Hacking Web Applications
12 practice questions under this official exam objective (312-50v12, 312-50v13), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
12 total · page 1 of 1Exploiting XSS with HTTPOnly Cookies
This question addresses the limitations of stealing session cookies via Cross-Site Scripting (XSS) when the HTTPOnly flag is enabled. It establishes t
How to Confirm XSS When CSP Allows Only Same-Domain Scripts?
This question tests how to validate an XSS finding when a strict Content Security Policy blocks inline and external scripts but permits same-origin so
Identifying API Vulnerability: Missing ABAC Validation
This question identifies an API vulnerability where attackers can manipulate sensitive data due to missing attribute-based access control. The correct
Which Web Vulnerability Is Exploited by an XML External Entity DTD Payload?
The payload is an XML DTD that declares an external entity resolving a local file, the signature of an XML External Entity (XXE) attack. This page con
Which Tool Intercepts and Tests Web Session Traffic?
This CEH 312-50v12 scenario asks which web-application penetration testing tool offers an intercepting proxy, customized attacks, and session-token ra
Which SQL Injection Technique Bypasses Input Validation?
This CEH scenario tests how a seasoned attacker defeats an e-commerce site whose input validation blocks known suspicious patterns. The page establish
Watering Hole Attack Identification
This question examines the Watering Hole attack technique where attackers compromise websites frequented by a specific target group to deliver malware
Exploiting XSS with HTTPOnly Cookies via HTML Encoding
This question examines how to exploit Cross-Site Scripting (XSS) when HTTPOnly flags prevent direct cookie access, focusing on input sanitization bypa
Which Injection Attack Exploits SSI Directives in a Web Application?
When a page-generation feature feeds remote user input into Server-Side Includes (SSI) directives, attackers can inject #exec, #include or #config sta
Which Web Service Architecture Component Secures SOAP Message Integrity and Confidentialit
WS-Security is the SOAP extension in the Web Service Architecture that authenticates users and preserves the integrity and confidentiality of SOAP mes
Exploiting Client-Side Sanitization and Missing HttpOnly Cookies
This CEH 312-50v12 question presents a web application that sanitizes input only with JavaScript and stores session cookies without the HttpOnly flag.
Exploiting Verbose Errors and No Lockout for Brute Force
This question examines how verbose error messages and missing account lockout policies facilitate credential guessing attacks against web applications