CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Intruder

  Why it's wrong here

  Burp Intruder is specifically designed for automating customized attacks against web applications, such as brute-forcing credentials, fuzzing parameters for vulnerabilities, or performing dictionary attacks. It enables security testers to define specific insertion points within requests and then systematically iterate through custom-defined payloads or generated lists. Its primary function is to test application responses to numerous crafted requests, not to passively or actively intercept and modify individual requests in real-time as they pass through the network.

• ✗

  Scanner

  Why it's wrong here

  Burp Scanner is an automated web vulnerability scanner that actively probes web applications for common security flaws like SQL injection, cross-site scripting (XSS), and path traversal. It analyzes application responses to identify potential weaknesses, either through passive observation of traffic or by actively sending crafted requests to discover vulnerabilities. While it processes intercepted traffic for analysis, its core purpose is automated vulnerability identification and reporting, not the real-time interception and manual manipulation of individual requests for analysis or modification.

• ✗

  Repeater

  Why it's wrong here

  Burp Repeater is a tool for manually modifying and re-sending individual HTTP requests and analyzing the application's responses. Testers typically send a request from the Proxy or another tool to Repeater, where they can fine-tune parameters, headers, or the body, then re-issue the request multiple times to observe behavioral changes or test specific conditions. Its function is focused on iterative, manual testing of a single request, not on intercepting the continuous flow of live traffic between a browser and a server.

• ✓

  Proxy

  Why this is correct

  Burp Proxy is the core interception component of Burp Suite, acting as a man-in-the-middle between the browser and the target web server. It is specifically designed to capture all HTTP and HTTPS traffic flowing through it, allowing security professionals to view, analyze, and modify requests and responses in real-time before they reach their destination. This real-time interception capability is fundamental for understanding application logic, identifying vulnerabilities, and manipulating data during penetration testing.

Go deeper

Related to this question