CEH Web Application and Injection Attacks Practice Question
A security analyst notices that a web application returns different error messages for valid and invalid usernames during login. Which type of attack is this application MOST vulnerable to?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Username enumeration
The different error messages allow an attacker to enumerate valid usernames, which is a common precursor to brute-force or credential-stuffing attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Directory traversal
Why it's wrong here
Directory traversal exploits vulnerabilities in file path handling to access arbitrary files and directories on the server, often by using sequences like "../" or "..\". While a successful traversal might reveal sensitive configuration files or data, it does not directly manifest as differing login error messages based on username validity. The observed behavior is a response to authentication attempts, not an indicator of file system access vulnerabilities.
- ✓
Username enumeration
Why this is correct
Username enumeration occurs when a web application's login mechanism provides distinct error messages or response times for valid usernames compared to invalid ones, even if the password is incorrect. For instance, "Invalid password for user 'admin'" versus "User 'admin' does not exist." This differential feedback allows an attacker to systematically test common usernames and compile a list of valid accounts, significantly aiding in subsequent brute-force or credential stuffing attacks.
- ✗
SQL injection
Why it's wrong here
SQL injection involves injecting malicious SQL code into input fields to manipulate database queries, potentially leading to data exfiltration, modification, or denial of service. While a successful SQL injection could bypass authentication or reveal database contents, the primary symptom described—distinct login error messages for valid versus invalid usernames—is not a direct or typical indicator of an active SQL injection vulnerability. SQLi often manifests as generic database errors, unexpected data, or altered application behavior due to manipulated queries.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) is a client-side code injection attack where malicious scripts are injected into trusted websites, typically targeting other users. These scripts execute in the victim's browser, potentially stealing cookies, session tokens, or defacing websites. The observed behavior of differing server responses to login attempts based on username validity is a server-side information disclosure issue, entirely unrelated to the client-side script execution characteristic of XSS.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?
medium- ✓ A.Username enumeration
- B.Cross-site scripting (XSS)
- C.Directory traversal
- D.SQL injection
Why A: The difference in responses (e.g., 'User not found' vs 'Invalid password') allows an attacker to enumerate valid usernames, which is a common first step in credential stuffing or brute-force attacks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.