CEH Web Application and Injection Attacks Practice Question
Which Burp Suite tool is most appropriate for modifying and re-sending a single HTTP request multiple times with different payloads to test for SQL injection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intruder
Burp Intruder is designed for automated customized attacks, allowing you to send many requests with varying payloads to a single target endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Repeater
Why it's wrong here
Repeater is designed for manipulating and reissuing single HTTP requests to analyze server responses interactively. It's excellent for fine-tuning a specific request's parameters or headers and observing the immediate impact, but it lacks the functionality to automate the insertion of multiple, varied payloads across numerous requests. Its purpose is focused on one-off, manual testing rather than systematic, iterative attacks.
- ✓
Intruder
Why this is correct
Burp Suite Intruder is specifically engineered for automating customized attacks against web applications by systematically injecting various payloads into designated request parameters. It enables testers to define specific insertion points and choose from multiple attack types (e.g., Sniper, Battering Ram, Pitchfork, Cluster Bomb) to iterate through wordlists or generate dynamic payloads, making it ideal for discovering vulnerabilities such as SQL injection, cross-site scripting, or brute-forcing credentials.
- ✗
Proxy
Why it's wrong here
The Burp Suite Proxy serves as the core interception point, allowing users to view, modify, and forward all HTTP/S traffic between their browser and the target web application. While crucial for capturing requests that can then be sent to other tools, the Proxy itself is not designed for automated payload generation or iterative sending of requests. Its primary function is real-time traffic manipulation and observation, not active vulnerability scanning or payload injection.
- ✗
Scanner
Why it's wrong here
Burp Suite Scanner is an automated web vulnerability scanner that passively and actively analyzes web applications for common security flaws, providing detailed reports on identified issues. Although it performs automated checks and uses its own set of payloads, it operates as a black-box testing tool with predefined checks and does not offer the granular control or custom payload configuration capabilities that Intruder provides for targeted, manual-assisted payload injection and specific attack scenario testing.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.