CEH Web Application and Injection Attacks Practice Test 8 — 15 Questions

Question 1

A security team wants to test their web application for vulnerabilities. Which Burp Suite tool is BEST suited for automating attacks like brute-force or fuzzing?

Accepted Answer

Intruder. Intruder is designed for automated customized attacks including brute-force, fuzzing, and credential stuffing.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 2

A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF). This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.

Answer

Command injection

Answer

Remote File Inclusion (RFI)

Answer

Directory traversal

Question 3

Which of the following is a primary defense against SQL injection attacks?

Accepted Answer

Prepared statements. Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.

Answer

HTTPS encryption

Answer

Input blacklisting

Answer

Output encoding

Question 4

An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?

Accepted Answer

Trying a few common passwords against many accounts. Password spraying uses a few common passwords against many accounts to avoid account lockout.

Answer

Using a list of compromised credentials from a data breach

Answer

Trying many passwords for a single account

Answer

Using automated tools to bypass CAPTCHA

Question 5

A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?

Accepted Answer

Remote File Inclusion (RFI). The scenario describes a web application that includes files based on user input without proper validation, and the tester supplies a remote URL (http://attacker.com/malicious.txt) which the application then includes. This is the definition of Remote File Inclusion (RFI), where an attacker can include a file from a remote server, often leading to remote code execution. RFI is possible when the application uses user-supplied input in file inclusion functions (e.g., include, require in PHP) and allows remote URLs. The key indicator is the inclusion of a file from an external domain, which is RFI.

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 6

A web application uses an XML parser to process user-supplied XML documents. An attacker submits the following payload: ]>&xxe;. Which vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. The payload defines an external entity that reads a local file, which is classic XXE (XML External Entity) injection.

Answer

Server-Side Request Forgery (SSRF)

Answer

XPath injection

Answer

SQL injection

Question 7

Which TWO of the following are characteristics of a reflected Cross-Site Scripting (XSS) attack? (Select 2)

Accepted Answer

The attack is typically delivered through a crafted link. Reflected XSS requires user interaction (clicking a link) and does not persist on the server.

Answer

The script executes in the server-side context

Answer

The attack affects all users who visit the compromised page without any interaction

Answer

The malicious script is permanently stored on the server

Question 8

Which TWO of the following are commonly used to mitigate SQL injection vulnerabilities? (Select 2)

Accepted Answer

Stored procedures. Stored procedures (A) are correct because they let the database execute predefined SQL with parameters, so user input is passed as data rather than concatenated into the query string, which prevents injected SQL from altering the statement's logic. Parameterized queries (D) are correct because they use placeholders (e.g., ? or :name) bound to typed parameters, ensuring the database treats user input strictly as values and never as executable SQL, which is the most reliable defense against SQL injection. Output encoding (B) is not the right control here because it protects against XSS by escaping data rendered into HTML, not against SQL injection. Input validation (C) is a useful defense-in-depth measure but is not a primary SQL injection mitigation, since attackers can often craft input that passes validation yet still exploits a poorly built query. HTTPS encryption (E) only protects data in transit and does nothing to stop SQL injection, which exploits how queries are constructed and executed.

Answer

Output encoding

Answer

Input validation

Answer

HTTPS encryption

Question 9

Which THREE of the following are valid defenses against CSRF attacks? (Select 3)

Accepted Answer

Custom request headers (e.g., X-Requested-With). CSRF tokens, SameSite cookies (Lax or Strict), and custom headers (e.g., X-Requested-With with XMLHttpRequest) are all effective CSRF defenses.

Answer

Input validation

Answer

Output encoding

Question 10

During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR occurs when an application exposes a direct reference to an internal object (like a user ID) without proper authorization checks, allowing unauthorized access.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 11

A security team discovers that their web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. Which of the following is the MOST effective mitigation technique to prevent SSRF?

Accepted Answer

Implement a whitelist of allowed domains and IP addresses for outbound requests. Whitelisting allowed domains and IP addresses is the most effective SSRF mitigation because it restricts the server from making requests to arbitrary external or internal resources.

Answer

Use input validation to block URLs containing '127.0.0.1' or 'localhost'

Answer

Implement CSRF tokens on all forms

Answer

Disable unnecessary HTTP methods on the web server

Question 12

Which of the following tools is specifically designed to automate the exploitation of SQL injection vulnerabilities and retrieve data from databases?

Accepted Answer

SQLMap. SQLMap is a purpose-built open-source penetration testing tool that automates the detection and exploitation of SQL injection vulnerabilities and can enumerate and dump database contents. It supports a wide range of DBMS backends (MySQL, MSSQL, Oracle, PostgreSQL) and injection techniques (boolean-based, time-based, UNION, error-based). This makes it the correct answer for automating SQLi exploitation and data retrieval.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 13

A penetration tester identifies a web page that reflects user input in the response without proper encoding. The input is submitted via a GET parameter. Which type of cross-site scripting (XSS) is MOST likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the web server in the response without proper encoding or validation. Since the input is submitted via a GET parameter and reflected in the response, this is the classic pattern of reflected XSS.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 14

A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?

Accepted Answer

To mitigate cross-site request forgery (CSRF) attacks. SameSite=Lax prevents the browser from sending the cookie in cross-site requests initiated by third-party websites, mitigating CSRF attacks.

Answer

To enforce HTTPS for cookie transmission

Answer

To prevent the cookie from being accessed by JavaScript

Answer

To ensure the cookie is only sent over HTTP and not FTP

Question 15

During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.

Answer

Remote File Inclusion (RFI)

Answer

Command Injection

Answer

Directory Traversal