CEH Web Application and Injection Attacks Practice Question
An attacker crafts a link that, when clicked by an authenticated user, performs an unintended action on a web application where the user is logged in, such as changing their email address. The application uses a session cookie for authentication but does not include any anti-forgery tokens in forms. Which attack is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-Site Request Forgery (CSRF)
The description matches Cross-Site Request Forgery (CSRF), where a malicious link triggers actions on a site where the victim is authenticated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cross-Site Request Forgery (CSRF)
Why this is correct
Cross-Site Request Forgery (CSRF) is an attack where an attacker crafts a malicious web page or link that, when clicked or loaded by a victim, forces their browser to send an unauthorized request to a trusted website. This attack leverages the victim's active authenticated session with the target site, causing the site to execute actions as if the user genuinely initiated them. The victim's browser automatically includes session cookies with the forged request, making it appear legitimate to the server, often resulting in state-changing operations like password changes or fund transfers.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) fundamentally differs from CSRF as it involves injecting malicious client-side scripts into web pages viewed by other users, rather than merely crafting a link to trigger a request. These injected scripts execute within the victim's browser in the context of the trusted site, enabling attackers to steal session cookies, deface websites, or redirect users. The core mechanism involves bypassing the Same-Origin Policy to execute arbitrary code, which is distinct from coercing a browser to send a legitimate-looking request.
- ✗
Clickjacking
Why it's wrong here
Clickjacking, also known as UI redressing, deceives users into clicking on something different from what they perceive, typically by layering a transparent malicious iframe over a legitimate webpage element. This technique relies on visual trickery and user interaction, where the user *intends* to click one thing but *unintentionally* activates a hidden element. Unlike CSRF, which forces an action without the user's explicit interaction with the malicious content, Clickjacking requires the user to perform a seemingly innocuous click that has an unforeseen consequence.
- ✗
Server-Side Request Forgery (SSRF)
Why it's wrong here
Server-Side Request Forgery (SSRF) is an attack where the attacker induces a server-side application to make HTTP requests to an arbitrary domain specified by the attacker, often targeting internal systems. Instead of the client's browser being tricked into sending a request, the vulnerability lies in the server's ability to fetch resources based on user-supplied input. This allows attackers to scan internal networks, access sensitive data on internal services, or interact with other services the server has access to, completely bypassing client-side browser limitations.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.