CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using a list of compromised credentials from a data breach

  Why it's wrong here

  This option describes credential stuffing, which involves taking a large list of username and password pairs obtained from a data breach on one service and attempting to use those exact combinations to log into accounts on a different, unrelated service. The underlying assumption is that users often reuse the same credentials across multiple platforms. This differs significantly from password spraying, which does not rely on pre-existing valid credential pairs but rather on common passwords.

• ✗

  Trying many passwords for a single account

  Why it's wrong here

  This scenario accurately describes a traditional brute-force attack, where an attacker focuses on a single user account and systematically tries numerous passwords until the correct one is discovered or account lockout policies are triggered. This method is often inefficient and easily detectable due to the high volume of login attempts directed at one specific target. Password spraying, in contrast, distributes attempts across many accounts to avoid such detection and lockouts.

• ✓

  Trying a few common passwords against many accounts

  Why this is correct

  This is the precise definition of a password spraying attack. Attackers employ this technique by taking a small list of commonly used passwords (e.g., 'Password123', 'Summer2023!') and attempting each of these passwords against a large number of different user accounts within the same system. The primary goal is to avoid triggering account lockout thresholds, which are typically set per-account, by only attempting one or two passwords per user before moving on to the next account.

• ✗

  Using automated tools to bypass CAPTCHA

  Why it's wrong here

  Bypassing CAPTCHA mechanisms involves using various automated tools or human-powered services to solve CAPTCHA challenges, thereby enabling bots to interact with web forms or login pages that are designed to deter automated access. While an attacker might bypass CAPTCHA to facilitate a password spraying attack, the act of bypassing CAPTCHA itself is a separate technical challenge and not the password spraying attack methodology. It's an enabling technique, not the attack itself.

Go deeper

Related to this question