Overview
Domain 5 covers three modules against the web tier. Hacking web servers covers attacking the server software and its configuration: directory traversal, misconfiguration, default content, and server-level vulnerabilities. Hacking web applications covers the broad methodology and the OWASP-style attack classes: broken authentication and session management, injection, cross-site scripting, cross-site request forgery, insecure direct object references, security misconfiguration and more. SQL injection covers the specific types (union, error-based, blind boolean, blind time-based, second-order, out-of-band), recognizing payloads, and evading web application firewalls.
This domain rewards hands-on familiarity. Candidates who have run through a deliberately vulnerable application do far better than those who only read about the attacks. The exam tests the web application methodology sequence and the precise SQL injection types, which are the two biggest loss points in this domain.
How it's tested
Expect questions showing web requests, responses, payloads or methodology steps, asking which attack is occurring, which SQL injection type a payload represents, what comes next in the methodology, or which evasion applies. Recognizing payloads and sequence is the key skill.
-
Identify the web attack
A request, response or payload is shown, and you must name the attack, such as SQL injection, XSS or SSRF.
-
Classify the SQL injection
A payload or behavior is described, and you must identify the injection type, such as blind time-based or union-based.
-
Methodology next step
A web app test is partway through, and you must choose the next step in the testing methodology.
A tester finds that an input returns no visible error or data, but adding a payload that delays the response by several seconds reliably changes the page's load time. There is no direct output to read, which rules out union and error-based injection. The delay confirms the database is executing injected logic, so this is blind time-based SQL injection.
Domains 3
Official domains from the EC-Council outline, in outline order.
5.1 Hacking Web ServersAttacking web server software and configuration.
- What it means
- This covers web server architecture and vulnerabilities, attacks such as directory traversal, misconfiguration exploitation, default and sample content, HTTP response splitting, web server misconfigurations and patch gaps, web server attack tools, and countermeasures such as hardening, patching and removing default content.
- What to understand
- Web server attacks target the server software and its configuration rather than the application logic. Default content, verbose error messages and missing patches are common openings. Hardening, timely patching and removing unnecessary content are the main defenses.
- How it shows up
- A web server weakness is described, and you must identify the attack or the hardening countermeasure.
- Common confusion
- Confusing web server attacks with web application attacks. One targets the server software and configuration, the other the application code.
5.2 Hacking Web ApplicationsThe web app testing methodology and OWASP-style attack classes.
- What it means
- This covers the web application hacking methodology (footprint the infrastructure, analyze the application, bypass client-side controls, attack authentication, authorization, session management, data validation and business logic) and the attack classes: broken authentication, injection, cross-site scripting, cross-site request forgery, insecure direct object references, server-side request forgery, security misconfiguration, and API and web service attacks.
- What to understand
- The methodology is a sequence you must internalize, because the exam asks what comes next after several completed steps. Each attack class has a distinct mechanism: XSS targets other users' browsers, CSRF abuses a victim's authenticated session, SSRF makes the server send requests, and insecure direct object references expose data by changing identifiers.
- How it shows up
- A web app attack or a methodology step is described, and you must identify it or choose the next step.
- Common confusion
- Confusing XSS, CSRF and SSRF. XSS runs script in a user's browser, CSRF rides the victim's session, and SSRF makes the server issue requests.
5.3 SQL InjectionSQL injection types, payload recognition and WAF evasion.
- What it means
- SQL injection covers the attack types (in-band such as union-based and error-based, inferential or blind such as boolean-based and time-based, and out-of-band), detecting and exploiting injection points, recognizing payloads, extracting data, and evading web application firewalls through encoding and obfuscation, with countermeasures such as parameterized queries and input validation.
- What to understand
- The injection type depends on how the application returns information. Union-based returns data directly, error-based leaks it through error messages, blind boolean infers it from true/false responses, and blind time-based infers it from response delays. The root-cause fix is parameterized queries and input validation, not a WAF alone.
- How it shows up
- A payload or behavior is described, and you must identify the SQL injection type or the correct countermeasure.
- Common confusion
- Confusing blind boolean with blind time-based injection. Boolean infers from true/false responses; time-based infers from deliberate delays.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Web server vs. web application attacks
Server attacks target software and configuration; application attacks target code and logic.
- Remember
- Default content and patch gaps are server issues; injection and XSS are application issues.
- Tested as
- Classification questions.
- Trap
- Mixing the two categories.
-
Web app testing methodology
Footprint, analyze, bypass client-side controls, then attack authentication, authorization, session, data validation and business logic.
- Remember
- The exam asks what comes next in the sequence.
- Tested as
- Methodology questions.
- Trap
- Guessing steps without internalizing the order.
-
Union-based SQL injection
Uses UNION to append attacker-controlled results to the query output.
- Remember
- It returns data directly in the response.
- Tested as
- SQL injection questions.
- Trap
- Confusing it with blind injection.
-
Error-based SQL injection
Extracts data through database error messages.
- Remember
- It relies on verbose errors being returned.
- Tested as
- SQL injection questions.
- Trap
- Expecting it to work when errors are suppressed.
-
Blind boolean SQL injection
Infers data from true/false differences in responses.
- Remember
- No data is returned directly.
- Tested as
- SQL injection questions.
- Trap
- Confusing it with time-based.
-
Blind time-based SQL injection
Infers data from deliberate response delays.
- Remember
- Used when there is no visible output or error.
- Tested as
- SQL injection questions.
- Trap
- Confusing delays with boolean responses.
-
XSS
Injects script that runs in other users' browsers.
- Remember
- Stored, reflected and DOM-based are the main types.
- Tested as
- Web app attack questions.
- Trap
- Confusing it with CSRF.
-
CSRF
Tricks a victim's browser into sending authenticated requests.
- Remember
- It abuses the victim's existing session.
- Tested as
- Web app attack questions.
- Trap
- Confusing it with SSRF.
-
SSRF
Makes the server send requests the attacker controls.
- Remember
- It can reach internal services and cloud metadata.
- Tested as
- Web app attack questions.
- Trap
- Confusing it with CSRF.
-
Insecure direct object reference
Accessing data by changing an identifier when authorization is not checked.
- Remember
- It is an authorization flaw.
- Tested as
- Web app attack questions.
- Trap
- Treating it as an injection flaw.
-
Parameterized queries
Separating SQL code from user data to prevent injection.
- Remember
- The root-cause fix for SQL injection, not a WAF alone.
- Tested as
- Countermeasure questions.
- Trap
- Relying on a WAF instead of fixing the code.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Union vs. error-based vs. blind boolean vs. blind time-based SQL injection
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Union-based | Appends results with UNION | Returns data directly | Confusing it with blind injection |
| Error-based | Leaks data via error messages | Needs verbose errors | Expecting it with errors suppressed |
| Blind boolean | Infers from true/false responses | No direct data output | Confusing it with time-based |
| Blind time-based | Infers from response delays | No output or errors at all | Confusing delays with boolean logic |
XSS vs. CSRF vs. SSRF
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| XSS | Runs attacker script in a user's browser | Targets other users | Confusing stored and reflected |
| CSRF | Forces a victim's browser to send requests | Abuses the victim's session | Confusing it with SSRF |
| SSRF | Makes the server send requests | Abuses server-side access | Confusing it with CSRF |
Web server vs. web application attacks
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Web server | Targets server software and configuration | Default content, patches, misconfiguration | Treating it as an application flaw |
| Web application | Targets application code and logic | Injection, XSS, broken auth | Treating it as a server flaw |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
WAF fixes injection
- What candidates pick
- Deploy a web application firewall to resolve a SQL injection flaw.
- Why it looks right
- It blocks attacks quickly without code changes.
- Why it's wrong
- A WAF is a compensating layer that can be bypassed. The root-cause fix is parameterized queries and input validation.
Clue to watch for The question asks for the best long-term remediation.
-
Boolean is time-based
- What candidates pick
- Call an injection that infers data from true/false page differences time-based.
- Why it looks right
- Both are blind injection.
- Why it's wrong
- Time-based infers from deliberate delays; boolean infers from true/false responses.
Clue to watch for The payload relies on response content versus response timing.
-
XSS is CSRF
- What candidates pick
- Describe script running in a victim's browser as CSRF.
- Why it looks right
- Both involve the victim's browser.
- Why it's wrong
- XSS injects and runs script in the browser; CSRF forces the browser to send an authenticated request.
Clue to watch for The attack runs script versus forcing a request.
-
SSRF is CSRF
- What candidates pick
- Call a server fetching attacker-supplied URLs CSRF.
- Why it looks right
- The names are similar.
- Why it's wrong
- SSRF makes the server send requests; CSRF makes the victim's browser send them.
Clue to watch for The server itself is making the request.
-
Server flaw is app flaw
- What candidates pick
- Classify a default sample page left on the server as an application vulnerability.
- Why it looks right
- It is on the web stack.
- Why it's wrong
- Default content and configuration are web server issues, not application code flaws.
Clue to watch for The weakness is in server configuration or default files.
-
Skip the methodology
- What candidates pick
- Jump to attacking business logic before analyzing the application.
- Why it looks right
- Business logic flaws are high impact.
- Why it's wrong
- The methodology analyzes and maps the application first, so later steps have context.
Clue to watch for The question gives the current step and asks what is next.
Answer framework
For any Domain 5 web attack scenario, use these steps before choosing an answer.
- Decide whether the target is the web server (software and configuration) or the web application (code and logic).
- For application attacks, identify the class precisely, distinguishing XSS, CSRF, SSRF and insecure direct object references.
- For SQL injection, classify the type by how data is returned, whether directly, through errors, through true/false responses or through timing.
- When asked for the next step, follow the web application testing methodology in order rather than jumping ahead.
- Recommend root-cause fixes such as parameterized queries and input validation, treating a WAF as a supplementary layer, and treat a web application firewall only as a supplementary layer.
Practice question
Want more like this? The CEH practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This domain rewards hands-on practice more than any other. Set up a deliberately vulnerable application such as DVWA or OWASP Juice Shop and an intercepting proxy, and actually run the attacks. Candidates who do this consistently outperform those who only read.
Start with SQL injection, the biggest loss point. Build a table of the injection types against how each returns data, and practice recognizing payloads and classifying them. Learn that parameterized queries, not a WAF, are the root-cause fix.
Next, internalize the web application testing methodology as an ordered sequence so you can answer what comes next. Then learn the attack classes, drilling the XSS, CSRF and SSRF distinctions until they are automatic.
Web server attacks are the smaller module; learn the common openings such as default content and missing patches and their hardening defenses. Afterwards, move to Domain 6, wireless network hacking. Review missed questions by naming the exact SQL injection type you misread.
FAQ
How much of CEH v13 is Domain 5?
Web Application Hacking is about 14% of the exam, roughly 18 questions across web servers, web applications and SQL injection.
What is the hardest part of this domain?
SQL injection, where the exam expects you to identify specific types and recognize payloads, and the web application methodology, where you must know what comes next.
What is the difference between blind boolean and blind time-based SQL injection?
Boolean-based infers data from true/false differences in the response. Time-based infers data from deliberate delays in the response time.
What is the difference between CSRF and SSRF?
CSRF makes a victim's browser send an authenticated request. SSRF makes the server itself send requests the attacker controls, which can reach internal services.
Is a WAF enough to stop SQL injection?
No. A WAF is a compensating layer that can be bypassed. The root-cause fix is parameterized queries and input validation.
Do I need a lab for this domain?
It helps a great deal. Practicing against a deliberately vulnerable application with an intercepting proxy makes the attacks and payloads far easier to recognize on the exam.
How does Domain 5 connect to the rest of the exam?
It extends attacks from the network to the web tier, and its injection and authorization flaws reappear in cloud and API contexts.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 5 knowledge
You have covered web server attacks, the web application methodology and SQL injection. Test whether you can classify payloads and attacks under exam conditions.