Certified Ethical Hacker (CEH) Web, Application, and Database Hacking Syllabus

List three key web server hardening countermeasures.

Disable unnecessary services/ports, remove default accounts and sample files, apply patches promptly, disable directory listing, use TLS/HTTPS, and run the server with least-privilege accounts.

Why should detailed error messages be disabled on production web servers?

Verbose errors can leak server versions, file paths, stack traces, and database details that help attackers fingerprint the system and craft targeted exploits.

What is the OWASP Top 10?

A regularly updated, consensus list published by OWASP of the ten most critical web application security risks, used as an awareness and prioritization standard.

In the OWASP Top 10 (2021), what is the #1 ranked risk?

A01: Broken Access Control.

What does OWASP A03:2021 'Injection' include?

Flaws where untrusted data is sent to an interpreter as part of a command/query, including SQL injection, NoSQL injection, OS command injection, and (newly merged) Cross-Site Scripting (XSS).

What is the difference between authentication and authorization?

Authentication verifies who a user is (identity); authorization determines what an authenticated user is permitted to do (access rights/permissions).

What is broken access control and give one example?

When users can act outside their intended permissions. Example: insecure direct object reference (IDOR) where changing an ID in the URL exposes another user's data.

What is a credential stuffing attack?

An automated attack that uses large lists of username/password pairs leaked from other breaches to try logging in, exploiting users' password reuse.

What is session hijacking in web applications?

Stealing or predicting a valid session token/cookie to impersonate an authenticated user and take over their session without credentials.

What is a session fixation attack?

The attacker sets or forces a known session ID on a victim before login; once the victim authenticates, the attacker reuses that fixed session ID to hijack the session.

What is privilege escalation, and what are its two types?

Gaining higher access than authorized. Vertical escalation = gaining higher-privilege (e.g., admin) rights; horizontal escalation = accessing another user's resources at the same privilege level.

What is Cross-Site Scripting (XSS)?

An injection flaw where an attacker injects malicious scripts into web pages viewed by other users, executing in their browsers to steal cookies, sessions, or perform actions.

Name and define the three types of XSS.

Stored (persistent) – script saved on the server and served to users; Reflected – script reflected off the server in a response from a request; DOM-based – manipulation occurs entirely in the client-side DOM.

What is Cross-Site Request Forgery (CSRF)?

An attack that tricks an authenticated user's browser into sending an unwanted request to a web app, performing actions on their behalf without consent; mitigated with anti-CSRF tokens.

What is OS command injection?

An attacker injects operating-system commands into an application input that is passed to a system shell, allowing arbitrary command execution on the server.

Why is input validation important and which approach is preferred?

It prevents malicious data from reaching interpreters. Whitelisting (allowlisting) valid input is preferred over blacklisting, since blacklists can be bypassed.

What is a web shell?

A malicious script (e.g., PHP, ASP, JSP) uploaded to a web server that gives an attacker a remote command/control interface to execute commands and maintain persistence.

What is an insecure file upload vulnerability and a typical consequence?

When an app allows uploading files without proper type/content checks, an attacker can upload a web shell or malicious script, leading to remote code execution.

What are two common security risks specific to APIs?

Broken object level authorization (BOLA/IDOR), broken authentication, excessive data exposure, lack of rate limiting, and improper input validation (see OWASP API Security Top 10).

What is a webhook and what is a key security concern with it?

A webhook is an automated HTTP callback that sends data to a URL when an event occurs. Key risk: unverified/forged requests, so payloads should be authenticated (e.g., signed with a shared secret/HMAC).

List three core web application countermeasures.

Validate and sanitize all input, use parameterized queries/prepared statements, enforce least privilege, apply secure session management, deploy a WAF, and keep components patched.

What is a Web Application Firewall (WAF) and where does it operate?

A WAF filters, monitors, and blocks malicious HTTP/HTTPS traffic to/from a web application, operating at Layer 7 (application layer) to defend against attacks like SQLi and XSS.

What is SQL injection (SQLi)?

An attack that inserts/manipulates malicious SQL statements via application input so they are executed by the backend database, allowing unauthorized data access or modification.

Why does SQL injection occur (root cause)?

Because user-supplied input is concatenated directly into SQL queries without proper validation, parameterization, or escaping, letting input alter query logic.

What does the classic injection ' OR '1'='1 achieve?

It creates an always-true condition in a WHERE clause, bypassing authentication or returning all rows because the query condition is always satisfied.

What are the three main categories of SQL injection?

In-band (e.g., error-based and UNION-based), Blind/Inferential (boolean-based and time-based), and Out-of-band SQL injection.

What is error-based SQL injection?

An in-band technique that deliberately triggers database error messages, using the leaked error details to extract information about the database structure and data.

What is UNION-based SQL injection?

An in-band technique using the UNION SQL operator to combine the result of an injected query with the original, retrieving data from other tables in the application's response.

What is the difference between boolean-based and time-based blind SQL injection?

Boolean-based infers data from true/false differences in the app's response; time-based infers data by observing whether a conditional time delay (e.g., SLEEP/WAITFOR) occurs, with no visible data returned.

What is out-of-band SQL injection and when is it used?

It exfiltrates data through a different channel (e.g., DNS or HTTP requests from the database to an attacker server). Used when in-band/blind methods are unreliable or responses are not returned directly.

Name two popular automated SQL injection tools.

sqlmap and Havij (others include jSQL Injection and BSQL Hacker).

What are the primary countermeasures against SQL injection?

Use parameterized queries/prepared statements, stored procedures, input validation (whitelisting), least-privilege database accounts, escaping inputs, and a WAF; avoid dynamic query string concatenation.