CEH Web Application and Injection Attacks Practice Test 8 — 15 Questions

Question 1

During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR occurs when an application exposes a direct reference to an internal object (like a user ID) without proper authorization checks, allowing unauthorized access.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 2

A security team discovers that their web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. Which of the following is the MOST effective mitigation technique to prevent SSRF?

Accepted Answer

Implement a whitelist of allowed domains and IP addresses for outbound requests. Whitelisting allowed domains and IP addresses is the most effective SSRF mitigation because it restricts the server from making requests to arbitrary external or internal resources.

Answer

Use input validation to block URLs containing '127.0.0.1' or 'localhost'

Answer

Implement CSRF tokens on all forms

Answer

Disable unnecessary HTTP methods on the web server

Question 3

Which of the following tools is specifically designed to automate the exploitation of SQL injection vulnerabilities and retrieve data from databases?

Accepted Answer

SQLMap. SQLMap is an open-source tool that automates detection and exploitation of SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 4

A penetration tester identifies a web page that reflects user input in the response without proper encoding. The input is submitted via a GET parameter. Which type of cross-site scripting (XSS) is MOST likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization, typically via GET parameters.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 5

A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?

Accepted Answer

To mitigate cross-site request forgery (CSRF) attacks. SameSite=Lax prevents the browser from sending the cookie in cross-site requests initiated by third-party websites, mitigating CSRF attacks.

Answer

To enforce HTTPS for cookie transmission

Answer

To prevent the cookie from being accessed by JavaScript

Answer

To ensure the cookie is only sent over HTTP and not FTP

Question 6

During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.

Answer

Remote File Inclusion (RFI)

Answer

Command Injection

Answer

Directory Traversal

Question 7

Which HTTP method is commonly used by WebDAV to upload files to a web server, and if misconfigured, could allow an attacker to upload malicious scripts?

Accepted Answer

PUT. The PUT method allows uploading resources to the server, and if enabled without proper controls, can be exploited to upload malicious files.

Answer

DELETE

Answer

GET

Answer

POST

Question 8

A web application takes a URL from user input and fetches the content to display on the page. An attacker submits a URL pointing to an internal service like http://localhost:8080/admin. The server retrieves the internal resource and returns it. What is this attack?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when a server makes requests to internal resources based on user-supplied URLs.

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Remote File Inclusion (RFI)

Question 9

Which of the following Burp Suite tools is used to automatically fuzz web application inputs and identify common vulnerabilities like SQL injection and XSS?

Accepted Answer

Intruder. Burp Intruder is a tool for automating customized attacks against web applications, including fuzzing for vulnerabilities.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 10

A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.

Answer

Union-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

Error-based SQL injection

Question 11

After a security incident, logs show repeated login attempts from different IP addresses using a list of common passwords against a single username. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying uses a small set of common passwords against many accounts or, as in this case, against a single account from multiple IPs to avoid lockout.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 12

A web application allows users to upload profile images. An attacker uploads a file named 'image.php.png' with malicious PHP code, and the server executes it as PHP. Which type of vulnerability is this?

Accepted Answer

Unrestricted file upload. Unrestricted file upload vulnerabilities allow attackers to upload executable files if the server does not validate the file type or execute permissions.

Answer

Directory traversal

Answer

Command injection

Answer

SQL injection

Question 13

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Using anti-CSRF tokens. CSRF tokens are unique per request and validated server-side. SameSite cookies restrict cookie sending to same-site requests.

Answer

Enabling HTTP Strict Transport Security (HSTS)

Answer

Implementing input validation on all user inputs

Answer

Using Content Security Policy (CSP) headers

Question 14

Which THREE of the following are types of SQL injection attacks? (Select 3)

Accepted Answer

Blind SQL injection (boolean-based, time-based). Option C is correct because blind SQL injection is a recognized type of SQL injection attack where the attacker does not receive direct error messages or data from the database but instead infers information by observing the application's response (boolean-based) or by causing time delays (time-based). This technique is commonly used when the application is configured to suppress error output, forcing the attacker to rely on side-channel behaviors.

Answer

DOM-based SQL injection

Answer

Stored SQL injection

Question 15

Which TWO of the following are common indicators of a command injection vulnerability? (Select 2)

Accepted Answer

The application allows input of shell metacharacters like ;, &&, or |. Command injection typically involves injecting shell metacharacters (;, &&, |) and can be confirmed by observing time delays with sleep commands.

Answer

The application reflects user input in the page without encoding

Answer

The application returns database error messages

Answer

The application uses parameterized queries for database access