CEH Intruder Attack Types Practice Question
A pentester uses Burp Suite's Intruder to perform a brute-force attack on a login form. Which TWO of the following Intruder attack types would be appropriate for testing different payload combinations?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pitchfork
For testing different payload combinations, you need multiple payload sets. Pitchfork uses multiple payload sets and pairs them position-by-position, testing different combinations where each set provides distinct values. Cluster bomb uses multiple payload sets and tests every possible combination across all positions, which is ideal for brute-force attacks on login forms. Sniper and Battering ram use a single payload set and are not appropriate for testing different combinations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pitchfork
Why this is correct
Pitchfork is a correct attack type, particularly useful when multiple payload positions need to be tested with corresponding values from different payload sets. This mode uses multiple payload sets, but unlike Cluster Bomb, it pairs payloads from each set in a one-to-one fashion. For instance, the first payload from set 1 is used with the first payload from set 2, and so on, making it ideal for scenarios like testing correlated username/password lists or sequential data.
- ✗
Sniper
Why it's wrong here
Sniper is incorrect for a multi-parameter brute-force because it uses a single payload set and iterates through each defined payload position sequentially. It tests one position at a time while holding all other positions constant (usually to their original base value). This mode is primarily designed for fuzzing individual parameters to identify vulnerabilities like SQL injection or XSS, not for simultaneously brute-forcing combinations across multiple distinct input fields.
- ✗
Direct
Why it's wrong here
The "Direct" attack type is not a standard or recognized option within Burp Suite's Intruder module. Intruder offers specific attack modes like Sniper, Battering Ram, Pitchfork, and Cluster Bomb, each designed for distinct payload injection strategies. Therefore, attempting to select or utilize a "Direct" attack type would be invalid, as it simply does not exist in the tool's functionality for payload delivery.
- ✓
Cluster bomb
Why this is correct
Cluster bomb is the correct attack type for a brute-force scenario involving multiple unknown parameters, such as a username and password. This mode utilizes multiple independent payload sets, one for each defined payload position. It systematically tests every possible combination of payloads from all sets, generating a large number of requests to exhaust all permutations, making it highly effective for discovering valid credentials or multi-parameter vulnerabilities.
- ✗
Battering ram
Why it's wrong here
Battering ram is incorrect because it employs a single payload set and inserts the same payload value into all defined payload positions simultaneously for each request. While it iterates through the payload set, every marked position receives the identical payload at any given time. This method is useful for testing vulnerabilities where a single value needs to be reflected across multiple input fields, but it is unsuitable for brute-forcing distinct combinations of different parameters.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.