question 13

Which TWO of the following are types of SQL injection? (Select 2)

Accepted Answer

Union-based. In-band SQL injection includes union-based and error-based. Blind SQL injection includes boolean-based and time-based. Out-of-band is another type.

Answer

Stored

Answer

DOM-based

Answer

Reflected

Question 14

Which THREE of the following are effective mitigations against brute force attacks on web application login forms? (Select 3)

Accepted Answer

Account lockout after failed attempts. Account lockout, rate limiting, and CAPTCHA all hinder automated brute force attempts. Strong password policies help but are not a direct mitigation against brute force rate.

Answer

Enforcing strong password policies

Answer

Using HTTP basic authentication

Question 15

Which TWO of the following attacks can be prevented by properly validating and sanitizing user input? (Select 2)

Accepted Answer

SQL injection. SQL injection and XSS are both injection attacks that can be prevented by input validation and sanitization. CSRF requires tokens, and clickjacking requires frame-busting headers.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) attack

Answer

Clickjacking