CEH Web Application and Injection Attacks Practice Test 5 — 15 Questions

Question 1

An attacker intercepts a request and notices that the server reflects the value of the 'User-Agent' header in the response without sanitization. The attacker crafts a payload that triggers an alert box. This is an example of:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reflected XSS. Reflected XSS occurs when the application immediately returns the user input in the response; here, the User-Agent header is reflected.

Answer

HTTP header injection

Answer

DOM-based XSS

Answer

Stored XSS

Question 2

In Burp Suite, which tool is used to modify and resend individual HTTP requests to observe responses, allowing manual testing of input validation and parameter manipulation?

Accepted Answer

Repeater. Burp Repeater is designed for manually crafting and resending requests to see individual responses, ideal for testing parameter handling.

Answer

Proxy

Answer

Scanner

Answer

Intruder

Question 3

A penetration tester finds that a web application allows uploading a file with the name '../../var/www/html/shell.php'. The file is successfully written to the server. Which combination of vulnerabilities does this exploit?

Accepted Answer

Directory traversal and unrestricted file upload. Directory traversal allows moving up directories, and unrestricted file upload allows writing a PHP shell, leading to remote code execution.

Answer

Cross-Site Scripting (XSS) and CSRF

Answer

Local File Inclusion (LFI) and Remote File Inclusion (RFI)

Answer

SQL injection and command injection

Question 4

Which of the following best describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker tricks the server into making requests to internal or external resources. A Server-Side Request Forgery (SSRF) attack occurs when an attacker manipulates a vulnerable server into making HTTP requests to arbitrary destinations, often bypassing network segmentation to access internal resources (e.g., 127.0.0.1, RFC 1918 addresses) or external services. The server acts as a proxy, allowing the attacker to interact with systems that are not directly reachable, such as cloud metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/) or internal databases.

Answer

An attacker sends a malicious script that executes in a user's browser

Answer

An attacker forges HTTP requests to perform actions on behalf of an authenticated user

Answer

An attacker injects SQL commands into a database query

Question 5

A web application uses XML to transfer data. An attacker submits the following payload: ']>&xxe;'. What vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read local files.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Question 6

Which of the following is a common defense against clickjacking attacks?

Accepted Answer

Content Security Policy (CSP) with 'frame-ancestors' directive. Clickjacking attacks trick users into clicking on a hidden or disguised element on a page that is embedded in a malicious frame. The Content Security Policy (CSP) directive 'frame-ancestors' is a modern and effective defense against clickjacking. It allows the server to specify which origins are permitted to embed the page in frames, providing granular control. For example, 'frame-ancestors none' blocks all embedding, while 'frame-ancestors self' allows same-origin framing only. This directive supersedes the older X-Frame-Options header, which only supports DENY or SAMEORIGIN and is less flexible. Therefore, CSP with 'frame-ancestors' is the correct choice among the given options.

Answer

CSRF tokens

Answer

SameSite cookies

Answer

Input validation

Question 7

A security analyst observes the following in Apache access logs: 'GET /cgi-bin/test.cgi?cmd=id HTTP/1.1' 200. This is most likely an attempt at which attack?

Accepted Answer

Command injection. The 'cmd' parameter in a CGI script is a common indicator of command injection, where the attacker tries to execute system commands.

Answer

Local File Inclusion (LFI)

Answer

SQL injection

Answer

Directory traversal

Question 8

Which TWO of the following are types of SQL injection? (Select 2)

Accepted Answer

Union-based. In-band SQL injection includes union-based and error-based. Blind SQL injection includes boolean-based and time-based. Out-of-band is another type.

Answer

Stored

Answer

DOM-based

Answer

Reflected

Question 9

Which THREE of the following are effective mitigations against brute force attacks on web application login forms? (Select 3)

Accepted Answer

Account lockout after failed attempts. Account lockout, rate limiting, and CAPTCHA all hinder automated brute force attempts. Strong password policies help but are not a direct mitigation against brute force rate.

Answer

Enforcing strong password policies

Answer

Using HTTP basic authentication

Question 10

Which TWO of the following attacks can be prevented by properly validating and sanitizing user input? (Select 2)

Accepted Answer

SQL injection. SQL injection and XSS are both injection attacks that can be prevented by input validation and sanitization. CSRF requires tokens, and clickjacking requires frame-busting headers.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) attack

Answer

Clickjacking

Question 11

A security analyst notices that the web application returns different response times when querying user IDs. For example, a valid user ID returns the page in 2 seconds, while an invalid ID returns in 0.5 seconds. The analyst suspects a blind SQL injection vulnerability. Which SQL injection technique is MOST likely being used?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on causing a time delay (e.g., via SLEEP or WAITFOR DELAY) to infer the truth of conditions. The varying response times (2s vs 0.5s) indicate a time-based attack.

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 12

Which OWASP Top 10 (2021) category describes the vulnerability where an application allows an attacker to include a remote file from an external server, leading to code execution or data disclosure?

Accepted Answer

Injection (A03:2021). Injection (A03:2021) covers various injection flaws, including Remote File Inclusion (RFI). RFI is a type of injection where user input is used to include a remote file, leading to code execution.

Answer

Security Misconfiguration (A05:2021)

Answer

Broken Access Control (A01:2021)

Answer

Cryptographic Failures (A02:2021)

Question 13

During a web application penetration test, a tester uses Burp Suite's Repeater tool to manually manipulate a request and observe the response. After sending the same request multiple times, the application returns a 302 redirect pointing to a login page. What is the MOST likely cause?

Accepted Answer

The session token has expired and the user must re-authenticate. A 302 redirect to a login page typically indicates that the session has expired or the tester's session is no longer valid. The application is redirecting to enforce authentication.

Answer

The server is rate-limiting the requests

Answer

A cross-site request forgery (CSRF) token mismatch occurred

Answer

The server detected the use of a proxy and blocked the request

Question 14

A penetration tester is testing an IIS web server and wants to exploit a WebDAV misconfiguration to upload a web shell. Which HTTP method should the tester check to determine if WebDAV is enabled and allows file uploads?

Accepted Answer

OPTIONS. The OPTIONS method queries the server for supported HTTP methods. If WebDAV is enabled, the response will include methods like PUT, DELETE, PROPFIND, etc. PUT is used for upload, but OPTIONS first confirms availability.

Answer

MOVE

Answer

PUT

Answer

PROPFIND

Question 15

Which of the following is a primary purpose of the SameSite cookie attribute in mitigating CSRF attacks?

Accepted Answer

To prevent the cookie from being sent in cross-origin requests, mitigating CSRF. SameSite cookie attribute (Strict, Lax, or None) controls when cookies are sent in cross-site requests. Setting SameSite to Lax or Strict prevents the browser from sending cookies on cross-site POST requests, thus mitigating CSRF.

Answer

To limit the cookie to a specific path

Answer

To encrypt the cookie value

Answer

To restrict the cookie to HTTPS connections only (Secure flag)