CEH Web Application and Injection Attacks Practice Question
Which of the following Burp Suite tools is used to automatically fuzz web application inputs and identify common vulnerabilities like SQL injection and XSS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intruder
Burp Intruder is a tool for automating customized attacks against web applications, including fuzzing for vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Proxy
Why it's wrong here
Burp Suite's Proxy tool functions as an intercepting HTTP/S proxy, allowing security professionals to view, modify, and forward individual requests and responses between the browser and the target server. While crucial for understanding application behavior and manually manipulating traffic, it is not designed for automated, iterative attacks like fuzzing or brute-forcing. Its primary role is real-time traffic inspection and manipulation, not systematic payload injection.
- ✗
Repeater
Why it's wrong here
The Repeater tool in Burp Suite is specifically designed for manually resending a single HTTP request multiple times, with the ability to modify various parts of the request between each submission. This functionality is invaluable for fine-tuning exploit payloads, confirming the presence of vulnerabilities, or observing server responses to specific input changes. However, it lacks the automation capabilities required for systematic fuzzing across a range of payloads or multiple insertion points.
- ✓
Intruder
Why this is correct
Burp Suite's Intruder tool is purpose-built for performing automated, highly configurable attacks against web applications, including fuzzing, brute-forcing, and enumeration. It allows users to define specific insertion points within a request and then systematically iterate through a list of payloads, observing the server's responses to identify vulnerabilities or weak points. Its advanced payload generation, attack types (e.g., Sniper, Battering Ram, Pitchfork, Cluster Bomb), and result analysis features make it the ideal choice for automated input testing.
- ✗
Scanner
Why it's wrong here
The Burp Scanner is an automated web vulnerability scanner that passively analyzes traffic and actively probes the application for common security flaws, such as SQL injection, XSS, and path traversal. While it performs automated checks, its function is to identify known vulnerability patterns using its built-in logic and signature database, not to allow a user to define and inject custom payload sets for systematic fuzzing or brute-forcing specific parameters. It focuses on broad vulnerability discovery rather than targeted, user-controlled payload injection.
Go deeper
Related to this question
Learn chapter
Hacking Web Applications
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.