An attacker submits an XML document to a web service that includes an external entity referencing a local file. The application's XML parser processes the entity and returns the file's contents. This attack is known as:

XXE (XML External Entity) attack

A web application allows users to submit a URL that the server fetches to generate a thumbnail. The application is hosted on a cloud platform with access to internal metadata services. An attacker wants to exploit SSRF to access the cloud metadata service. Which of the following is the most effective defense?

Use a blacklist of internal IP ranges and block requests to them.

Disable the thumbnail generation feature.

Add a CAPTCHA to the URL input form.

Block requests to the metadata service IP (169.254.169.254) and validate the URL against a whitelist of allowed domains.

Which of the following is a potential impact of an XXE attack?

Stealing session cookies via JavaScript

Reading local files from the server

Performing client-side JavaScript injection

EC-CouncilEthical Hacking Essentials

Domain 6Objective 2

Web Application Attack Techniques and Exploitation EHE Practice Questions (Page 1)

Part of the Web Application Attacks and Countermeasures domain, which makes up ~9% of our current practice bank.

57questions here

12free pages

11concepts

11 Concepts in This Objective

Web Application Attack Surface
Injection Attacks
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Session Hijacking and Fixation
Authentication and Authorization Flaws
File Upload Vulnerabilities
XML External Entity (XXE) Attacks
Server-Side Request Forgery (SSRF)
Web Application Exploitation Tools
Countermeasures and Secure Coding Practices

Questions 1–5

1foundation · easy
An attacker submits an XML document to a web service that includes an external entity referencing a local file. The application's XML parser processes the entity and returns the file's contents. This attack is known as:
Select an answer first
2expert · hard
A web application allows users to submit a URL that the server fetches to generate a thumbnail. The application is hosted on a cloud platform with access to internal metadata services. An attacker wants to exploit SSRF to access the cloud metadata service. Which of the following is the most effective defense?
Select an answer first
3foundation · easy
In a typical three-tier web application architecture, which component is primarily responsible for executing business logic and processing user requests?
Select an answer first
4foundation · easy
Which of the following is a potential impact of an XXE attack?
Select an answer first
5foundation · easy
Which injection attack occurs when an application passes unsanitized user input to a system shell command?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Web Application Attack Techniques and Exploitation EHE Practice Questions (Page 1)

Questions 1–5

An attacker submits an XML document to a web service that includes an external entity referencing a local file. The application's XML parser processes the entity and returns the file's contents. This attack is known as:

In a typical three-tier web application architecture, which component is primarily responsible for executing business logic and processing user requests?

Which of the following is a potential impact of an XXE attack?

Which injection attack occurs when an application passes unsanitized user input to a system shell command?

Keep studying — Web Application Attacks and Countermeasures