CEH Web Application and Injection Attacks Practice Question
A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intruder
Burp Intruder is designed for automated request customization and repetition, allowing fuzzing of parameters for injection flaws, brute-force attacks, and other vulnerability testing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Intruder
Why this is correct
Intruder is the dedicated Burp Suite tool for automating customized attacks against web applications by systematically sending multiple requests with variable payloads. It allows testers to define specific insertion points within a request and iterate through a list of payloads, making it ideal for brute-forcing credentials, fuzzing input fields, and identifying injection vulnerabilities like SQLi or XSS with high precision and control over attack types.
- ✗
Repeater
Why it's wrong here
Repeater is a manual Burp Suite tool designed for modifying and resending individual HTTP requests one at a time to observe immediate responses. While invaluable for fine-tuning specific requests and testing single changes, it completely lacks any automation capabilities for iterating through multiple payloads or performing systematic, multi-request attacks, making it unsuitable for scenarios requiring variable payload testing.
- ✗
Proxy
Why it's wrong here
The Proxy tool in Burp Suite functions as an intercepting proxy, capturing and allowing real-time inspection and modification of individual HTTP/S traffic between the browser and the target application. Its primary role is traffic interception and forwarding, not the generation or automation of multiple requests with varying payloads, thus it cannot perform the systematic testing described.
- ✗
Scanner
Why it's wrong here
Burp Scanner is an automated web vulnerability scanner that proactively identifies common security flaws by crawling the application and performing various checks with predefined attack vectors. While it automates vulnerability detection, it operates with its own heuristics and attack logic, making it less suitable for highly customized, targeted payload testing or specific brute-force scenarios where a tester defines precise payload sets and insertion points.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.