CEH Web Application and Injection Attacks Practice Test 7 — 15 Questions

Question 1

A security analyst notices that a web application returns different error messages for valid and invalid usernames during login. Which type of attack is this application MOST vulnerable to?

Accepted Answer

Username enumeration. The different error messages allow an attacker to enumerate valid usernames, which is a common precursor to brute-force or credential-stuffing attacks.

Answer

Directory traversal

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 2

During a penetration test, you identify a parameter in a web application that appears to fetch a file from the server. You modify the parameter to '../../../etc/passwd' and see the contents of the passwd file. Which type of vulnerability is this?

Accepted Answer

Directory traversal. The use of '../' sequences to traverse directories and access files outside the web root is classic directory traversal.

Answer

Remote File Inclusion (RFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

Local File Inclusion (LFI)

Question 3

Which of the following is the BEST defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are unique, unpredictable tokens that validate that requests originate from the legitimate site, effectively mitigating CSRF.

Answer

SameSite cookies

Answer

Input validation

Answer

Output encoding

Question 4

A web application allows users to submit feedback that is stored in a database and displayed to other users without proper sanitization. A tester inputs '' and it executes when other users view the feedback. Which type of XSS is this?

Accepted Answer

Stored XSS. The payload is stored in the database and executed when other users load the page, which is stored (persistent) XSS.

Answer

Self-XSS

Answer

DOM-based XSS

Answer

Reflected XSS

Question 5

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page.php?id=1' --batch --dbs. Which database enumeration technique is SQLMap using by default?

Accepted Answer

In-band SQL injection. Without specifying a technique, SQLMap defaults to using in-band (UNION) and error-based techniques, which are all in-band.

Answer

Out-of-band SQL injection

Answer

Blind SQL injection

Answer

Time-based SQL injection

Question 6

A web server is found to have directory listing enabled for the /uploads folder. An attacker discovers a shell.php file uploaded earlier. Which attack is the attacker MOST likely to perform next?

Accepted Answer

Remote code execution via uploaded shell. With directory listing, the attacker can find the path to the uploaded shell and then access it to execute commands on the server.

Answer

File inclusion

Answer

Cross-site scripting

Answer

SQL injection

Question 7

A security team wants to test their web application for vulnerabilities. Which Burp Suite tool is BEST suited for automating attacks like brute-force or fuzzing?

Accepted Answer

Intruder. Intruder is designed for automated customized attacks including brute-force, fuzzing, and credential stuffing.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 8

A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF). This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.

Answer

Command injection

Answer

Remote File Inclusion (RFI)

Answer

Directory traversal

Question 9

Which of the following is a primary defense against SQL injection attacks?

Accepted Answer

Prepared statements. Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.

Answer

HTTPS encryption

Answer

Input blacklisting

Answer

Output encoding

Question 10

An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?

Accepted Answer

Trying a few common passwords against many accounts. Password spraying uses a few common passwords against many accounts to avoid account lockout.

Answer

Using a list of compromised credentials from a data breach

Answer

Trying many passwords for a single account

Answer

Using automated tools to bypass CAPTCHA

Question 11

A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?

Accepted Answer

Remote File Inclusion (RFI). Including a remote file from an attacker-controlled server is Remote File Inclusion (RFI).

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 12

A web application uses an XML parser to process user-supplied XML documents. An attacker submits the following payload: ]>&xxe;. Which vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. The payload defines an external entity that reads a local file, which is classic XXE (XML External Entity) injection.

Answer

Server-Side Request Forgery (SSRF)

Answer

XPath injection

Answer

SQL injection

Question 13

Which TWO of the following are characteristics of a reflected Cross-Site Scripting (XSS) attack? (Select 2)

Accepted Answer

The attack is typically delivered through a crafted link. Reflected XSS requires user interaction (clicking a link) and does not persist on the server.

Answer

The script executes in the server-side context

Answer

The attack affects all users who visit the compromised page without any interaction

Answer

The malicious script is permanently stored on the server

Question 14

Which TWO of the following are commonly used to mitigate SQL injection vulnerabilities? (Select 2)

Accepted Answer

Stored procedures. Parameterized queries and stored procedures (when used correctly) prevent SQL injection by separating SQL logic from data.

Answer

Output encoding

Answer

Input validation

Answer

HTTPS encryption

Question 15

Which THREE of the following are valid defenses against CSRF attacks? (Select 3)

Accepted Answer

Custom request headers (e.g., X-Requested-With). CSRF tokens, SameSite cookies (Lax or Strict), and custom headers (e.g., X-Requested-With with XMLHttpRequest) are all effective CSRF defenses.

Answer

Input validation

Answer

Output encoding