CEH Web Application and Injection Attacks Practice Test 5 — 15 Questions

Question 1

During a web application penetration test, a tester submits a comment containing '<script>alert("XSS")</script>' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stored (persistent) XSS. Stored (persistent) XSS occurs when malicious script is permanently saved on the target server (e.g., in a database, comment field, or message board) and served to every user who subsequently views that page. Because the payload executes for all viewers without any crafted URL or user interaction beyond visiting the page, it is the most dangerous XSS variant. The scenario describes exactly this: the comment is persisted and the script runs for all users who view it.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 2

A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:

Accepted Answer

Directory traversal. Directory traversal (also known as path traversal) allows an attacker to access files outside the intended directory by using '../' sequences.

Answer

Command injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 3

Which of the following is the most effective defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are the most effective defense because they are unique, unpredictable values embedded in each form or request that the server validates. Without a valid token, the server rejects the request, preventing an attacker from forging a legitimate user's action even if the victim is authenticated.

Answer

Content Security Policy (CSP)

Answer

Rate limiting

Answer

Input validation

Question 4

An attacker intercepts a request and notices that the server reflects the value of the 'User-Agent' header in the response without sanitization. The attacker crafts a payload that triggers an alert box. This is an example of:

Accepted Answer

Reflected XSS. Reflected XSS occurs when the application immediately returns the user input in the response; here, the User-Agent header is reflected.

Answer

HTTP header injection

Answer

DOM-based XSS

Answer

Stored XSS

Question 5

In Burp Suite, which tool is used to modify and resend individual HTTP requests to observe responses, allowing manual testing of input validation and parameter manipulation?

Accepted Answer

Repeater. Burp Repeater is designed for manually crafting and resending requests to see individual responses, ideal for testing parameter handling.

Answer

Proxy

Answer

Scanner

Answer

Intruder

Question 6

A penetration tester finds that a web application allows uploading a file with the name '../../var/www/html/shell.php'. The file is successfully written to the server. Which combination of vulnerabilities does this exploit?

Accepted Answer

Directory traversal and unrestricted file upload. Directory traversal allows moving up directories, and unrestricted file upload allows writing a PHP shell, leading to remote code execution.

Answer

Cross-Site Scripting (XSS) and CSRF

Answer

Local File Inclusion (LFI) and Remote File Inclusion (RFI)

Answer

SQL injection and command injection

Question 7

Which of the following best describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker tricks the server into making requests to internal or external resources. A Server-Side Request Forgery (SSRF) attack occurs when an attacker manipulates a vulnerable server into making HTTP requests to arbitrary destinations, often bypassing network segmentation to access internal resources (e.g., 127.0.0.1, RFC 1918 addresses) or external services. The server acts as a proxy, allowing the attacker to interact with systems that are not directly reachable, such as cloud metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/) or internal databases.

Answer

An attacker sends a malicious script that executes in a user's browser

Answer

An attacker forges HTTP requests to perform actions on behalf of an authenticated user

Answer

An attacker injects SQL commands into a database query

Question 8

A web application uses XML to transfer data. An attacker submits the following payload: ']>&xxe;'. What vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. The payload defines an external entity (xxe) that references the local file /etc/passwd and then uses it within the XML document. This is a classic XML External Entity (XXE) injection attack, where the attacker exploits weakly configured XML parsers to read local files or perform SSRF. The presence of <!DOCTYPE> with an ENTITY declaration and its usage in the root element confirms XXE.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Question 9

Which of the following is a common defense against clickjacking attacks?

Accepted Answer

Content Security Policy (CSP) with 'frame-ancestors' directive. Clickjacking attacks trick users into clicking on a hidden or disguised element on a page that is embedded in a malicious frame. The Content Security Policy (CSP) directive 'frame-ancestors' is a modern and effective defense against clickjacking. It allows the server to specify which origins are permitted to embed the page in frames, providing granular control. For example, 'frame-ancestors none' blocks all embedding, while 'frame-ancestors self' allows same-origin framing only. This directive supersedes the older X-Frame-Options header, which only supports DENY or SAMEORIGIN and is less flexible. Therefore, CSP with 'frame-ancestors' is the correct choice among the given options.

Answer

CSRF tokens

Answer

SameSite cookies

Answer

Input validation

Question 10

A security analyst observes the following in Apache access logs: 'GET /cgi-bin/test.cgi?cmd=id HTTP/1.1' 200. This is most likely an attempt at which attack?

Accepted Answer

Command injection. The log entry shows a GET request to a CGI script with a parameter 'cmd=id'. The 'cmd' parameter is a classic indicator of command injection, where an attacker attempts to execute arbitrary system commands (in this case, 'id') via a vulnerable CGI script. The HTTP 200 response suggests the command may have executed successfully, confirming the attempt.

Answer

Local File Inclusion (LFI)

Answer

SQL injection

Answer

Directory traversal

Question 11

Which TWO of the following are types of SQL injection? (Select 2)

Accepted Answer

Union-based. Union-based SQL injection (C) is a correct type because it uses the SQL UNION operator to append a crafted SELECT statement to the original query, allowing the attacker to retrieve data from other tables in the same result set. Blind boolean-based SQL injection (D) is also correct because the application returns no data or error details, so the attacker sends true/false conditions and infers information from differences in the application's response. The other options are not SQL injection types: Stored (A) and Reflected (E) are categories of cross-site scripting (XSS), and DOM-based (B) is also an XSS classification that manipulates the client-side DOM rather than injecting SQL into a database query.

Answer

Stored

Answer

DOM-based

Answer

Reflected

Question 12

Which THREE of the following are effective mitigations against brute force attacks on web application login forms? (Select 3)

Accepted Answer

Account lockout after failed attempts. Account lockout after failed attempts (A) is correct because temporarily disabling or locking an account after a defined number of failed logins (e.g., 5 attempts) prevents an attacker from making unlimited password guesses against a given username, directly throttling the brute force attempt. Implementing CAPTCHA (B) is correct because it forces a human-interaction challenge that automated tools and scripted credential-stuffing/brute force bots cannot easily solve, breaking the automation loop required for high-volume guessing. Rate limiting on login endpoints (C) is correct because restricting the number of login requests per IP, session, or time window (e.g., via 429 responses or tools like fail2ban/mod_security) slows or blocks the rapid repeated requests brute force attacks depend on. Enforcing strong password policies (D) is not among the marked answers: it increases the search space and thus the cost of guessing, but it does not stop or slow an ongoing brute force attack and can be bypassed by guessing common-but-compliant passwords. Using HTTP basic authentication (E) is not among the marked answers: it merely transmits credentials in a base64-encoded header and provides no throttling, lockout, or bot-resistance mechanism, so it does nothing to mitigate brute force and is itself weaker than form-based auth over TLS.

Answer

Enforcing strong password policies

Answer

Using HTTP basic authentication

Question 13

Which TWO of the following attacks can be prevented by properly validating and sanitizing user input? (Select 2)

Accepted Answer

SQL injection. Option B (SQL injection) is correct because SQL injection occurs when untrusted user input is concatenated into SQL queries, and validating/sanitizing that input (or using parameterized queries/prepared statements) prevents attackers from injecting malicious SQL syntax. Option E (Cross-Site Scripting, XSS) is correct because XSS arises when user-supplied data is rendered into HTML/JavaScript without proper output encoding or input sanitization, so validating and sanitizing input stops script payloads from executing in victims' browsers. Option A (CSRF) is not prevented by input validation alone; it requires anti-CSRF tokens, SameSite cookies, or origin/referer checks, since the attack abuses a victim's authenticated session rather than malformed input. Option C (MitM) is a network-layer interception problem mitigated by TLS, certificate pinning, and secure protocols, not by input validation. Option D (Clickjacking) is prevented by frame-busting headers such as X-Frame-Options or Content-Security-Policy frame-ancestors, not by sanitizing user input.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) attack

Answer

Clickjacking

Question 14

A security analyst notices that the web application returns different response times when querying user IDs. For example, a valid user ID returns the page in 2 seconds, while an invalid ID returns in 0.5 seconds. The analyst suspects a blind SQL injection vulnerability. Which SQL injection technique is MOST likely being used?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on causing a time delay (e.g., via SLEEP or WAITFOR DELAY) to infer the truth of conditions. The varying response times (2s vs 0.5s) indicate a time-based attack.

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 15

During a web application penetration test, a tester submits a comment containing '<script>alert("XSS")</script>' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The session token has expired and the user must re-authenticate. A 302 redirect to the login page is the classic server-side signal that the session cookie presented in the request is no longer valid — either it expired, was invalidated server-side, or the session store lost the record. Burp Repeater replays the exact same request with the same session token, so once that token ages out or is rotated, every subsequent replay gets bounced to authentication. This is expected behavior, not a security control firing.

Answer

The server is rate-limiting the requests

Answer

A cross-site request forgery (CSRF) token mismatch occurred

Answer

The server detected the use of a proxy and blocked the request