CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SMTP header injection

  Why it's wrong here

  SMTP header injection exploits vulnerabilities in web applications or mail servers that fail to properly sanitize user input, allowing an attacker to insert arbitrary header fields (e.g., "Bcc:", "Subject:", "From:") into an email. This can lead to email spoofing, spamming, or bypassing security filters. The provided scenario, however, describes the use of the VRFY command, which is a direct query for user existence, not an attempt to manipulate email headers.

• ✗

  SMTP open relay testing

  Why it's wrong here

  SMTP open relay testing determines if a mail server allows unauthenticated users to send emails to external domains, effectively acting as a relay for spam or malicious content. Attackers typically attempt to send a test email from an arbitrary external address to another external address through the target server without providing credentials. The VRFY command, used to verify user existence, is distinct from the process of attempting to send mail through an unauthenticated relay.

• ✓

  SMTP user enumeration via VRFY

  Why this is correct

  SMTP user enumeration via VRFY is a technique where an attacker uses the VRFY (verify) command to query the mail server for the existence of specific usernames. A successful VRFY command typically elicits a "250 OK" response along with the full name or email address of the user if the account exists, whereas an invalid user often results in a "550 No such user" or similar error. This differential response allows an attacker to systematically build a list of valid user accounts on the system, which can then be used for further attacks like brute-forcing or phishing.

• ✗

  SMTP DDoS attack

  Why it's wrong here

  An SMTP Distributed Denial of Service (DDoS) attack aims to overwhelm a mail server with a massive volume of connection requests, legitimate-looking email traffic, or malformed packets from multiple compromised sources, rendering it unavailable to legitimate users. This typically involves a flood of HELO, MAIL FROM, RCPT TO, or even VRFY commands, but at an extremely high rate and scale designed to exhaust server resources. A few VRFY commands, as implied by an "SMTP conversation" snippet, are diagnostic or enumerative, not indicative of a resource-exhausting DDoS attempt.

Go deeper

Related to this question