CEH Web Application and Injection Attacks Practice Test 9 — 15 Questions

Question 1

A web application takes a URL from user input and fetches the content to display on the page. An attacker submits a URL pointing to an internal service like http://localhost:8080/admin. The server retrieves the internal resource and returns it. What is this attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when a server makes requests to internal resources based on user-supplied URLs.

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Remote File Inclusion (RFI)

Question 2

Which of the following Burp Suite tools is used to automatically fuzz web application inputs and identify common vulnerabilities like SQL injection and XSS?

Accepted Answer

Intruder. Burp Intruder is a tool for automating customized attacks against web applications, including fuzzing for vulnerabilities.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 3

A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.

Answer

Union-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

Error-based SQL injection

Question 4

After a security incident, logs show repeated login attempts from different IP addresses using a list of common passwords against a single username. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying uses a small set of common passwords against many accounts or, as in this case, against a single account from multiple IPs to avoid lockout.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 5

A web application allows users to upload profile images. An attacker uploads a file named 'image.php.png' with malicious PHP code, and the server executes it as PHP. Which type of vulnerability is this?

Accepted Answer

Unrestricted file upload. Unrestricted file upload vulnerabilities allow attackers to upload executable files if the server does not validate the file type or execute permissions.

Answer

Directory traversal

Answer

Command injection

Answer

SQL injection

Question 6

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Using anti-CSRF tokens. CSRF tokens are unique per request and validated server-side. SameSite cookies restrict cookie sending to same-site requests.

Answer

Enabling HTTP Strict Transport Security (HSTS)

Answer

Implementing input validation on all user inputs

Answer

Using Content Security Policy (CSP) headers

Question 7

Which THREE of the following are types of SQL injection attacks? (Select 3)

Accepted Answer

Blind SQL injection (boolean-based, time-based). Blind SQL injection is a recognized type of SQL injection attack where the attacker does not receive direct error messages or data from the database but instead infers information by observing the application's response (boolean-based) or by causing time delays (time-based). This technique is commonly used when the application is configured to suppress error output, forcing the attacker to rely on side-channel behaviors.

Answer

DOM-based SQL injection

Answer

Stored SQL injection

Question 8

A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization. The script executes once and is not stored, distinguishing it from stored XSS. DOM-based XSS would involve client-side JavaScript manipulation without server reflection.

Answer

Blind XSS

Answer

Stored (persistent) XSS

Answer

DOM-based XSS

Question 9

During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references (e.g., database keys) and fails to enforce proper access controls, allowing users to manipulate them to access unauthorized data.

Answer

SQL injection

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Request Forgery (CSRF)

Question 10

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection vulnerabilities. Burp Suite is a web proxy and scanner, Nikto is a web server scanner, and Metasploit is a penetration testing framework with broader capabilities.

Answer

Burp Suite

Answer

Nikto

Answer

Metasploit

Question 11

An application allows users to upload XML files for processing. A tester uploads the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which attack is being performed?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read a local file. The server's XML parser processes the entity and reflects the file content, confirming the vulnerability.

Answer

SQL injection

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Question 12

A security analyst observes that a web application's login page responds with different HTTP status codes and response times for valid versus invalid usernames. This information leakage could be used to perform which type of authentication attack?

Accepted Answer

Username enumeration. Username enumeration occurs when an application reveals whether a username exists, often through differing error messages or response times. This information can be leveraged for brute force or password spraying attacks by focusing on valid usernames.

Answer

Credential stuffing

Answer

Password spraying

Answer

Brute force attack

Question 13

A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?

Accepted Answer

Exploitation. Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.

Answer

Reconnaissance

Answer

Reporting

Answer

Scanning and enumeration

Question 14

While analyzing web server logs, an analyst finds the following entry: GET /../../../../etc/passwd HTTP/1.1 with a 200 OK response. Which vulnerability is indicated, and what is the MOST likely impact?

Accepted Answer

Directory traversal; reading sensitive files. The path contains '../' sequences indicating directory traversal. A 200 response suggests the attacker successfully read the /etc/passwd file, leading to disclosure of system user accounts. This can aid further attacks like password cracking.

Answer

Command injection; remote shell access

Answer

SQL injection; data exfiltration

Answer

Remote File Inclusion (RFI); arbitrary code execution

Question 15

Which of the following describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker forces the web server to make HTTP requests to arbitrary destinations, potentially accessing internal resources.. SSRF occurs when an attacker can induce the server to make HTTP requests to internal or external resources. This can lead to accessing internal services (e.g., cloud metadata endpoints) that are not normally accessible from the outside.

Answer

An attacker tricks a user into clicking a link that executes unwanted actions on a web application where the user is authenticated.

Answer

An attacker injects malicious scripts into a web page that executes in other users' browsers.

Answer

An attacker manipulates input to execute system commands on the server.