CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Proxy

  Why it's wrong here

  A proxy, such as Burp Suite's Proxy, primarily functions as an intermediary to intercept, inspect, and manually modify HTTP/S requests and responses between a browser and a web server. While crucial for understanding application behavior and initial reconnaissance, it does not possess built-in capabilities for automating repetitive attack patterns, brute-forcing parameters, or fuzzing inputs programmatically. Its core purpose is interactive traffic manipulation, not automated vulnerability testing requiring varied payloads.

• ✗

  Repeater

  Why it's wrong here

  Repeater allows a user to manually resend a single HTTP request multiple times, with the ability to modify specific parameters before each send. This feature is invaluable for fine-tuning an exploit or observing server responses to slight variations in a request. However, Repeater is designed for individual, manual testing and lacks the functionality to automate the delivery of multiple payloads across various insertion points, making it unsuitable for large-scale brute-force or fuzzing operations.

• ✓

  Intruder

  Why this is correct

  Intruder is specifically designed for automating customized attacks against web applications by systematically injecting multiple payloads into designated insertion points within HTTP requests. It excels at tasks like brute-forcing credentials, fuzzing parameters for injection vulnerabilities (SQLi, XSS), and enumerating valid inputs by delivering a large number of varied payloads and analyzing the responses. Its highly configurable payload generation and attack types make it the ideal tool for automated vulnerability discovery.

• ✗

  Scanner

  Why it's wrong here

  An automated vulnerability scanner, such as Burp Suite's Active Scanner, is engineered to proactively identify common security flaws by crawling an application and automatically sending a predefined set of attack vectors. While effective for broad coverage and identifying known vulnerabilities, it is not optimized for highly customizable, targeted brute-force attacks or specific fuzzing scenarios that require precise control over payload sets and insertion points, which Intruder provides. Its strength lies in general, automated discovery, not tailored attack execution.

Go deeper

Related to this question