CEH Web Application and Injection Attacks Practice Question

During a penetration test, a tester observes that a web application's login form does not implement rate limiting and returns different error messages for valid vs invalid usernames. Which THREE attacks are most likely to be successful? (Select three)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Credential stuffing

With username enumeration and no rate limiting, brute force (trying many passwords on one user), credential stuffing (using breached credentials), and password spraying (trying common passwords across many users) are all viable. SQL injection is not directly related to the described conditions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Directory traversal
Why it's wrong here
Directory traversal is a web vulnerability that allows an attacker to access files and directories stored outside the web root folder by manipulating file paths, typically using sequences like "../" or "..\". The provided scenario lacks any indicators such as file path manipulation attempts in URLs or input fields, error messages related to file system access, or the successful retrieval of unauthorized files, which would suggest the presence of this specific vulnerability.
✓
Credential stuffing
Why this is correct
Credential stuffing is a highly effective attack where threat actors automate login attempts using large lists of username and password pairs previously compromised in data breaches from other services. If the web application allows valid usernames to be tested against these breached password lists without adequate detection or rate limiting, it becomes vulnerable to users who reuse their credentials across multiple platforms. This leverages the common user habit of password reuse.
✓
Brute-force attack
Why this is correct
A brute-force attack involves systematically trying every possible password combination for a specific target username until the correct one is discovered. The observation that the web application has no rate limiting or account lockout mechanisms directly enables this attack, as it permits an unlimited number of password attempts against a single account without triggering any security defenses or temporary blocks. This makes the account highly susceptible to exhaustive guessing.
✗
SQL injection
Why it's wrong here
SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution. Indicators of SQL injection typically include unusual error messages revealing database structure, unexpected query results, or the ability to bypass authentication by injecting specific SQL syntax like "' OR '1'='1' --". The scenario described does not present any of these characteristic signs.
✓
Password spraying
Why this is correct
Password spraying is a targeted attack where a small set of commonly used passwords (e.g., "Welcome1", "Spring2024!") is tried against a large list of enumerated usernames. This technique is designed to avoid triggering account lockouts that might occur from repeatedly guessing many passwords for a single user, instead distributing attempts across many accounts to identify users with weak or default passwords. It's efficient for finding easy targets without immediate detection.

Go deeper

CEH Web Application and Injection Attacks Practice Question

Why each option matters

Option-by-option breakdown

Related to this question