CEH Web Application and Injection Attacks Practice Question
Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intruder
Burp Intruder is the tool for automating customized attacks like brute-forcing and fuzzing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Repeater
Why it's wrong here
Repeater allows a user to take a single HTTP request, modify it manually, and resend it multiple times to observe server responses. While crucial for testing specific parameters or understanding server behavior, it lacks the ability to automate a series of requests with varying payloads or attack patterns. Its primary function is focused on meticulous, one-off request manipulation and response analysis, not large-scale automated attacks.
- ✗
Proxy
Why it's wrong here
The Burp Proxy acts as an intercepting intermediary between the user's browser and web servers, allowing real-time viewing and modification of all HTTP/S traffic. Its core utility lies in capturing requests and responses, enabling manual manipulation before they reach their destination or the browser. While fundamental for understanding application communication, it does not inherently automate attack sequences or payload delivery.
- ✗
Scanner
Why it's wrong here
Burp Scanner is an automated web vulnerability scanner designed to identify common security flaws like SQL injection, XSS, and path traversal by passively analyzing traffic and actively probing the application. It employs predefined checks and heuristics to detect known vulnerabilities. However, it is not built for highly customized, user-defined attack automation with specific payload lists or complex attack types beyond its pre-programmed vulnerability tests.
- ✓
Intruder
Why this is correct
Burp Intruder is specifically engineered for automating customized attacks against web applications, making it ideal for brute-forcing, fuzzing, and credential stuffing. It allows users to define specific insertion points within a request and then systematically iterate through custom payload lists, applying various attack types like Sniper, Battering Ram, Pitchfork, and Cluster Bomb. This precise control over payload generation and delivery makes it the tool of choice for automating targeted attack scenarios.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.