CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  An attacker tricks a user into clicking a link that executes unwanted actions on a web application where the user is authenticated.

  Why it's wrong here

  This describes Cross-Site Request Forgery (CSRF), where an attacker leverages a victim's authenticated session to send unauthorized requests from the victim's browser to a trusted web application. The attack relies on the victim's browser automatically including session cookies with the forged request, causing the application to execute actions as if initiated by the legitimate user. Unlike SSRF, the request originates from the client-side, not the server.

• ✗

  An attacker injects malicious scripts into a web page that executes in other users' browsers.

  Why it's wrong here

  This explanation accurately describes Cross-Site Scripting (XSS), a client-side code injection vulnerability. An attacker injects malicious scripts, typically JavaScript, into a web page that is then delivered to other users' browsers. When a victim's browser renders the compromised page, the injected script executes within their security context, potentially stealing session cookies, defacing websites, or redirecting users.

• ✓

  An attacker forces the web server to make HTTP requests to arbitrary destinations, potentially accessing internal resources.

  Why this is correct

  This precisely defines Server-Side Request Forgery (SSRF), a vulnerability where a web application is tricked into making HTTP requests to an attacker-specified location. The server, acting on behalf of the attacker, can then access internal network resources, metadata services, or other systems that are typically inaccessible from the external internet. This allows for internal network reconnaissance, port scanning, and potential data exfiltration by bypassing firewall restrictions.

• ✗

  An attacker manipulates input to execute system commands on the server.

  Why it's wrong here

  This describes command injection, a critical vulnerability where an attacker can execute arbitrary operating system commands on the host server through improperly validated input. By injecting special characters or commands into user-supplied data that is subsequently used in a system call, the attacker gains direct control over the server's underlying operating system. This differs significantly from SSRF, which focuses on manipulating the server to make *network requests* rather than executing *local system commands*.