The Cybersecurity Trail

A path to cyber mastery

EC-Council CEH Practice Tests

CEH v13 Domain 5.2 Practice Test 001

ByThe Test Master

Apr 15, 2026 #CEH, #EC-Council, #hacking, #web applications

Welcome to this CEH v13 practice test!

This practice test covers Domain 5 (Web Application Hacking) Subdomain 2 (Hacking Web Applications) from the CEH v13 (312-50v13) exam blueprint (v5).

These questions are inspired by the EC-Council CEH exam and are designed to help you test your knowledge of ethical hacking tools, techniques, and methodologies. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CEH exam.

Note: CEH and Certified Ethical Hacker are registered trademarks of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CEH practice tests based on specific domains and subdomains, click that link.

CEH v13 Domain 5.2 Practice Test 001
10 questions • 8 single-answer, 2 multi-select
CEH v13 (312-50v13) • Domain 5: Web Application Hacking — Sub-Domain 5.2: Hacking Web Applications
Question 1
During a bug bounty engagement, Maria discovers that modifying a price parameter in a web request allows her to purchase items at a lower cost than intended. The application does not validate the modified value on the server. What vulnerability is being exploited?
    Question 2
    A developer deploys a comment feature on a website. An attacker submits a script that gets stored in the database and executes whenever other users view the comments section. What attack is being performed?
      Question 3
      While testing a web application, Alex disables JavaScript in the browser and notices that input restrictions no longer apply, allowing submission of malicious data. What flaw does this reveal?
        Question 4
        John sends a malicious link to a logged-in user of a banking site. When clicked, the link performs a fund transfer without the user's consent by leveraging their active session. What type of attack is this?
          Question 5
          During an assessment, a security analyst uses an intercepting proxy to modify HTTP requests and observe application behavior. Which tool is commonly used for this purpose?
            Question 6
            Select all that apply
            A security engineer is testing input fields in a web application for validation weaknesses. Which TWO techniques are effective for identifying such vulnerabilities? (Choose two)
              Question 7
              A web application generates session IDs in a predictable sequence. An attacker uses this to guess valid session tokens. What vulnerability does this represent?
                Question 8
                A malicious script manipulates the browser DOM to execute code without sending payloads to the server. What type of attack is this?
                  Question 9
                  After logging out of a web application, a user’s session token remains valid and can be reused by an attacker. What vulnerability is present?
                    Question 10
                    Select all that apply
                    A web application is being reviewed for authentication weaknesses. Which TWO issues could lead to authentication bypass? (Choose two)
                      Answered: 0/10

                      Related Post

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 2.2 Practice Test 002

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 2.1 Practice Test 002

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 1.1 Practice Test 002

                      Leave a Reply

                      Your email address will not be published. Required fields are marked *

                      You missed

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 2.2 Practice Test 002

                      April 16, 2026 The Test Master
                      EC-Council CEH Practice Tests

                      CEH v13 Domain 2.1 Practice Test 002

                      April 16, 2026 The Test Master
                      EC-Council CEH Practice Tests

                      CEH v13 Domain 1.1 Practice Test 002

                      April 16, 2026 The Test Master
                      EC-Council CEH Practice Tests

                      CEH v13 Domain 9.1 Practice Test 001

                      April 16, 2026 The Test Master