CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cross-Site Scripting (XSS)

  Why this is correct

  If a web application reflects unsanitized user-controlled input, such as the User-Agent HTTP header, directly into the HTML response, it creates a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious client-side scripts (e.g., JavaScript) into the User-Agent string. When another user's browser renders this page, the injected script executes within their browser's security context, potentially leading to session hijacking, defacement, or redirection.

• ✗

  Directory traversal

  Why it's wrong here

  Directory traversal, also known as path traversal, involves manipulating file paths to access files and directories outside the intended web root. This attack typically uses sequences like ../ to navigate the file system. The scenario described, involving the reflection of a User-Agent header, does not indicate any attempt or mechanism for file path manipulation or unauthorized access to server-side files.

• ✗

  Server-Side Request Forgery (SSRF)

  Why it's wrong here

  Server-Side Request Forgery (SSRF) occurs when a web application is tricked into making requests to an arbitrary domain specified by an attacker, often targeting internal systems or services. This attack leverages the server's ability to make outbound requests, but the core mechanism involves the server initiating a *new* request, not merely reflecting an incoming HTTP header. The described vulnerability is about input reflection, not server-initiated outbound requests.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection exploits vulnerabilities in an application's database queries, allowing attackers to interfere with the queries that an application makes to its database. This typically involves injecting malicious SQL code into input fields that are subsequently used in database statements. The scenario provided focuses on the reflection of an HTTP header (User-Agent) in the web application's output, with no indication of database interaction or SQL query manipulation.

Go deeper

Related to this question