CEH Web Application and Injection Attacks Practice Test 4 — 15 Questions

Question 1

Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is the tool for automating customized attacks like brute-forcing and fuzzing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 2

A web application allows users to upload profile pictures. The application uses the filename provided by the user to save the file on the server. An attacker uploads a file named 'malicious.php%00.png' and the server saves it as 'malicious.php'. Which vulnerability is being exploited?

Accepted Answer

Null byte injection. Null byte injection exploits the fact that in some programming languages (like C or older PHP versions), a null byte (%00) terminates a string. The application saves the file using the user-supplied filename, but when it processes 'malicious.php%00.png', the null byte causes the string to be truncated to 'malicious.php', allowing the attacker to upload a PHP file that can be executed.

Answer

Directory traversal

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 3

Which of the following is the BEST defense against brute-force attacks on a login form?

Accepted Answer

Account lockout after 5 failed attempts. Account lockout after a small number of failed attempts (D) is the most direct and effective defense against brute-force attacks on a login form: it stops the attack at the source by disabling the targeted account after repeated failures, regardless of source IP. Rate limiting (A) is a useful complementary control, but it can be bypassed by distributing attempts across many IPs and does not stop slow, low-rate brute-force attempts. CAPTCHA (B) can be bypassed by automated solvers, and complex password policies (C) do not prevent repeated attempts. Therefore the BEST answer is D.

Answer

Rate limiting on the login endpoint

Answer

CAPTCHA

Answer

Complex password policy

Question 4

A penetration tester discovers that a web application includes the following code: 'include($_GET['page'] . '.php');' and the application is running on a Linux server. The tester attempts to exploit this by accessing 'index.php?page=../../etc/passwd'. What type of attack is this, and will it succeed?

Accepted Answer

Local File Inclusion (LFI); it will not succeed because the '.php' extension is appended. This is a Local File Inclusion (LFI) vulnerability. The appended '.php' extension prevents reading '/etc/passwd' because the file would be interpreted as '/etc/passwd.php', which does not exist.

Answer

Directory traversal; it will succeed because '../' bypasses restrictions

Answer

Remote File Inclusion (RFI); it will succeed because the parameter is not filtered

Answer

Command injection; it will succeed if the server interprets PHP code

Question 5

An attacker wants to perform a CSRF attack against a banking application. The application uses SameSite cookies set to 'Strict'. The attacker hosts a malicious page on their own domain. When the victim visits the malicious page, which of the following statements is TRUE regarding the CSRF attack?

Accepted Answer

The attack will fail because the browser will not include the session cookie with the cross-origin request.. SameSite=Strict prevents cookies from being sent on cross-site requests, effectively blocking CSRF attacks if the attacker cannot control the origin.

Answer

The attack will succeed because cookies are sent regardless of SameSite settings.

Answer

The attack will succeed because the attacker can bypass SameSite using GET requests.

Answer

The attack will fail because CSRF requires POST requests and the malicious page only uses GET.

Question 6

A web application uses XML to transmit data between client and server. A tester submits the following payload: ']>&xxe;'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.

Answer

SQL injection

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 7

During a web application test, an analyst intercepts a request containing a 'Referer' header that points to a different domain. The analyst modifies the request by removing the 'Referer' header and the action still executes successfully. Which type of attack is the analyst testing?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF protection often relies on checking the Referer header; if it can be removed or spoofed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Clickjacking

Answer

Cross-Site Scripting (XSS)

Question 8

Which of the following is a common indicator of a stored (persistent) Cross-Site Scripting (XSS) attack?

Accepted Answer

A script is permanently stored on the server and executed when users view a page. Stored (persistent) XSS occurs when malicious script is permanently stored on the server (e.g., in a database, comment field, or forum post) and is served to every user who views the affected page. The script executes in the victim's browser without requiring any additional interaction, as it is part of the page's HTML response from the server.

Answer

A script executes in the victim's browser without any server interaction

Answer

A script is executed when a user submits a form with malicious input

Answer

A script executes only after clicking a manipulated URL

Question 9

A web application firewall (WAF) blocks requests containing ' UNION SELECT '. A penetration tester wants to bypass this restriction to perform a union-based SQL injection. Which of the following techniques is MOST likely to succeed?

Accepted Answer

Use inline comments: 'UN/**/ION/**/SE/**/LECT'. Using comments or alternative encoding can bypass WAF rules. Inline comments like '/**/' can break up keywords.

Answer

Use double URL encoding: '%25%35%35%25%34%65%25%34%39...'

Answer

Use hex encoding: '0x554e494f4e2053454c454354'

Answer

Use URL encoding: '%55%4e%49%4f%4e%20%53%45%4c%45%43%54'

Question 10

An organization wants to prevent directory listing on its Apache web server. Which of the following configuration changes would achieve this?

Accepted Answer

Set 'Options -Indexes' in the httpd.conf or .htaccess file. Disabling the Indexes option in the Directory directive prevents Apache from listing directory contents when no index file exists.

Answer

Set 'AllowOverride None'

Answer

Set 'ServerSignature Off'

Answer

Set 'DirectoryIndex disabled'

Question 11

Which TWO of the following are effective mitigations against Clickjacking attacks? (Choose 2)

Accepted Answer

Set Content-Security-Policy: frame-ancestors 'none'. Option B is correct because the Content-Security-Policy directive frame-ancestors 'none' instructs the browser that the page must never be embedded in a frame, iframe, or object, which directly blocks the framing technique clickjacking relies on. Option D is correct because the X-Frame-Options: DENY response header prevents the page from being rendered inside a frame on any site, including the same origin, thereby stopping clickjacking overlay attacks. Option A is not a clickjacking mitigation because HSTS only forces HTTPS connections and prevents protocol downgrade or cookie hijacking, not framing. Option C is unrelated since CSRF tokens defend against forged state-changing requests, not UI redressing. Option E is also unrelated because SameSite cookie attributes limit cross-site cookie sending to mitigate CSRF, not framing-based clickjacking.

Answer

Enable HTTP Strict-Transport-Security (HSTS)

Answer

Use CSRF tokens

Answer

Set SameSite cookies to Strict

Question 12

Which THREE of the following are types of SQL injection attacks? (Choose 3)

Accepted Answer

Out-of-band SQLi (e.g., DNS or HTTP exfiltration). Option A is correct because out-of-band SQLi is a recognized SQL injection category in which the attacker uses a separate channel such as DNS or HTTP requests to exfiltrate data when the database server cannot return results directly through the application response. Option C is correct because in-band SQLi is the classic SQL injection type where results are returned in the same communication channel, typically via error-based or UNION-based techniques that leverage database error messages or UNION SELECT statements. Option D is correct because blind (inferential) SQLi is a standard SQL injection category where no data is directly returned; instead, attackers infer information using boolean-based true/false responses or time-based delays such as WAITFOR DELAY or SLEEP. Option B is not a recognized SQLi type; 'stored' describes stored XSS, not SQL injection, even though stored procedures can be involved in SQLi. Option E is also not a SQLi category; 'reflected' describes reflected XSS, where malicious script is echoed back by the application rather than injected into SQL queries.

Answer

Stored SQLi

Answer

Reflected SQLi

Question 13

Which TWO of the following are common tools used for web application security testing? (Choose 2)

Accepted Answer

Burp Suite. Burp Suite and OWASP ZAP are both widely used web application security testing tools.

Answer

Wireshark

Answer

Nessus

Answer

Metasploit

Question 14

A security analyst notices that a web application returns different page sizes when a valid user ID is submitted versus an invalid one in the URL parameter. Which type of vulnerability is most likely being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). The different page sizes for valid versus invalid user IDs indicate an Insecure Direct Object Reference (IDOR) vulnerability, where the application exposes internal object references (like user IDs) without proper authorization checks. An attacker can manipulate the parameter to access other users' data, and the varying response size reveals whether the ID exists, enabling enumeration. This is a classic IDOR exploitation pattern.

Answer

Stored Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Question 15

Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws. It supports a wide range of database backends and injection techniques, making it the go-to tool for this specific task.

Answer

Burp Suite

Answer

Metasploit

Answer

Nmap