Exam objective
CEHHacking Web Applications
This objective sits in Web Application Hacking, which carries 14% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.
Objective title verbatim from the official objectives. EC-Council exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A profile page writes user-supplied text between two HTML tags, and an analyst watches script run from it. Which control belongs on that variable?
Correct.
Checked against cheatsheetseries.owasp.org, September 2026Concept
Untrusted data turns dangerous at the moment it is written into a page, and what makes it safe depends on the part of the document it lands in. Escaping is applied on the way out, per context.
Why D
Text placed between HTML tags sits in an HTML context, and entity encoding converts the characters a browser would read as markup into literal text before the page is parsed.
Source
OWASP Cheat Sheet Series, Cross Site Scripting Prevention, checked September 2026“HTML Context” refers to inserting a variable between two basic HTML tags like a <div> or <b>. For example: <div> $varUnsafe </div>... In order to add a variable to a HTML context safely to a web template, use HTML entity encoding for that variable.
Now you: practice questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An application encodes every value its server writes into pages, yet a payload carried in the URL fragment still runs in the browser. What explains it?
Sample question 2 of 3
A transfer endpoint accepts a POST from any origin as long as the session cookie rides along. Which server-side control stops the forged request?
Sample question 3 of 3
A team proposes removing CSRF tokens and relying on SameSite=Lax for the session cookie. How should the reviewer respond?
That’s 3 of the full CEH bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.