CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enabling directory listing on the web server

  Why it's wrong here

  Enabling directory listing on a web server allows attackers to view the contents of directories, potentially exposing sensitive files, application structure, and configuration details. This practice is a significant security vulnerability in itself, providing reconnaissance opportunities for further attacks like information disclosure or path traversal. It offers no protection against Cross-Site Request Forgery (CSRF) attacks, which exploit a user's authenticated session to execute unwanted actions.

• ✓

  Implementing CSRF tokens in forms

  Why this is correct

  Implementing CSRF tokens involves embedding a unique, unpredictable, and secret value within each HTML form or AJAX request that modifies server-side state. The server generates this token and associates it with the user's session, then validates its presence and correctness upon submission. If the submitted token does not match the expected value, the server rejects the request, effectively preventing attackers from forging legitimate requests without knowledge of the specific token.

• ✗

  Using a same-origin policy with CORS headers

  Why it's wrong here

  The Same-Origin Policy (SOP) is a fundamental security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin, primarily preventing unauthorized *reading* of cross-origin data. While CORS (Cross-Origin Resource Sharing) headers relax SOP for legitimate cross-origin requests, neither directly prevents CSRF, which exploits the browser's automatic sending of cookies with *state-changing* requests to the target site. More relevant defenses include `SameSite` cookie attributes, which control when cookies are sent with cross-origin requests.

• ✗

  Setting the HttpOnly flag on cookies

  Why it's wrong here

  Setting the HttpOnly flag on cookies prevents client-side scripts, such as those injected via Cross-Site Scripting (XSS) vulnerabilities, from accessing the cookie's value. This significantly mitigates the risk of session hijacking by preventing an attacker from stealing session cookies through XSS. However, HttpOnly does not prevent CSRF attacks because the browser still automatically sends these cookies with legitimate (or forged) requests to the originating domain, regardless of script access.

Go deeper

Related to this question