CEH Web Application and Injection Attacks Practice Test 9 — 15 Questions

Question 1

Which HTTP method is commonly used by WebDAV to upload files to a web server, and if misconfigured, could allow an attacker to upload malicious scripts?

Accepted Answer

PUT. The PUT method is used by WebDAV to upload files to a web server. If WebDAV is misconfigured to allow unauthenticated PUT requests, an attacker can upload malicious scripts (e.g., web shells) to the server, leading to remote code execution. PUT is idempotent and directly places the request body at the specified URI.

Answer

DELETE

Answer

GET

Answer

POST

Question 2

A web application takes a URL from user input and fetches the content to display on the page. An attacker submits a URL pointing to an internal service like http://localhost:8080/admin. The server retrieves the internal resource and returns it. What is this attack?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when a server makes requests to internal resources based on user-supplied URLs.

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Remote File Inclusion (RFI)

Question 3

Which of the following Burp Suite tools is used to automatically fuzz web application inputs and identify common vulnerabilities like SQL injection and XSS?

Accepted Answer

Intruder. Burp Intruder is a tool for automating customized attacks against web applications, including fuzzing for vulnerabilities.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 4

A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.

Answer

Union-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

Error-based SQL injection

Question 5

After a security incident, logs show repeated login attempts from different IP addresses using a list of common passwords against a single username. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying uses a small set of common passwords against many accounts or, as in this case, against a single account from multiple IPs to avoid lockout.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 6

A web application allows users to upload profile images. An attacker uploads a file named 'image.php.png' with malicious PHP code, and the server executes it as PHP. Which type of vulnerability is this?

Accepted Answer

Unrestricted file upload. The vulnerability is unrestricted file upload because the application allows an attacker to upload a file with a double extension ('image.php.png') that the server executes as PHP. This occurs when the server does not properly validate file types, extensions, or content, allowing executable code to be uploaded and run. The double extension tricks the server into treating the file as an image while the PHP interpreter executes it.

Answer

Directory traversal

Answer

Command injection

Answer

SQL injection

Question 7

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Using anti-CSRF tokens. Option A (Using anti-CSRF tokens) is correct because a unique, unpredictable token tied to the user's session and validated server-side ensures that a forged request originating from a malicious third-party site cannot include the correct token, so the request is rejected. Option B (Setting the SameSite attribute on cookies) is correct because SameSite=Lax or SameSite=Strict prevents the browser from attaching session cookies to cross-site requests, which blocks the automatic credential submission that CSRF relies on. Option C (HSTS) is not correct because it only enforces HTTPS and prevents protocol downgrade/SSL-stripping attacks, not cross-site request forgery. Option D (input validation) is not correct because validating input addresses injection flaws like XSS or SQLi but does not stop a browser from sending an authenticated forged request. Option E (CSP headers) is not correct because CSP mitigates XSS and content-injection risks, which is a different attack class than CSRF.

Answer

Enabling HTTP Strict Transport Security (HSTS)

Answer

Implementing input validation on all user inputs

Answer

Using Content Security Policy (CSP) headers

Question 8

Which THREE of the following are types of SQL injection attacks? (Select 3)

Accepted Answer

Blind SQL injection (boolean-based, time-based). Blind SQL injection (C) is a recognized SQLi type where the attacker gets no direct data in the response and instead infers information via boolean true/false queries or time delays (e.g., WAITFOR DELAY, SLEEP). In-band SQL injection (D) is the classic SQLi category where results are returned through the same channel used to inject, typically via error-based or UNION-based techniques. Out-of-band SQL injection (E) is also a valid SQLi type that uses a different channel (e.g., DNS or HTTP requests via xp_dirtree or UTL_HTTP) to exfiltrate data when in-band and blind methods are not viable. The other options do not belong: DOM-based SQL injection (A) is not a SQLi category (DOM-based is a type of XSS), and stored SQL injection (B) is not a standard SQLi classification (stored XSS is a distinct vulnerability).

Answer

DOM-based SQL injection

Answer

Stored SQL injection

Question 9

A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the web server in the response without proper encoding, causing the script to execute in the victim's browser. The scenario describes a search field where the payload is reflected in the URL and executes, which is classic reflected XSS.

Answer

Blind XSS

Answer

Stored (persistent) XSS

Answer

DOM-based XSS

Question 10

During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). Insecure Direct Object Reference (IDOR) occurs when an application exposes an internal object identifier, such as a numeric id in a URL, and fails to verify that the requester is authorized to access that object. Changing the id to another user's value and retrieving their data is the classic IDOR exploitation pattern.

Answer

SQL injection

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Request Forgery (CSRF)

Question 11

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool specifically designed to automate the detection and exploitation of SQL injection flaws in web applications. It supports a wide range of database backends, injection techniques (boolean-based, time-based, error-based, UNION, stacked queries), and post-exploitation actions such as dumping database contents. This makes it the correct answer for automated SQLi detection and exploitation.

Answer

Burp Suite

Answer

Nikto

Answer

Metasploit

Question 12

An application allows users to upload XML files for processing. A tester uploads the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which attack is being performed?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read a local file. The server's XML parser processes the entity and reflects the file content, confirming the vulnerability.

Answer

SQL injection

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Question 13

A security analyst observes that a web application's login page responds with different HTTP status codes and response times for valid versus invalid usernames. This information leakage could be used to perform which type of authentication attack?

Accepted Answer

Username enumeration. Username enumeration occurs when an application's responses (status codes, error messages, or timing) differ based on whether a submitted username exists. Attackers exploit this discrepancy to build a list of valid usernames before launching targeted password attacks. The scenario explicitly describes different HTTP status codes and response times for valid versus invalid usernames, which is the textbook signature of username enumeration.

Answer

Credential stuffing

Answer

Password spraying

Answer

Brute force attack

Question 14

A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?

Accepted Answer

Exploitation. Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.

Answer

Reconnaissance

Answer

Reporting

Answer

Scanning and enumeration

Question 15

While analyzing web server logs, an analyst finds the following entry: GET /../../../../etc/passwd HTTP/1.1 with a 200 OK response. Which vulnerability is indicated, and what is the MOST likely impact?

Accepted Answer

Directory traversal; reading sensitive files. The path contains '../' sequences indicating directory traversal. A 200 response suggests the attacker successfully read the /etc/passwd file, leading to disclosure of system user accounts. This can aid further attacks like password cracking.

Answer

Command injection; remote shell access

Answer

SQL injection; data exfiltration

Answer

Remote File Inclusion (RFI); arbitrary code execution