CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting (XSS) is a client-side code injection attack where malicious scripts, typically JavaScript, are injected into legitimate web pages viewed by other users. The goal is to execute arbitrary code in the victim's browser, often to steal session cookies, deface the website, or redirect users. This attack focuses on injecting executable content into the DOM, rather than manipulating HTTP headers like the Referer to forge requests for state-changing actions.

• ✗

  Server-side request forgery (SSRF)

  Why it's wrong here

  Server-side request forgery (SSRF) occurs when a web application is tricked into making requests to an arbitrary or attacker-specified location on behalf of the attacker. This vulnerability allows an attacker to cause the server to interact with internal network resources, cloud metadata APIs, or other external systems. SSRF does not involve manipulating the client's Referer header to perform state-changing actions; instead, it exploits the server's own request-making capabilities.

• ✓

  Cross-site request forgery (CSRF)

  Why this is correct

  Cross-site request forgery (CSRF) exploits the trust a web application has in an authenticated user's browser. An attacker crafts a malicious web page or email that, when visited or opened by an authenticated user, forces their browser to send an unintended request to the vulnerable application. The application, failing to verify the request's true origin or intent, processes the forged request, often relying on session cookies. Manipulating or bypassing checks on the Referer header can be a technique used in CSRF attacks, as applications sometimes use it as a weak defense to ensure requests originate from the expected domain.

• ✗

  Clickjacking

  Why it's wrong here

  Clickjacking is a user interface (UI) redressing attack that tricks users into clicking on something different from what they perceive. An attacker overlays a transparent malicious iframe or element over a legitimate web page, making the user believe they are interacting with the visible content. This deception causes the user to unknowingly perform actions on the hidden page, such as making purchases or changing settings. Clickjacking primarily relies on visual trickery and iframe manipulation, not on altering HTTP headers like the Referer.

Go deeper

Related to this question