CEH Web Application and Injection Attacks Practice Question
A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?
⚠ Common exam trap
EC-Council often tests the misconception that Repeater can be used for brute-forcing because it can resend requests, but Repeater lacks the automated payload iteration and response analysis features that Intruder provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intruder
Burp Suite Intruder is specifically designed for automating parameterized attacks, such as brute-forcing login credentials, by allowing the tester to define payload positions and iterate through a list of values (e.g., passwords) against a target endpoint. Unlike other tools in Burp Suite, Intruder supports multiple attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) and can handle rate limiting and session handling, making it ideal for password guessing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Repeater
Why it's wrong here
Repeater is designed for manually modifying and re-sending individual HTTP requests to observe server responses. It allows a penetration tester to precisely control each parameter, header, or body content for specific test cases, such as confirming a vulnerability or testing input validation. However, it lacks the automated payload generation and iteration capabilities required for a systematic brute-force attack across a large set of credentials or values.
- ✗
Scanner
Why it's wrong here
The Scanner module primarily functions as an automated vulnerability detection tool, performing both passive and active analysis of web applications. It identifies common security flaws like SQL injection, cross-site scripting, and insecure direct object references by analyzing traffic and sending crafted requests. While powerful for vulnerability discovery, it is not engineered to systematically iterate through a list of potential credentials or values for a brute-force attack.
- ✓
Intruder
Why this is correct
Intruder is purpose-built for automating parameterized attacks by systematically injecting various payloads into specified insertion points within an HTTP request. It enables sophisticated brute-force, dictionary, and credential stuffing attacks by iterating through user-defined lists or generated sequences of values. This module offers multiple attack types, such as Sniper or Battering Ram, to efficiently test a wide range of input fields for vulnerabilities or weak credentials.
- ✗
Proxy
Why it's wrong here
The Proxy tool acts as an intercepting intermediary, allowing a penetration tester to view, modify, and forward all HTTP/S traffic between their browser and the target web application. While essential for capturing requests and setting up other Burp Suite tools, its primary function is traffic manipulation and observation, not the automated generation and iteration of attack payloads. It facilitates manual analysis but does not execute automated brute-force attacks independently.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.