CEH Web Application and Injection Attacks Practice Question
An attacker discovers that a web application's login form allows unlimited login attempts. The attacker uses a list of usernames and passwords obtained from a previous breach to gain access. This attack is known as:
⚠ Common exam trap
A common mix-up: candidates confuse credential stuffing with a dictionary attack, but credential stuffing specifically uses known username-password pairs from a prior breach, not a generic wordlist of passwords.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Credential stuffing
Credential stuffing (option D) is correct because the attacker uses a list of known username/password pairs from a previous breach to automate login attempts against the web application. This attack exploits password reuse across services, not the weakness of the passwords themselves, and relies on the application's lack of rate limiting or account lockout mechanisms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password spraying
Why it's wrong here
Password spraying is an attack technique where a single, common password is tried against a large number of user accounts, typically across an organization. This method aims to avoid account lockouts that often occur when multiple incorrect password attempts are made against a single account. It is distinct from using known breached credentials for specific users, focusing instead on finding accounts with weak, widely used passwords.
- ✗
Brute force attack
Why it's wrong here
A brute force attack involves systematically trying every possible combination of characters until the correct password is discovered. This exhaustive method is computationally intensive and generally inefficient, especially for complex passwords, and is highly susceptible to triggering account lockout policies. Unlike attacks leveraging pre-existing knowledge, brute force starts with no assumptions about the password's content beyond its potential character set.
- ✗
Dictionary attack
Why it's wrong here
A dictionary attack attempts to gain access by trying a pre-compiled list of common words, phrases, and previously leaked passwords against a target account or a small set of accounts. While it uses a wordlist, it does not inherently involve taking username/password pairs from a data breach on one service and applying them to another. Its effectiveness relies on users choosing easily guessable passwords found in common dictionaries or wordlists.
- ✓
Credential stuffing
Why this is correct
Credential stuffing is a highly effective attack where attackers take large lists of username and password pairs, typically obtained from data breaches on one web service, and automatically attempt to use these same credentials to log into other, unrelated web applications. This attack exploits the widespread user practice of reusing the same login credentials across multiple online platforms. Success hinges on the assumption that users will recycle their compromised passwords on new targets.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.