CEH Web Application and Injection Attacks Practice Test 7 — 15 Questions

Question 1

An analyst notices that a web application's login page returns a generic 'Invalid credentials' message regardless of whether the username is valid. This is an example of which security control?

Accepted Answer

Generic error messages. Providing generic error messages prevents attackers from enumerating valid usernames, which is a common mitigation against brute-force attacks.

Answer

Anti-CSRF token

Answer

Account lockout policy

Answer

Rate limiting

Question 2

A web server is configured with WebDAV and allows PUT requests. An attacker uploads a .asp file and accesses it to execute code. Which tool or method is most directly associated with exploiting this misconfiguration?

Accepted Answer

File upload vulnerability. WebDAV with PUT enabled allows attackers to upload arbitrary files, including web shells, leading to remote code execution.

Answer

SQL injection

Answer

Directory brute forcing

Answer

Cross-site scripting (XSS)

Question 3

A penetration tester uses a tool to intercept and modify HTTP/HTTPS requests in real-time between the browser and the web application. Which tool is being used?

Accepted Answer

Burp Suite Proxy. Burp Suite's Proxy module allows interception and modification of HTTP/HTTPS traffic. Repeater is for resending requests, Intruder for automated attacks, Scanner for vulnerability scanning.

Answer

SQLMap

Answer

Nmap

Answer

Metasploit

Question 4

An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?

Accepted Answer

The application includes a parameter like 'url=' that fetches remote resources. SSRF vulnerabilities often appear where the application fetches URLs based on user input, such as 'url=' parameters, allowing the attacker to make the server request internal resources.

Answer

The application uses user input in file inclusion functions like include()

Answer

The application reflects user input in HTTP headers

Answer

The application stores user input in a database without sanitization

Question 5

Which of the following best describes the attack where an attacker uses a valid session token to impersonate a user without needing to authenticate?

Accepted Answer

Session hijacking. Session hijacking involves stealing or using a valid session token to impersonate a user, bypassing authentication.

Answer

Cross-site scripting

Answer

Phishing

Answer

Brute-force attack

Question 6

A security analyst is reviewing a web application log and sees the following request: GET /page?file=../../../etc/passwd HTTP/1.1. Which TWO vulnerabilities are most likely being attempted? (Select two)

Accepted Answer

Directory traversal. The request uses '../' to traverse directories (directory traversal) and attempts to read the /etc/passwd file, which is also a local file inclusion (LFI) attempt if the application includes files.

Answer

Remote file inclusion (RFI)

Answer

SQL injection

Answer

Command injection

Question 7

Which THREE of the following are common types of SQL injection attacks? (Select three)

Accepted Answer

Out-of-band SQL injection. In-band SQL injection (including error-based and union-based) are classic types. Blind SQL injection (boolean-based and time-based) are also common. Out-of-band is less common but still a type.

Answer

Reflected SQL injection

Answer

Stored SQL injection

Question 8

During a penetration test, a tester observes that a web application's login form does not implement rate limiting and returns different error messages for valid vs invalid usernames. Which THREE attacks are most likely to be successful? (Select three)

Accepted Answer

Credential stuffing. With username enumeration and no rate limiting, brute force (trying many passwords on one user), credential stuffing (using breached credentials), and password spraying (trying common passwords across many users) are all viable. SQL injection is not directly related to the described conditions.

Answer

Directory traversal

Answer

SQL injection

Question 9

A security analyst notices that a web application returns different error messages for valid and invalid usernames during login. Which type of attack is this application MOST vulnerable to?

Accepted Answer

Username enumeration. The different error messages allow an attacker to enumerate valid usernames, which is a common precursor to brute-force or credential-stuffing attacks.

Answer

Directory traversal

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 10

During a penetration test, you identify a parameter in a web application that appears to fetch a file from the server. You modify the parameter to '../../../etc/passwd' and see the contents of the passwd file. Which type of vulnerability is this?

Accepted Answer

Directory traversal. The use of '../' sequences to traverse directories and access files outside the web root is classic directory traversal.

Answer

Remote File Inclusion (RFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

Local File Inclusion (LFI)

Question 11

Which of the following is the BEST defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are unique, unpredictable tokens that validate that requests originate from the legitimate site, effectively mitigating CSRF.

Answer

SameSite cookies

Answer

Input validation

Answer

Output encoding

Question 12

A web application allows users to submit feedback that is stored in a database and displayed to other users without proper sanitization. A tester inputs '' and it executes when other users view the feedback. Which type of XSS is this?

Accepted Answer

Stored XSS. The payload is stored in the database and executed when other users load the page, which is stored (persistent) XSS.

Answer

Self-XSS

Answer

DOM-based XSS

Answer

Reflected XSS

Question 13

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page.php?id=1' --batch --dbs. Which database enumeration technique is SQLMap using by default?

Accepted Answer

In-band SQL injection. Without specifying a technique, SQLMap defaults to using in-band (UNION) and error-based techniques, which are all in-band.

Answer

Out-of-band SQL injection

Answer

Blind SQL injection

Answer

Time-based SQL injection

Question 14

A web server is found to have directory listing enabled for the /uploads folder. An attacker discovers a shell.php file uploaded earlier. Which attack is the attacker MOST likely to perform next?

Accepted Answer

Remote code execution via uploaded shell. With directory listing, the attacker can find the path to the uploaded shell and then access it to execute commands on the server.

Answer

File inclusion

Answer

Cross-site scripting

Answer

SQL injection

Question 15

A security team wants to test their web application for vulnerabilities. Which Burp Suite tool is BEST suited for automating attacks like brute-force or fuzzing?

Accepted Answer

Intruder. Intruder is designed for automated customized attacks including brute-force, fuzzing, and credential stuffing.

Answer

Proxy

Answer

Repeater

Answer

Scanner