CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Burp Scanner

  Why it's wrong here

  Burp Scanner is an automated web vulnerability scanner that passively and actively probes web applications for common security flaws like SQL injection, XSS, and path traversal. While it involves sending modified requests, its primary function is automated discovery and reporting of vulnerabilities, not manual interception and modification of specific requests or systematic brute-forcing of credentials or parameters. It operates at a higher level of abstraction than direct request manipulation.

• ✓

  Burp Proxy

  Why this is correct

  Burp Proxy is the core component for intercepting all HTTP/S traffic between the browser and the target application. It allows a penetration tester to view, analyze, and manually modify individual requests and responses in real-time before they reach their destination. This direct interception and on-the-fly modification capability is fundamental for understanding application behavior and initiating various attacks, often serving as the initial capture point for other Burp tools.

• ✗

  Burp Decoder

  Why it's wrong here

  Burp Decoder is designed for transforming data between various encoding schemes (e.g., URL, HTML, Base64) or hashing. While it modifies data, its purpose is purely for data representation and analysis, not for actively intercepting live traffic or automating attack payloads against a target application. It lacks the proxying or attack automation capabilities required for such a task.

• ✓

  Burp Intruder

  Why this is correct

  Burp Intruder is a powerful tool for automating customized attacks against web applications by systematically injecting various payloads into specific request parameters. It excels at tasks like brute-forcing credentials, fuzzing input fields, or enumerating valid values by sending numerous modified requests based on predefined attack types and payload sets. This systematic and automated modification of requests is a key aspect of its functionality.

• ✗

  Burp Repeater

  Why it's wrong here

  Burp Repeater allows a penetration tester to manually modify and resend individual HTTP requests repeatedly, observing the application's responses in detail. While it facilitates modification, its strength lies in precise, manual testing and fine-tuning of single requests, not in the automated, systematic generation and sending of multiple requests with varying payloads, which is often implied by 'intercept and modify' in a broader attack context.

Go deeper

Related to this question