312-50 Question 341
Single answer▪ Attack Web App ClientDuring an authorized red-team engagement, you need to assess whether employees are vulnerable to client-side web application attacks when browsing an internal portal. The target users access the portal from managed Windows workstations with modern browsers. You want a technique that executes in the victim's browser after they load a page you control, allowing you to demonstrate session context abuse and browser-based post-exploitation within the scope of the test. Which approach is the MOST appropriate?
- A
Use a browser hook framework such as BeEF to inject JavaScript into a page the victim loads, then use the hooked browser to demonstrate client-side attack impact
- B
Launch a SYN flood against the portal so users reconnect through a fallback page where credentials can be captured
- C
Run SQL injection against the portal's login form to obtain database access and then pivot to the client browser
- D
Perform ARP spoofing on the subnet to directly execute code inside the victim's browser without any page content manipulation
Show answer and explanation
Correct answer: A
Explanation
The best answer is the browser hook approach using BeEF because the scenario is explicitly about attacking the web application client, meaning the victim's browser environment rather than the server or network alone. In CEH contexts, BeEF is a well-known tool for demonstrating the impact of client-side weaknesses by hooking a browser with JavaScript delivered through a page the user visits. This enables realistic validation of browser trust, session abuse, page manipulation, and other client-side risks. By contrast, SYN flooding is availability-focused, SQL injection is server-side, and ARP spoofing is a traffic interception method that does not inherently provide browser code execution. This aligns with common web security testing guidance: client-side testing focuses on browser behavior, script execution, DOM interaction, and session-context abuse, while server-side and network-layer attacks are separate categories. Relevant references include the BeEF project documentation for browser hooking concepts and OWASP guidance distinguishing client-side issues from server-side vulnerabilities.
- A. Correct.
Correct. A browser exploitation framework such as BeEF (Browser Exploitation Framework) is specifically designed to assess client-side web attack exposure by hooking a browser through injected JavaScript. Once a user loads a page containing the hook, the tester can demonstrate same-browser impacts such as DOM manipulation, session-context actions, social engineering prompts, and other browser-based attack techniques that are relevant to the 'Attack Web App Client' domain. This matches the scenario because the goal is code execution in the browser after the victim loads controlled content.
- B. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique, not a client-side web application attack method for executing in the victim's browser. It may disrupt availability, but it does not provide browser hook capability or demonstrate post-exploitation within the user's web session context. A candidate might choose this because it affects user access paths, but it does not satisfy the objective of testing browser-side compromise.
- C. Incorrect.
Incorrect. SQL injection is a server-side attack against the application's backend, not a primary technique for attacking the web application client. While a server compromise could potentially enable later delivery of malicious content, the option describes database access rather than a direct client-browser attack method. This is a common misconception: compromising the server is different from assessing client-side execution in the browser.
- D. Incorrect.
Incorrect. ARP spoofing is a network-layer man-in-the-middle technique. It can be used to intercept or manipulate traffic under some conditions, but it does not by itself directly execute code in a victim's browser. To achieve browser execution, the attacker would still need to inject or modify web content and deal with HTTPS protections, HSTS, certificate validation, and other controls. The option overstates what ARP spoofing alone can do.