CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Username enumeration

  Why this is correct

  Username enumeration is an attack where an attacker attempts to discover valid usernames by observing differences in application responses (e.g., distinct error messages, varying HTTP status codes, or even subtle timing discrepancies) when submitting valid versus invalid usernames. For instance, a "User not found" message for an invalid username compared to an "Incorrect password" message for a valid one clearly indicates a username's existence, allowing an attacker to compile a list of active accounts. This technique is a critical precursor to many other credential-based attacks.

• ✗

  Credential stuffing

  Why it's wrong here

  Credential stuffing involves taking large lists of username/password pairs obtained from data breaches on other websites and attempting to log in with them on a target application. This attack relies on users reusing credentials across multiple services. While a list of valid usernames can be helpful, it's not a prerequisite because the attack typically uses *known* leaked pairs, and the goal is direct login attempts, not the discovery of valid usernames through differing application responses.

• ✗

  Password spraying

  Why it's wrong here

  Password spraying is an attack where an attacker tries a small number of very common passwords (e.g., "Password123", "Summer2024!") against a large list of usernames, often across an entire domain. The primary goal is to avoid account lockouts by distributing attempts across many accounts rather than repeatedly failing on one. While a list of enumerated usernames can make this attack more efficient, the core technique itself does not *involve* the process of observing differing responses to *discover* usernames.

• ✗

  Brute force attack

  Why it's wrong here

  A brute force attack systematically tries every possible password combination for a specific target username until the correct one is found. This method is computationally intensive and often leads to account lockouts if not carefully managed. While knowing a valid username (potentially through enumeration) is necessary, the attack itself is defined by the exhaustive guessing of passwords for that single user, not by the observation of differing application responses to identify valid usernames.