CEH Web Application and Injection Attacks Practice Test 6 — 15 Questions

Question 1

A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?

Accepted Answer

Username enumeration. The difference in responses (e.g., 'User not found' vs 'Invalid password') allows an attacker to enumerate valid usernames, which is a common first step in credential stuffing or brute-force attacks.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 2

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 3

A penetration tester discovers that a web application's search functionality reflects user input directly in the page source without sanitization. The tester crafts a URL like http://example.com/search?q= and the script executes. This is an example of which type of XSS?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response, without being stored, and the example shows the payload in the URL parameter.

Answer

Stored (persistent) XSS

Answer

Blind XSS

Answer

DOM-based XSS

Question 4

During a web application assessment, a tester intercepts a request and modifies the 'Referer' header. The application then performs a state-changing action without requiring a token. Which vulnerability is most likely present?

Accepted Answer

Cross-site request forgery (CSRF). Cross-Site Request Forgery (CSRF) attacks rely on the application not verifying the origin of the request; a missing CSRF token and lack of Referer validation make the application vulnerable.

Answer

Cross-site scripting (XSS)

Answer

Server-side request forgery (SSRF)

Answer

Clickjacking

Question 5

A web application allows users to access files using parameters like 'file=report.pdf'. A tester changes the parameter to '../../etc/passwd' and retrieves the system password file. This is an example of which attack?

Accepted Answer

Directory traversal. Directory traversal attacks exploit insufficient input validation to access files outside the intended directory by using '../' sequences.

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Answer

Command injection

Question 6

A security team is implementing measures to prevent cross-site request forgery (CSRF) attacks. Which of the following is the most effective mitigation technique?

Accepted Answer

Implementing CSRF tokens. CSRF tokens are unique, unpredictable values that must be included in state-changing requests, ensuring the request originated from the legitimate site.

Answer

Enabling SSL/TLS

Answer

Using HTTP GET for all form submissions

Answer

Using input validation

Question 7

An analyst notices that a web application's login page returns a generic 'Invalid credentials' message regardless of whether the username is valid. This is an example of which security control?

Accepted Answer

Generic error messages. Providing generic error messages prevents attackers from enumerating valid usernames, which is a common mitigation against brute-force attacks.

Answer

Anti-CSRF token

Answer

Account lockout policy

Answer

Rate limiting

Question 8

A web server is configured with WebDAV and allows PUT requests. An attacker uploads a .asp file and accesses it to execute code. Which tool or method is most directly associated with exploiting this misconfiguration?

Accepted Answer

File upload vulnerability. WebDAV with PUT enabled allows attackers to upload arbitrary files, including web shells, leading to remote code execution.

Answer

SQL injection

Answer

Directory brute forcing

Answer

Cross-site scripting (XSS)

Question 9

A penetration tester uses a tool to intercept and modify HTTP/HTTPS requests in real-time between the browser and the web application. Which tool is being used?

Accepted Answer

Burp Suite Proxy. Burp Suite's Proxy module allows interception and modification of HTTP/HTTPS traffic. Repeater is for resending requests, Intruder for automated attacks, Scanner for vulnerability scanning.

Answer

SQLMap

Answer

Nmap

Answer

Metasploit

Question 10

An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?

Accepted Answer

The application includes a parameter like 'url=' that fetches remote resources. SSRF vulnerabilities often appear where the application fetches URLs based on user input, such as 'url=' parameters, allowing the attacker to make the server request internal resources.

Answer

The application uses user input in file inclusion functions like include()

Answer

The application reflects user input in HTTP headers

Answer

The application stores user input in a database without sanitization

Question 11

Which of the following best describes the attack where an attacker uses a valid session token to impersonate a user without needing to authenticate?

Accepted Answer

Session hijacking. Session hijacking involves stealing or using a valid session token to impersonate a user, bypassing authentication.

Answer

Cross-site scripting

Answer

Phishing

Answer

Brute-force attack

Question 12

A security analyst is reviewing a web application log and sees the following request: GET /page?file=../../../etc/passwd HTTP/1.1. Which TWO vulnerabilities are most likely being attempted? (Select two)

Accepted Answer

Directory traversal. The request uses '../' to traverse directories (directory traversal) and attempts to read the /etc/passwd file, which is also a local file inclusion (LFI) attempt if the application includes files.

Answer

Remote file inclusion (RFI)

Answer

SQL injection

Answer

Command injection

Question 13

Which THREE of the following are common types of SQL injection attacks? (Select three)

Accepted Answer

Out-of-band SQL injection. In-band SQL injection (including error-based and union-based) are classic types. Blind SQL injection (boolean-based and time-based) are also common. Out-of-band is less common but still a type.

Answer

Reflected SQL injection

Answer

Stored SQL injection

Question 14

An application uses the SameSite cookie attribute. Which TWO of the following are valid values for this attribute and their purposes? (Select two)

Accepted Answer

Lax - Cookie is sent for top-level navigations with safe methods. SameSite can be set to 'Lax' (default) which allows cookies for top-level navigations, or 'Strict' which prevents cookies on cross-site requests. 'None' requires Secure flag but is used for cross-site.

Answer

None - Cookie is sent on all cross-site requests

Answer

Secure - Cookie is sent only over HTTPS

Answer

HttpOnly - Cookie is inaccessible to JavaScript

Question 15

During a penetration test, a tester observes that a web application's login form does not implement rate limiting and returns different error messages for valid vs invalid usernames. Which THREE attacks are most likely to be successful? (Select three)

Accepted Answer

Credential stuffing. With username enumeration and no rate limiting, brute force (trying many passwords on one user), credential stuffing (using breached credentials), and password spraying (trying common passwords across many users) are all viable. SQL injection is not directly related to the described conditions.

Answer

Directory traversal

Answer

SQL injection