CEH v13 Domain 5.2 Practice Test 002

Question 1

Clark is hired to perform a web application penetration test and begins by crawling the target's website using OWASP ZAP to map all accessible URLs, input fields, and hidden parameters, building a comprehensive inventory of the application's attack surface. He discovers several endpoints that accept user-supplied input without adequate validation and identifies outdated JavaScript libraries linked from the application's pages. Which phase of the web application hacking methodology did Clark perform?

A. Footprint Web Infrastructure B. Attack Authentication Mechanism C. Attack Session Management D. Bypass Client-Side Controls

Question 2

Jane is testing a web application that uses hidden HTML form fields to store item prices during the shopping checkout process, passing the price value from the client to the server without any server-side validation. She intercepts the POST request using Burp Suite and modifies the hidden 'price' field from 99.99 to 0.01, then submits the tampered form and successfully completes a purchase at the altered price. Which web application attack technique did Jane exploit?

A. SQL Injection B. Hidden Field Manipulation C. Cookie Poisoning D. Session Fixation

Question 3

Elijah is performing a security assessment of a banking web application and uses Burp Suite's Intruder module to automatically cycle through a wordlist of common passwords against the application's login endpoint while monitoring HTTP response sizes to identify valid credentials. The application does not implement account lockout or CAPTCHA after repeated failed attempts, allowing Elijah to test thousands of password combinations without interruption. Which attack technique is Elijah using against the authentication mechanism?

A. Credential Stuffing B. Brute Force Attack C. Session Fixation D. Rainbow Table Attack

Question 4

Select all that apply

A penetration tester is evaluating a web application's session management and uses a Python script to collect 1,000 session tokens after repeated logins, analyzing them for patterns and discovering that tokens follow a sequential numeric value tied to the epoch timestamp at login. While reviewing Burp Suite proxy logs, she also notices that the server sends a Set-Cookie header with a new session token before authentication completes, meaning an attacker could pre-supply a victim with a known token value to hijack the session post-login. Which two session management vulnerabilities has she identified? (Choose two)

A. Predictable Session Tokens B. Missing HSTS Header C. Session Fixation D. Cross-Site Request Forgery E. Weak Password Policy

Question 5

Clark discovers that a web application's search feature reflects user-supplied input directly into the HTML response without encoding or sanitization, and he crafts a malicious URL containing a script tag that executes JavaScript in the victim's browser when the link is clicked. The injected script captures the victim's session cookie and transmits it to Clark's remote collection server, enabling him to impersonate the victim in subsequent requests. Which type of cross-site scripting attack did Clark perform?

A. Stored XSS B. DOM-Based XSS C. Reflected XSS D. CSRF

Question 6

Jane is testing an e-commerce application and notices that order records are retrieved via a URL parameter such as 'order_id=1042'; she increments the parameter to adjacent values and successfully views complete order histories, shipping addresses, and payment details belonging to other customers without any authorization challenge. The application uses the predictable numeric identifier as the sole access control mechanism without verifying that the authenticated user is the resource owner. Which vulnerability is Jane exploiting?

A. Path Traversal B. Insecure Direct Object Reference C. XML External Entity (XXE) D. Server-Side Request Forgery

Question 7

Elijah gains initial access to a target web server by exploiting an unrestricted file upload vulnerability that accepts PHP files renamed with a double extension such as 'shell.php.jpg', which he accesses via the browser's URL bar to execute arbitrary OS commands on the underlying server. He uses this persistent foothold to enumerate internal network segments, exfiltrate database credentials from configuration files, and maintain a covert command-and-control channel across sessions. Which web application attack technique did Elijah deploy?

A. Web Shell Deployment B. Command Injection C. SQL Injection D. Reverse Shell via Metasploit

Question 8

Select all that apply

A security team is performing a threat assessment of a newly deployed REST API that handles financial transactions, and they observe that the API returns full user profile objects in responses — including fields such as SSN, credit score, and account balance — even when the client only requests a username lookup. During authorization testing, they also confirm that authenticated users can access other users' account records simply by substituting a different user ID in the endpoint path without receiving an authorization error. Which two attack techniques specifically target this API's security weaknesses? (Choose two)

A. Broken Object Level Authorization B. ARP Poisoning C. Excessive Data Exposure D. DNS Cache Poisoning E. MAC Flooding

Question 9

Clark is testing a subscription-based SaaS platform and discovers that the coupon validation endpoint does not use database-level locking, allowing him to exploit a race condition by sending ten parallel POST requests with a single-use coupon code before the server marks it as redeemed. He successfully applies the discount ten times on a single transaction, reducing a $500 invoice to $5 and demonstrating that the flaw allows unauthorized financial benefit. Which type of web application vulnerability did Clark exploit?

A. SQL Injection B. Business Logic Flaw C. CSRF D. Broken Access Control

Question 10

A red team analyst uses Google dork queries such as 'site:target.com filetype:pdf' and 'inurl:admin' combined with Wayback Machine searches to uncover archived versions of the target web application that expose deprecated API endpoints, legacy administrative panels, and configuration files that were inadvertently crawled and indexed. She compiles these findings into a structured inventory of the application's publicly exposed infrastructure and technology stack before initiating any active interaction with the live application. Which web application hacking methodology phase does this activity represent?

A. Attack Database Connectivity B. Footprint Web Infrastructure C. Bypass Client-Side Controls D. Attack Web Services

ByThe Test Master

Related Post

CEH v13 Domain 7.1 Practice Test 002

CEH v13 Domain 6.1 Practice Test 002

CEH v13 Domain 5.3 Practice Test 002

Leave a Reply Cancel reply

You missed

CEH v13 Domain 7.1 Practice Test 002

CEH v13 Domain 6.1 Practice Test 002

CEH v13 Domain 5.3 Practice Test 002

CEH v13 Domain 5.2 Practice Test 002