CEH Web Application and Injection Attacks Practice Question
A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploitation
Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance is the initial phase of information gathering, focusing on passive techniques like OSINT or active but non-intrusive methods to map the target's attack surface. Burp Suite Repeater, however, is an active tool designed for direct manipulation and replaying of specific HTTP requests, which goes beyond mere information gathering and actively probes for weaknesses. Its purpose is to test specific interactions, not broadly discover initial targets or gather open-source intelligence.
- ✗
Reporting
Why it's wrong here
Reporting constitutes the final phase of a penetration test, where all identified vulnerabilities, their impact, and recommended remediation steps are formally documented and presented to stakeholders. Burp Suite Repeater is an operational tool used during the active testing phase to manually craft and resend HTTP requests to analyze server responses in real-time. It facilitates the discovery and verification of vulnerabilities, but it does not generate the comprehensive, structured output required for a formal penetration test report.
- ✓
Exploitation
Why this is correct
Exploitation involves leveraging identified vulnerabilities to achieve a specific objective, such as gaining unauthorized access, escalating privileges, or exfiltrating sensitive data. Burp Suite Repeater is an indispensable tool for this phase, allowing testers to meticulously modify request parameters, headers, or body content with crafted payloads. This precision enables the confirmation and exploitation of vulnerabilities like SQL injection, cross-site scripting, or authentication bypasses by observing the server's direct, often vulnerable, responses.
- ✗
Scanning and enumeration
Why it's wrong here
Scanning typically employs automated tools to systematically identify potential vulnerabilities or open services across a broad range of targets or parameters, while enumeration focuses on gathering detailed information about specific system components. Burp Suite Repeater, in contrast, is a manual, highly targeted tool used to meticulously test a single, specific HTTP request or parameter. It is primarily utilized for in-depth analysis and verification of potential findings, often after an initial scan has identified a suspicious area, rather than for broad discovery or automated vulnerability identification.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.