CEH v13 Domain 5.2 Practice Test 004

This practice test covers Domain 5 (Web Application Hacking) Subdomain 2 (Hacking Web Applications) from the CEH v13 (312-50v13) exam blueprint (v5).

These questions are inspired by the EC-Council CEH exam and are designed to help you test your knowledge of ethical hacking tools, techniques, and methodologies. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CEH exam.

Note: CEH and Certified Ethical Hacker are registered trademarks of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CEH practice tests based on specific domains and subdomains, click that link

CEH v13 Domain 5.2 Practice Test 004

10 questions • 8 single-answer, 2 multi-select

Question 1

Penetration tester Jane intercepts a shopping app request and changes a hidden form field holding the item price from 100 to 1. The server accepts the altered value and processes the discounted order without revalidation. Which weakness is Jane exploiting?

A. Session fixation B. Directory traversal C. Server-side request forgery D. Bypassing client-side controls

Question 2

Analyst Kevin injects a malicious script into a forum comment field, and the payload executes in every visitor's browser when the page loads. The script silently forwards their session cookies to his server. Which attack did Kevin perform?

A. Stored XSS B. Reflected XSS C. CSRF D. DOM clobbering

Question 3

A security team reviews logs and finds requests appending ../../../../etc/passwd to a file parameter on the web app. The server returned the contents of system files outside the intended directory. Which attack does this indicate?

A. Command injection B. Directory traversal C. LDAP injection D. SQL injection

Question 4

Elijah authenticates as a low-privilege user, then edits the account_id value in the URL to view another customer's invoice. The app returns the data without checking ownership of the record. Which flaw is Elijah abusing?

A. Session hijacking B. Privilege escalation via XSS C. Insecure direct object reference D. Forced browsing of admin pages

Question 5

Select all that apply

During an assessment of a banking portal, a tester crafts a page that auto-submits a hidden funds-transfer form when a logged-in victim visits it. The bank processes the request using the victim's active session. Which web app attack is demonstrated? (Choose two)

A. Cross-Site Request Forgery B. Clickjacking C. Parameter pollution D. Session riding E. SQL injection

Question 6

Clara uses Burp Suite to map a target application, then sends each input through the Intruder module with crafted payloads to observe error messages and response timing. She is systematically probing where untrusted data reaches sensitive functions. Which methodology phase is she performing?

A. Attack session management B. Footprint web infrastructure C. Analyze web applications D. Bypass access controls

Question 7

A tester discovers an upload feature that accepts files without verifying type and places a script named image.php on the server. Browsing to that file executes attacker code and returns a remote shell. Which condition enabled this outcome?

A. Open redirect B. Weak password policy C. Unrestricted file upload D. Verbose error disclosure

Question 8

Select all that apply

An attacker notices a web app passes a URL in a parameter and fetches it server-side, so he supplies an internal metadata endpoint address. The server retrieves and returns cloud credentials from that internal-only resource. Which attack technique is this? (Select all that apply)

A. Cross-site scripting B. Cookie poisoning C. Cloud metadata abuse D. Server-Side Request Forgery E. HTTP response splitting

Question 9

A retailer's API returns full account details when a tester requests an endpoint meant only for administrators using a normal user token. The backend never checks the caller's role before responding. Which web API weakness is exposed?

A. Rate limiting bypass B. Excessive data exposure C. Mass assignment D. Broken function level authorization

Question 10

Marcus finds a search box that echoes his input straight into the response, so he sends a victim a crafted link containing a script in the query string. When the victim clicks, the script runs once in their browser and steals their token. Which attack did Marcus use?

A. Reflected XSS B. SQL injection C. DOM-based XSS D. Stored XSS

Related Posts

Leave a Comment Cancel Reply