CEH Web Application and Injection Attacks Practice Test 6 — 15 Questions

Question 1

A penetration tester is using SQLMap to automate exploitation of a SQL injection vulnerability found in a login form. The tester wants to retrieve the names of all databases on the backend MySQL server. Which SQLMap flag should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--dbs. The --dbs flag in SQLMap enumerates all databases on the database server.

Answer

--current-db

Answer

--schema

Answer

--tables

Question 2

During a penetration test, the tester finds that the Apache server is configured with directory listing enabled on the /uploads directory. The tester navigates to http://example.com/uploads/ and sees a list of files. Which of the following is the MOST immediate security concern?

Accepted Answer

Sensitive files may be exposed to unauthorized users. Directory listing exposes file names that may reveal sensitive information (e.g., backup files, config files). Attackers can then attempt to access these files directly, potentially leading to data disclosure.

Answer

The server is running an outdated version of Apache

Answer

The server is vulnerable to cross-site scripting (XSS) attacks

Answer

An attacker can upload malicious files to the directory

Question 3

A web application is vulnerable to server-side request forgery (SSRF). An attacker sends a request that causes the server to make an internal HTTP request to http://169.254.169.254/latest/meta-data/. What is the attacker attempting to achieve?

Accepted Answer

Access the cloud instance metadata to obtain temporary credentials. 169.254.169.254 is the metadata IP address for cloud providers like AWS. The attacker is trying to retrieve instance metadata, which may contain credentials (e.g., IAM role credentials).

Answer

Exploit a command injection vulnerability in the web server

Answer

Perform a denial-of-service attack on the internal network

Answer

Perform a port scan on the internal network

Question 4

Which of the following describes the difference between reflected and stored (persistent) cross-site scripting (XSS)?

Accepted Answer

Reflected XSS is non-persistent and requires user interaction, while stored XSS is persistent and can affect multiple users. Reflected XSS is injected via the current request (e.g., URL parameter) and the script reflects immediately in the response. Stored XSS is saved on the server (e.g., in a database) and executed when other users view the affected page.

Answer

Reflected XSS is a server-side vulnerability, while stored XSS is a client-side vulnerability

Answer

Reflected XSS only works with HTTP POST requests, while stored XSS works with GET requests

Answer

Reflected XSS is triggered by the server, while stored XSS is triggered by the client

Question 5

A security analyst observes that a web application allows users to submit feedback, and after submission, the feedback is displayed on a public page. An attacker submits feedback containing the script: . When an admin views the public page, the script executes. Which type of attack occurred?

Accepted Answer

Stored XSS. The script is stored on the server (feedback) and executed when the admin views the page. This is persistent (stored) XSS.

Answer

Reflected XSS

Answer

Cross-site request forgery (CSRF)

Answer

DOM-based XSS

Question 6

During a security assessment, a tester discovers an endpoint that reflects the 'User-Agent' header in the response without sanitization. The tester wants to confirm a reflected XSS vulnerability. Which of the following payloads would be MOST effective to demonstrate the issue in a single request?

Accepted Answer

Set the User-Agent to: . Using a simple script alert like is a standard proof-of-concept for reflected XSS. The exact payload may vary, but it must execute JavaScript. The simplest is an alert.

Answer

Set the User-Agent to: <img src=x onerror=alert(1)>

Answer

Set the User-Agent to: ' OR '1'='1

Answer

Set the User-Agent to: ../../../../etc/passwd

Question 7

Which TWO of the following are effective defenses against CSRF attacks? (Choose 2.)

Accepted Answer

Using anti-CSRF tokens that are validated on the server. CSRF tokens and SameSite cookies both prevent cross-site request forgery. Double Submit Cookie is also a method but not listed. Custom headers are not a standard defense; the primary ones are CSRF tokens and SameSite cookies.

Answer

Setting the Secure flag on cookies

Answer

Using input validation to block special characters

Answer

Enabling the HttpOnly flag on session cookies

Question 8

Which THREE of the following are common indicators of an SQL injection attack? (Choose 3.)

Accepted Answer

Unexpected rows or columns in query results. SQL injection attacks commonly cause unexpected rows or columns in query results due to manipulated queries, unusually slow database responses from resource-intensive operations like UNION or subqueries, and database error messages that reveal syntax or structure to the attacker. Frequent 302 redirects and many failed connection attempts are not typical or specific indicators of SQL injection.

Answer

Frequent 302 redirects to login pages

Answer

Multiple failed connection attempts in server logs

Question 9

Which TWO of the following are valid techniques used in password spraying attacks? (Choose 2.)

Accepted Answer

Using a list of common passwords (e.g., 'Password123', 'Welcome1') against a large set of usernames. Password spraying uses a few common passwords against many accounts to avoid lockouts. Credential stuffing uses known username/password pairs from breaches. Dictionary attack uses a list of words. Brute force tries many passwords on one account. Keylogging is passive.

Answer

Using previously compromised username/password pairs from a breach

Answer

Capturing keystrokes to obtain a user's password

Answer

Trying every possible password from a dictionary against a single username

Question 10

A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?

Accepted Answer

Username enumeration. The difference in responses (e.g., 'User not found' vs 'Invalid password') allows an attacker to enumerate valid usernames, which is a common first step in credential stuffing or brute-force attacks.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 11

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 12

A penetration tester discovers that a web application's search functionality reflects user input directly in the page source without sanitization. The tester crafts a URL like http://example.com/search?q= and the script executes. This is an example of which type of XSS?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response, without being stored, and the example shows the payload in the URL parameter.

Answer

Stored (persistent) XSS

Answer

Blind XSS

Answer

DOM-based XSS

Question 13

During a web application assessment, a tester intercepts a request and modifies the 'Referer' header. The application then performs a state-changing action without requiring a token. Which vulnerability is most likely present?

Accepted Answer

Cross-site request forgery (CSRF). Cross-Site Request Forgery (CSRF) attacks rely on the application not verifying the origin of the request; a missing CSRF token and lack of Referer validation make the application vulnerable.

Answer

Cross-site scripting (XSS)

Answer

Server-side request forgery (SSRF)

Answer

Clickjacking

Question 14

A web application allows users to access files using parameters like 'file=report.pdf'. A tester changes the parameter to '../../etc/passwd' and retrieves the system password file. This is an example of which attack?

Accepted Answer

Directory traversal. Directory traversal attacks exploit insufficient input validation to access files outside the intended directory by using '../' sequences.

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Answer

Command injection

Question 15

A security team is implementing measures to prevent cross-site request forgery (CSRF) attacks. Which of the following is the most effective mitigation technique?

Accepted Answer

Implementing CSRF tokens. CSRF tokens are unique, unpredictable values that must be included in state-changing requests, ensuring the request originated from the legitimate site.

Answer

Enabling SSL/TLS

Answer

Using HTTP GET for all form submissions

Answer

Using input validation