CEH Web Application and Injection Attacks Practice Question
During a web application test, an analyst intercepts a request containing a 'Referer' header that points to a different domain. The analyst modifies the request by removing the 'Referer' header and the action still executes successfully. Which type of attack is the analyst testing?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-Site Request Forgery (CSRF)
CSRF protection often relies on checking the Referer header; if it can be removed or spoofed, the application is vulnerable to CSRF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-Side Request Forgery (SSRF)
Why it's wrong here
Server-Side Request Forgery (SSRF) involves an attacker coercing a server-side application to make requests to an unintended location, either internal or external. This typically occurs by manipulating URLs or parameters that the server processes and uses to initiate its own outbound connections. The Referer header, however, is a client-side HTTP header indicating the origin of the user's request, not a mechanism for the server to initiate its own requests. Therefore, manipulating the Referer header does not directly facilitate an SSRF attack.
- ✗
Clickjacking
Why it's wrong here
Clickjacking is a user interface redressing attack that tricks users into clicking on a hidden or disguised element on a web page. This is typically achieved by layering a transparent iframe containing a malicious page over a legitimate one, making the user believe they are interacting with the visible content. The attack primarily exploits user interaction and browser rendering, focusing on visual deception rather than the manipulation of HTTP headers like the Referer to bypass server-side origin validation.
- ✓
Cross-Site Request Forgery (CSRF)
Why this is correct
Cross-Site Request Forgery (CSRF) exploits a user's authenticated session to force their browser to send an unwanted request to a vulnerable web application. A common defense against CSRF involves the server inspecting the HTTP Referer header to verify that the request originated from the application's own domain, preventing requests from external, malicious sites. An analyst successfully bypassing this Referer header check by manipulating or omitting it directly demonstrates a CSRF vulnerability, as the server's origin validation mechanism has been defeated.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) attacks involve injecting malicious client-side scripts, typically JavaScript, into web pages viewed by other users. These scripts execute within the victim's browser, allowing attackers to steal session cookies, deface websites, or redirect users. While XSS can sometimes be a vector to deliver other attacks, the fundamental nature of XSS is script injection and execution, which is distinct from manipulating the HTTP Referer header to bypass server-side origin checks for request validation.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.