CEH Web Application and Injection Attacks Practice Test 8 — 15 Questions

Question 1

A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server-Side Request Forgery (SSRF). This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.

Answer

Command injection

Answer

Remote File Inclusion (RFI)

Answer

Directory traversal

Question 2

Which of the following is a primary defense against SQL injection attacks?

Accepted Answer

Prepared statements. Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.

Answer

HTTPS encryption

Answer

Input blacklisting

Answer

Output encoding

Question 3

An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?

Accepted Answer

Trying a few common passwords against many accounts. Password spraying uses a few common passwords against many accounts to avoid account lockout.

Answer

Using a list of compromised credentials from a data breach

Answer

Trying many passwords for a single account

Answer

Using automated tools to bypass CAPTCHA

Question 4

A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?

Accepted Answer

Remote File Inclusion (RFI). Including a remote file from an attacker-controlled server is Remote File Inclusion (RFI).

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 5

A web application uses an XML parser to process user-supplied XML documents. An attacker submits the following payload: ]>&xxe;. Which vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. The payload defines an external entity that reads a local file, which is classic XXE (XML External Entity) injection.

Answer

Server-Side Request Forgery (SSRF)

Answer

XPath injection

Answer

SQL injection

Question 6

Which TWO of the following are characteristics of a reflected Cross-Site Scripting (XSS) attack? (Select 2)

Accepted Answer

The attack is typically delivered through a crafted link. Reflected XSS requires user interaction (clicking a link) and does not persist on the server.

Answer

The script executes in the server-side context

Answer

The attack affects all users who visit the compromised page without any interaction

Answer

The malicious script is permanently stored on the server

Question 7

Which TWO of the following are commonly used to mitigate SQL injection vulnerabilities? (Select 2)

Accepted Answer

Stored procedures. Parameterized queries and stored procedures (when used correctly) prevent SQL injection by separating SQL logic from data.

Answer

Output encoding

Answer

Input validation

Answer

HTTPS encryption

Question 8

Which THREE of the following are valid defenses against CSRF attacks? (Select 3)

Accepted Answer

Custom request headers (e.g., X-Requested-With). CSRF tokens, SameSite cookies (Lax or Strict), and custom headers (e.g., X-Requested-With with XMLHttpRequest) are all effective CSRF defenses.

Answer

Input validation

Answer

Output encoding

Question 9

During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR occurs when an application exposes a direct reference to an internal object (like a user ID) without proper authorization checks, allowing unauthorized access.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 10

A security team discovers that their web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. Which of the following is the MOST effective mitigation technique to prevent SSRF?

Accepted Answer

Implement a whitelist of allowed domains and IP addresses for outbound requests. Whitelisting allowed domains and IP addresses is the most effective SSRF mitigation because it restricts the server from making requests to arbitrary external or internal resources.

Answer

Use input validation to block URLs containing '127.0.0.1' or 'localhost'

Answer

Implement CSRF tokens on all forms

Answer

Disable unnecessary HTTP methods on the web server

Question 11

Which of the following tools is specifically designed to automate the exploitation of SQL injection vulnerabilities and retrieve data from databases?

Accepted Answer

SQLMap. SQLMap is an open-source tool that automates detection and exploitation of SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 12

A penetration tester identifies a web page that reflects user input in the response without proper encoding. The input is submitted via a GET parameter. Which type of cross-site scripting (XSS) is MOST likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization, typically via GET parameters.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 13

A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?

Accepted Answer

To mitigate cross-site request forgery (CSRF) attacks. SameSite=Lax prevents the browser from sending the cookie in cross-site requests initiated by third-party websites, mitigating CSRF attacks.

Answer

To enforce HTTPS for cookie transmission

Answer

To prevent the cookie from being accessed by JavaScript

Answer

To ensure the cookie is only sent over HTTP and not FTP

Question 14

During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.

Answer

Remote File Inclusion (RFI)

Answer

Command Injection

Answer

Directory Traversal

Question 15

Which HTTP method is commonly used by WebDAV to upload files to a web server, and if misconfigured, could allow an attacker to upload malicious scripts?

Accepted Answer

PUT. The PUT method allows uploading resources to the server, and if enabled without proper controls, can be exploited to upload malicious files.

Answer

DELETE

Answer

GET

Answer

POST