CEH Network and Web Application Attacks Practice Question

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

⚠ Common exam trap

It's easy for candidates to confuse parameter tampering with CSRF, but CSRF does not allow modifying the request body; it only reuses existing parameters from a forged request, whereas parameter tampering directly alters the parameter value.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Parameter tampering

Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Directory traversal
Why it's wrong here
Directory traversal, also known as path traversal, exploits vulnerabilities to access files and directories stored outside the intended web root directory. This attack manipulates file paths in input parameters to read sensitive files like configuration files or password files, but it does not directly modify the values of form parameters submitted by a user, such as a product price. Its focus is on file system access, not data manipulation within an application's business logic.
✓
Parameter tampering
Why this is correct
Parameter tampering involves an attacker manipulating parameters exchanged between a client and server to alter application behavior or data. This can include modifying values in URL query strings, HTTP headers, cookies, or hidden form fields, such as changing a product's price from $100 to $10 before submission. The goal is to bypass authorization, gain unauthorized access, or manipulate transaction details by altering the data the application expects.
✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) is a client-side code injection attack where malicious scripts are injected into legitimate websites. When a user visits the compromised page, the malicious script executes in their browser, potentially stealing cookies, session tokens, or redirecting them to malicious sites. While XSS can manipulate the DOM, its primary purpose is script execution within the victim's browser context, not directly altering server-side form parameter values like a product price during submission.
✗
Cross-Site Request Forgery (CSRF)
Why it's wrong here
Cross-Site Request Forgery (CSRF) tricks a victim's browser into sending an authenticated request to a vulnerable web application without the user's knowledge. The attacker crafts a malicious request (e.g., a money transfer) and embeds it into a page the victim visits. While CSRF can initiate actions like changing a password or making a purchase, it does so by forcing the browser to send a *pre-defined* request, not by allowing the attacker to *modify* specific parameters like a product price within an existing form submission.

Go deeper

CEH Network and Web Application Attacks Practice Question

Why each option matters

Option-by-option breakdown

Related to this question