CEH Web Application and Injection Attacks Practice Question
A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Username enumeration
The difference in responses (e.g., 'User not found' vs 'Invalid password') allows an attacker to enumerate valid usernames, which is a common first step in credential stuffing or brute-force attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Username enumeration
Why this is correct
Username enumeration occurs when a web application's login mechanism provides distinct responses or behaviors for valid versus invalid usernames. This difference, which could manifest as varying HTTP status codes, specific error messages (e.g., "Username exists" vs. "Invalid credentials"), or even subtle timing discrepancies, allows an attacker to systematically test usernames and identify which ones correspond to existing accounts. Once valid usernames are identified, they become targets for subsequent brute-force attacks or credential stuffing.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) is a client-side code injection vulnerability where an attacker injects malicious scripts into web pages viewed by other users. This attack primarily aims to compromise user sessions, deface websites, or redirect users to malicious sites, operating within the victim's browser context. XSS does not exploit differences in server-side login responses to determine the validity of usernames; its mechanism is entirely distinct from account enumeration.
- ✗
Directory traversal
Why it's wrong here
Directory traversal, also known as path traversal, is an attack that exploits vulnerabilities in file path handling to access files and directories stored outside the intended web root directory. Attackers manipulate input parameters containing file paths (e.g., using `../` sequences) to navigate the server's file system and retrieve sensitive information or execute unauthorized files. This attack is focused on file system access and is entirely unrelated to observing login response differences for username enumeration.
- ✗
SQL injection
Why it's wrong here
SQL injection is a code injection technique used to manipulate or interfere with the queries an application makes to its database. Attackers insert malicious SQL statements into input fields to bypass authentication, extract sensitive data, or modify database content. While SQL injection can sometimes lead to authentication bypass or data exfiltration that might indirectly reveal usernames, the core mechanism described (observing distinct login responses for valid vs. invalid usernames) is not the direct or typical manifestation of a SQL injection vulnerability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.