CEH Web Application and Injection Attacks Practice Test 5 — 15 Questions

Question 1

A security analyst notices that the web application returns different response times when querying user IDs. For example, a valid user ID returns the page in 2 seconds, while an invalid ID returns in 0.5 seconds. The analyst suspects a blind SQL injection vulnerability. Which SQL injection technique is MOST likely being used?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on causing a time delay (e.g., via SLEEP or WAITFOR DELAY) to infer the truth of conditions. The varying response times (2s vs 0.5s) indicate a time-based attack.

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 2

Which OWASP Top 10 (2021) category describes the vulnerability where an application allows an attacker to include a remote file from an external server, leading to code execution or data disclosure?

Accepted Answer

Injection (A03:2021). Injection (A03:2021) covers various injection flaws, including Remote File Inclusion (RFI). RFI is a type of injection where user input is used to include a remote file, leading to code execution.

Answer

Security Misconfiguration (A05:2021)

Answer

Broken Access Control (A01:2021)

Answer

Cryptographic Failures (A02:2021)

Question 3

During a web application penetration test, a tester uses Burp Suite's Repeater tool to manually manipulate a request and observe the response. After sending the same request multiple times, the application returns a 302 redirect pointing to a login page. What is the MOST likely cause?

Accepted Answer

The session token has expired and the user must re-authenticate. A 302 redirect to a login page typically indicates that the session has expired or the tester's session is no longer valid. The application is redirecting to enforce authentication.

Answer

The server is rate-limiting the requests

Answer

A cross-site request forgery (CSRF) token mismatch occurred

Answer

The server detected the use of a proxy and blocked the request

Question 4

A penetration tester is testing an IIS web server and wants to exploit a WebDAV misconfiguration to upload a web shell. Which HTTP method should the tester check to determine if WebDAV is enabled and allows file uploads?

Accepted Answer

OPTIONS. The OPTIONS method queries the server for supported HTTP methods. If WebDAV is enabled, the response will include methods like PUT, DELETE, PROPFIND, etc. PUT is used for upload, but OPTIONS first confirms availability.

Answer

MOVE

Answer

PUT

Answer

PROPFIND

Question 5

A security analyst identifies a vulnerability where an attacker can include a local file such as '/etc/passwd' by manipulating the 'page' parameter in the URL: http://example.com/index.php?page=../../../../etc/passwd. What type of attack is this?

Accepted Answer

Directory traversal. Directory traversal (also known as path traversal) exploits insufficient input validation to access files outside the web root by using '..' sequences.

Answer

Command injection

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Question 6

Which of the following is a primary purpose of the SameSite cookie attribute in mitigating CSRF attacks?

Accepted Answer

To prevent the cookie from being sent in cross-origin requests, mitigating CSRF. SameSite cookie attribute (Strict, Lax, or None) controls when cookies are sent in cross-site requests. Setting SameSite to Lax or Strict prevents the browser from sending cookies on cross-site POST requests, thus mitigating CSRF.

Answer

To limit the cookie to a specific path

Answer

To encrypt the cookie value

Answer

To restrict the cookie to HTTPS connections only (Secure flag)

Question 7

A penetration tester is using SQLMap to automate exploitation of a SQL injection vulnerability found in a login form. The tester wants to retrieve the names of all databases on the backend MySQL server. Which SQLMap flag should be used?

Accepted Answer

--dbs. The --dbs flag in SQLMap enumerates all databases on the database server.

Answer

--current-db

Answer

--schema

Answer

--tables

Question 8

During a penetration test, the tester finds that the Apache server is configured with directory listing enabled on the /uploads directory. The tester navigates to http://example.com/uploads/ and sees a list of files. Which of the following is the MOST immediate security concern?

Accepted Answer

Sensitive files may be exposed to unauthorized users. Directory listing exposes file names that may reveal sensitive information (e.g., backup files, config files). Attackers can then attempt to access these files directly, potentially leading to data disclosure.

Answer

The server is running an outdated version of Apache

Answer

The server is vulnerable to cross-site scripting (XSS) attacks

Answer

An attacker can upload malicious files to the directory

Question 9

A web application is vulnerable to server-side request forgery (SSRF). An attacker sends a request that causes the server to make an internal HTTP request to http://169.254.169.254/latest/meta-data/. What is the attacker attempting to achieve?

Accepted Answer

Access the cloud instance metadata to obtain temporary credentials. 169.254.169.254 is the metadata IP address for cloud providers like AWS. The attacker is trying to retrieve instance metadata, which may contain credentials (e.g., IAM role credentials).

Answer

Exploit a command injection vulnerability in the web server

Answer

Perform a denial-of-service attack on the internal network

Answer

Perform a port scan on the internal network

Question 10

Which of the following describes the difference between reflected and stored (persistent) cross-site scripting (XSS)?

Accepted Answer

Reflected XSS is non-persistent and requires user interaction, while stored XSS is persistent and can affect multiple users. Reflected XSS is injected via the current request (e.g., URL parameter) and the script reflects immediately in the response. Stored XSS is saved on the server (e.g., in a database) and executed when other users view the affected page.

Answer

Reflected XSS is a server-side vulnerability, while stored XSS is a client-side vulnerability

Answer

Reflected XSS only works with HTTP POST requests, while stored XSS works with GET requests

Answer

Reflected XSS is triggered by the server, while stored XSS is triggered by the client

Question 11

A security analyst observes that a web application allows users to submit feedback, and after submission, the feedback is displayed on a public page. An attacker submits feedback containing the script: . When an admin views the public page, the script executes. Which type of attack occurred?

Accepted Answer

Stored XSS. The script is stored on the server (feedback) and executed when the admin views the page. This is persistent (stored) XSS.

Answer

Reflected XSS

Answer

Cross-site request forgery (CSRF)

Answer

DOM-based XSS

Question 12

During a security assessment, a tester discovers an endpoint that reflects the 'User-Agent' header in the response without sanitization. The tester wants to confirm a reflected XSS vulnerability. Which of the following payloads would be MOST effective to demonstrate the issue in a single request?

Accepted Answer

Set the User-Agent to: . Using a simple script alert like is a standard proof-of-concept for reflected XSS. The exact payload may vary, but it must execute JavaScript. The simplest is an alert.

Answer

Set the User-Agent to: <img src=x onerror=alert(1)>

Answer

Set the User-Agent to: ' OR '1'='1

Answer

Set the User-Agent to: ../../../../etc/passwd

Question 13

Which TWO of the following are effective defenses against CSRF attacks? (Choose 2.)

Accepted Answer

Using anti-CSRF tokens that are validated on the server. CSRF tokens and SameSite cookies both prevent cross-site request forgery. Double Submit Cookie is also a method but not listed. Custom headers are not a standard defense; the primary ones are CSRF tokens and SameSite cookies.

Answer

Setting the Secure flag on cookies

Answer

Using input validation to block special characters

Answer

Enabling the HttpOnly flag on session cookies

Question 14

Which THREE of the following are common indicators of an SQL injection attack? (Choose 3.)

Accepted Answer

Unexpected rows or columns in query results. SQL injection often causes slow queries due to heavy operations (e.g., UNION, subqueries), unexpected rows in output, and database error messages revealing syntax details. D. and E. are not typical indicators; redirects are not SQLi specific, and dropped connections could be network issues.

Answer

Frequent 302 redirects to login pages

Answer

Multiple failed connection attempts in server logs

Question 15

Which TWO of the following are valid techniques used in password spraying attacks? (Choose 2.)

Accepted Answer

Using a list of common passwords (e.g., 'Password123', 'Welcome1') against a large set of usernames. Password spraying uses a few common passwords against many accounts to avoid lockouts. Credential stuffing uses known username/password pairs from breaches. Dictionary attack uses a list of words. Brute force tries many passwords on one account. Keylogging is passive.

Answer

Using previously compromised username/password pairs from a breach

Answer

Capturing keystrokes to obtain a user's password

Answer

Trying every possible password from a dictionary against a single username