CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using previously compromised username/password pairs from a breach

  Why it's wrong here

  Credential stuffing involves using previously leaked username/password combinations from one data breach to gain unauthorized access to accounts on *different* services. This technique relies on users reusing credentials across multiple platforms, directly contrasting password spraying, which systematically tests a *small set of common passwords* against a *large list of usernames* on a *single target system* to avoid account lockouts.

• ✗

  Capturing keystrokes to obtain a user's password

  Why it's wrong here

  Keylogging is a surveillance technique where an attacker records every keystroke made by a user, typically through malicious software or hardware, to capture sensitive information like passwords as they are typed. This method focuses on direct interception of user input on an individual machine, fundamentally differing from password spraying, which is a network-based attack attempting to guess passwords across many accounts.

• ✗

  Trying every possible password from a dictionary against a single username

  Why it's wrong here

  A dictionary attack systematically attempts every word from a predefined list, or dictionary, as a password against a *single target username* until the correct password is found or the list is exhausted. This method is often prone to triggering account lockout policies due to numerous failed attempts against one account, which is precisely what password spraying aims to circumvent by distributing attempts across many users.

• ✓

  Using a list of common passwords (e.g., 'Password123', 'Welcome1') against a large set of usernames

  Why this is correct

  Password spraying is a low-and-slow attack strategy where an attacker uses a small, curated list of extremely common or default passwords against a very large number of usernames within a target system. The primary goal is to avoid triggering account lockout thresholds, which typically activate after multiple failed login attempts on a *single user account*, by distributing the password attempts horizontally across many accounts.

• ✓

  Attempting a single common password across multiple users, then trying the next common password

  Why this is correct

  This technique accurately describes the operational flow of a password spraying attack, where an attacker selects one common password and attempts it against every username in their target list before moving to the next common password. This systematic, horizontal approach ensures that no single user account receives too many failed login attempts within a short period, thereby evading detection and account lockout mechanisms.

Go deeper

Related to this question