Certified Ethical Hacker CEH (CEH) — Questions 676–750

Object-Relational Mappers (ORMs) provide an effective defense against SQL injection by abstracting database interactions and typically generating parameterized queries. Instead of concatenating user input directly into SQL strings, ORMs bind input values as parameters, ensuring they are treated as data and not executable code. This fundamental separation prevents malicious input from altering the query's structure, thereby neutralizing injection attempts.

Phishing is a prevalent cyberattack where adversaries employ deceptive emails to trick recipients into divulging confidential information or executing malicious actions. The Social Engineering Toolkit (SET) is frequently used to craft convincing fake login pages or deliver malware via email attachments, making it a classic vector for credential harvesting or system compromise. This method leverages trust and urgency to bypass security awareness and technical controls.

Mantraps are highly effective physical security controls consisting of two interlocking doors, designed to permit only one person to pass through at a time after successful authentication. This physical barrier directly prevents tailgating by making it impossible for a second individual to enter behind an authorized person. Coupling this technical control with a strictly enforced policy reinforces security protocols, ensuring both physical and administrative measures actively mitigate the tailgating threat.

Time-based blind SQL injection is the appropriate technique when the application provides no direct output and no discernible boolean difference in its responses. This method relies on making the database server pause for a specific duration (e.g., using `SLEEP()`, `WAITFOR DELAY`, or `PG_SLEEP()`) if a particular injected condition is met. By measuring the time taken for the server to respond, the penetration tester can infer the truthfulness of conditions and extract data character by character.

This option accurately describes the Nmap command's functionality. The `-sS` flag initiates a TCP SYN scan, also known as a stealth scan, which is efficient and less likely to be logged by firewalls. The `-sV` flag enables service version detection, attempting to determine the application and version running on open ports. Additionally, the `-O` flag performs operating system detection, and the `-p` flag explicitly targets only ports 22, 80, 443, and 3389.

Spear phishing is a highly targeted form of phishing that uses personalized information to increase the credibility and effectiveness of the attack. Attackers conduct reconnaissance to gather details about the target, such as their name, job title, company, and even internal relationships, to craft a convincing email. An email appearing to be from the CEO to a specific employee leverages this personalized context and perceived authority, making it a classic example of a spear phishing attempt designed to elicit a specific response.

Server-Side Request Forgery (SSRF) occurs when an attacker exploits a vulnerability in a web application to compel the server itself to make arbitrary requests. These requests can target internal network resources, such as other services, databases, or cloud metadata APIs, which are typically inaccessible directly from the internet. The server acts as a proxy, fetching data or performing actions on behalf of the attacker, often bypassing firewall rules and network segmentation. This allows for reconnaissance, port scanning, and even direct interaction with sensitive internal systems.

Forged ARP replies bind the attacker's MAC to the gateway IP, allowing interception of traffic.

Collecting data from Open Source Intelligence (OSINT) sources, such as Shodan for internet-facing device information or social media for organizational details, is a purely passive reconnaissance technique. This method involves querying publicly available databases and websites, generating no direct network traffic to the target's infrastructure, thus ensuring complete undetectability.

Injection vulnerabilities occur when untrusted data is sent to an interpreter as part of a command or query without proper validation or sanitization. This allows an attacker to trick the interpreter into executing unintended commands, accessing unauthorized data, or including arbitrary files. Remote File Inclusion (RFI) is a prime example, where an attacker can force the application to include and execute malicious remote files, often leading to remote code execution.

Using a gelatin mold is a classic and often effective method for creating a spoofed fingerprint, as gelatin can accurately capture and replicate the unique ridge patterns and valleys of an authorized user's print. When pressed against a scanner, particularly older optical or capacitive types lacking advanced liveness detection, the gelatin replica can mimic the electrical or optical properties of a real finger. This allows the penetration tester to deceive the biometric system into granting access.

Correct: `airodump-ng` is utilized to monitor wireless traffic and capture the WPA/WPA2 4-way handshake, which is essential for offline password cracking. To expedite this process, a deauthentication attack (typically executed with `aireplay-ng` alongside `airodump-ng`) is employed. This attack forces an authenticated client to disconnect and then immediately reconnect to the access point, thereby generating the necessary handshake frames for `airodump-ng` to record.

A mantrap at the main entrance is a robust physical security control that effectively prevents tailgating and unauthorized physical access to the premises. Simultaneously, requiring multi-factor authentication (MFA) for all password reset requests significantly strengthens logical security by making it much harder for social engineers to gain unauthorized account access, even if they successfully trick an employee into initiating a reset. This combination addresses both physical and social engineering vulnerabilities comprehensively.

The `--dbs` option explicitly instructs sqlmap to enumerate and display the names of all accessible databases on the target system by querying the database's information schema or system tables. Concurrently, the `--batch` option ensures that sqlmap operates in a non-interactive mode, automatically accepting default choices and proceeding without requiring user input for any prompts or questions that might arise during the enumeration process. This combination efficiently retrieves database names without interruption, which is ideal for automated scripting.

Correct. Rate limiting can throttle attack traffic.

DNS zone transfers, specifically AXFR (full zone transfer) and IXFR (incremental zone transfer), are designed to replicate DNS zone data between primary and secondary name servers. By configuring the authoritative DNS server to only permit these transfers from a predefined list of trusted IP addresses (typically the secondary DNS servers), an administrator directly prevents unauthorized entities from enumerating an entire domain's host records. This access control mechanism is the primary and most effective defense against malicious reconnaissance via zone transfers.

Burp Proxy is the core interception component of Burp Suite, acting as a man-in-the-middle between the browser and the target web server. It is specifically designed to capture all HTTP and HTTPS traffic flowing through it, allowing security professionals to view, analyze, and modify requests and responses in real-time before they reach their destination. This real-time interception capability is fundamental for understanding application logic, identifying vulnerabilities, and manipulating data during penetration testing.

SNMP Management Information Bases (MIBs) are structured databases that store a wealth of information about network devices. Many standard MIB objects, such as those under the `host` or `users` branches, are designed to expose system details like operating system versions, running services, and even lists of local user accounts. This information, often accessible with a default read-only community string, is invaluable for attackers performing reconnaissance to identify potential vulnerabilities or valid login names.

SSRF enables a malicious actor to force the vulnerable server to make requests to internal endpoints. Cloud instance metadata services, such as AWS IMDS (Instance Metadata Service), are often accessible from the instance itself via a well-known internal IP address (e.g., 169.254.169.254). An SSRF vulnerability can be leveraged to query these services, potentially retrieving sensitive information like temporary IAM role credentials, user data, or network configuration details, which can then be used for privilege escalation or further attacks within the cloud environment.

OSINT (Open Source Intelligence) using WHOIS queries is a highly effective passive information gathering technique. It involves querying public databases to retrieve domain registration details such as registrant names, contact information, registration and expiration dates, and nameservers. This method is considered passive because it does not directly interact with the target's live systems or network, relying solely on publicly available records.

Utilizing Shodan for target infrastructure searches is a quintessential passive reconnaissance technique because it relies entirely on pre-collected, publicly available data. Shodan continuously scans the internet and indexes information about internet-connected devices, services, and their configurations, storing this data in its own databases. An analyst querying Shodan does not send any direct network traffic to the target's systems, thereby avoiding detection and remaining completely non-intrusive.

The `ldapsearch -x -h <host>` command initiates an anonymous or simple authenticated query against an LDAP server. If successful, it enumerates directory attributes. The discovery of plaintext passwords within the returned LDAP attributes signifies a critical security misconfiguration, as sensitive user credentials are directly exposed. This poses a severe risk of credential theft, allowing attackers to reuse these passwords for lateral movement or access to other systems.

WEP key recovery using tools like aircrack-ng is the correct answer because WEP's fundamental cryptographic weakness stems from its inefficient use of Initialization Vectors (IVs) with the RC4 stream cipher. Attackers exploit the small 24-bit IV space and the plaintext transmission of IVs, leading to frequent IV reuse with the same WEP key. By collecting a large number of unique IVs, often hundreds of thousands to millions, statistical analysis can be performed to deduce the WEP key by observing patterns in the keystream generated from the IV and the key.

Weak service binary permissions represent a critical privilege escalation vulnerability where an attacker possesses write access to the executable file of a Windows service. By replacing the legitimate service binary with a malicious payload, such as a reverse shell or a user-creation script, the attacker can achieve elevated privileges. When the compromised service is subsequently started or restarted by the operating system, it will execute the attacker's code, typically under the SYSTEM account, granting full control over the machine.

The -sV flag instructs Nmap to perform service version detection on the specified port, which in this context is port 22, commonly used for SSH. Nmap achieves this by sending various probes to the port and analyzing the responses, often comparing banner grabs or protocol handshakes against its extensive service signature database. This process accurately identifies the specific SSH daemon and its version, such as OpenSSH 8.2p1, providing crucial intelligence for vulnerability assessment.

This option accurately describes the Nmap command's functionality. The -sU flag specifically instructs Nmap to perform a UDP port scan, targeting services that communicate via the User Datagram Protocol. Concurrently, the -sV flag enables service version detection, attempting to identify the application and its version running on any discovered open UDP ports. The -p 53,161,162 argument precisely limits this comprehensive scan to three specific UDP ports.

A downgrade attack specifically targets the SSL/TLS handshake process by forcing the communicating parties to negotiate and use an older, weaker, and often vulnerable version of the protocol. During the ClientHello message, an attacker intercepts and modifies the list of supported protocol versions, removing stronger options like TLS 1.2 or 1.3. This manipulation tricks the server into agreeing upon an outdated protocol, such as SSL 3.0 or TLS 1.0, which may contain known cryptographic weaknesses that can then be exploited for decryption or further compromise.

The `volatility -f memory.dmp netscan` command is crucial for initial malware investigation because it enumerates all active network connections present in the memory dump. This allows incident responders to quickly identify suspicious outbound connections to unknown or malicious IP addresses, which are strong indicators of command and control (C2) communication, data exfiltration, or botnet activity. Confirming such network activity is a primary step in validating a potential infection.

Tailgating is a physical security breach where an unauthorized individual gains access to a restricted area by following an authorized person through a controlled entry point without proper authentication. Once physically inside the secured perimeter, the attacker can connect their device to the internal network, potentially assigning themselves an unauthorized internal IP address, which would then be logged by the firewall attempting connections like SMB, indicating an internal compromise.

Log manipulation precisely describes the act of an attacker altering, deleting, or fabricating entries within system logs to obscure their malicious activities. This technique is crucial for covering tracks, evading detection by security monitoring systems, and hindering forensic investigations by removing evidence of unauthorized access or actions. Modifying log files directly addresses the scenario of removing specific entries.

Baiting is a social engineering attack that leverages human curiosity or greed by leaving physical media, such as USB drives or CDs, infected with malware in public or semi-public locations. The attacker relies on the victim finding the device and inserting it into their computer, thereby executing the malicious payload. The Social Engineering Toolkit (SET) is specifically designed to create such malicious payloads and facilitate the setup for baiting attacks, making it a direct match for this technique.

When an snmpwalk command successfully retrieves data using common or default community strings, it signifies that the device's SNMP agent is configured insecurely. This allows an attacker to access extensive Management Information Base (MIB) data, which frequently includes critical system details, network interface configurations, routing tables, and even potentially sensitive user account information. Such information leakage provides valuable reconnaissance for further targeted attacks.

Cross-Site Scripting (XSS) occurs when a web application incorporates untrusted data into a web page without proper validation or encoding, allowing attackers to inject client-side scripts. In the case of reflected XSS, the malicious script is immediately returned by the web server in its response and executed by the user's browser, directly impacting the content displayed to the user. This vulnerability directly manifests as unsanitized input being rendered in the browser.

Sniffing network traffic is a fundamental component of the CHPSET (Cracking, Hiding, Planting, Sniffing, Executing, Erasing) methodology, specifically corresponding to the 'Sniffing' phase. This involves passively capturing and analyzing data packets traversing a network segment to intercept sensitive information such as credentials, session tokens, or proprietary data. Attackers utilize tools like Wireshark or tcpdump to monitor network communications, gaining insights into network topology and identifying potential vulnerabilities for further exploitation.

Worms are a distinct category of malware known for their ability to self-replicate and propagate independently across computer networks without requiring user interaction. They exploit vulnerabilities in network protocols or services to spread from one system to another, consuming bandwidth and system resources. This autonomous replication is their defining characteristic, enabling rapid and widespread infection.

An SSRF vulnerability allows an attacker to manipulate a vulnerable server-side application into making arbitrary requests to internal network resources on behalf of the attacker. In cloud environments, this is critically dangerous as it can be leveraged to query the cloud provider's instance metadata service, typically found at a well-known, non-routable IP address like 169.254.169.254. Accessing this service often reveals temporary IAM credentials, instance profiles, and other sensitive configuration data, leading to privilege escalation or data exfiltration within the cloud infrastructure.

Installing a rootkit is a highly effective technique for covering an attacker's tracks by providing stealthy, persistent access. Rootkits are designed to modify the operating system's core functions, either at the kernel or userland level, to conceal files, processes, network connections, and other malicious artifacts from legitimate system utilities and security software. This sophisticated level of hiding allows an attacker to maintain a covert presence, making detection extremely challenging for administrators and forensic analysts.

Insecure MQTT (Message Queuing Telemetry Transport) protocol exploitation via default credentials is a common and critical vulnerability in IoT deployments. Many MQTT brokers are configured with weak or absent authentication, or rely on easily guessable default usernames and passwords. An attacker exploiting these weaknesses can subscribe to all topics, publish malicious commands, exfiltrate sensitive data, and gain unauthorized control over connected IoT devices, directly aligning with active exploitation behavior.

Phishing is a broad social engineering technique characterized by mass-distributed, generic fraudulent communications, typically via email, designed to trick recipients into revealing sensitive information like login credentials, credit card numbers, or installing malware. These attacks often impersonate well-known entities such as banks, social media platforms, or online services, using urgent or alarming language to prompt immediate action. The email described, claiming to be from a bank and likely seeking credentials from a general user, perfectly aligns with the characteristics of a classic phishing campaign.

This option represents the most common and standard configuration for a modern web server. A single instance of web server software, such as Apache or Nginx, is typically configured to listen on both port 80 for unencrypted HTTP traffic and port 443 for secure HTTPS communication. The Nmap output identifying the same server version on both ports directly supports this interpretation, as the server handles both protocols from a unified configuration.

Setting up a rogue RADIUS server is a highly effective attack against WPA2-Enterprise networks. By impersonating the legitimate authentication server, the rogue RADIUS server can trick clients into authenticating against it. During this process, it captures the challenge-response hashes, such as NTLMv2 hashes from PEAP/MSCHAPv2, which are exchanged during the EAP authentication phase. These captured hashes can then be subjected to efficient offline dictionary or brute-force attacks to recover the actual user credentials, providing unauthorized access.

Pretexting is a highly targeted social engineering technique where an attacker creates a fabricated scenario or 'pretext' to manipulate a victim into divulging sensitive information or performing an action. This often involves extensive research to develop a believable false identity and backstory, making the attacker appear legitimate and authoritative during direct interactions like phone calls. The tester's action of calling with a false identity to extract information perfectly aligns with this method's characteristics.

Reflected XSS occurs when a malicious script injected into an HTTP request is immediately returned in the server's HTTP response without being permanently stored. The payload is non-persistent, executing only once in the victim's browser as part of that specific request and response cycle. The observation that the application 'reflects' the input directly aligns with this immediate, one-time execution characteristic, making it the correct answer.

This option directly addresses data confidentiality for Zigbee communications within the smart building. The Zigbee security suite, specifically utilizing AES-128 symmetric encryption, encrypts data packets exchanged between sensor devices and the coordinator. This prevents unauthorized eavesdropping and ensures the privacy of sensitive sensor readings, which is crucial for maintaining the security and integrity of the smart building's operational data.

Implementing client authentication ensures that only authorized IoT devices can connect to the MQTT broker, preventing unauthorized actors from publishing or subscribing to sensitive data streams. Concurrently, enabling TLS encryption secures the communication channel itself, protecting all data transmitted between devices and the broker from eavesdropping, tampering, and man-in-the-middle attacks. This combination establishes robust confidentiality, integrity, and access control for MQTT communications, directly addressing the core security vulnerabilities.

Filtered indicates that no response was received, typically because a firewall dropped the packet.

This is the most common and impactful exploitation path for SSRF when targeting cloud environments. Cloud providers like AWS, GCP, and Azure expose local metadata services (e.g., http://169.254.169.254 for AWS EC2) that provide critical information about the running instance, including temporary security credentials (IAM roles), network configuration, and user data. By leveraging SSRF to access these endpoints, an attacker can obtain sensitive credentials, potentially escalating privileges and gaining access to other cloud resources.

John the Ripper is a robust, open-source password cracking utility widely recognized for its versatility in performing dictionary attacks against a multitude of hash types. It can efficiently process password hashes, including NTLM and LM hashes commonly found in Windows environments and potentially extracted or identified through SMB enumeration tools like enum4linux. Its extensive wordlist support and customizable rules make it an ideal choice for attempting to crack enumerated user passwords via dictionary attack.

This is the correct answer because while HTTPS encrypts data in transit between the client and server, it does not inherently encrypt data at the application layer before it is sent or when it is stored. If sensitive fields are not encrypted by the application itself, they could be exposed in memory, logs, or databases on the server side, even if the network communication is secure. The application's failure to encrypt sensitive data before processing or storage creates a vulnerability independent of transport security.

Googledork is a specialized utility explicitly engineered to automate the process of Google Hacking, commonly known as Google Dorking. This tool systematically generates and executes advanced search queries (dorks) against the Google search engine, leveraging specific operators like site:, filetype:, intitle:, and inurl: to discover exposed sensitive files, misconfigured servers, login pages, and other vulnerable information indexed by Google. Its core function is to streamline the identification of security weaknesses through targeted search engine exploitation, making it the correct answer.

Passive OS fingerprinting analyzes network traffic that has already been captured or is passively observed, without sending any new packets to the target. Tools like p0f examine characteristics within TCP/IP headers, such as initial Time-To-Live (TTL) values, window sizes, Don't Fragment (DF) bit settings, and TCP options, to infer the operating system. This method is highly stealthy as it leaves no trace on the target system, making it ideal for undetected reconnaissance.

Static analysis involves examining malware without executing it, focusing on its internal structure and potential functionality. This method includes disassembling the executable, analyzing strings, inspecting header information, and reviewing embedded resources to infer the malware's capabilities, target APIs, and potential network indicators. It provides insights into the code logic and design before dynamic execution.

When the IP address returned by a DNS query for a specific domain name differs from the legitimate server's actual IP, it is a primary indicator of DNS spoofing. An attacker has successfully intercepted or poisoned the DNS resolution process, substituting the correct IP with a malicious one. This manipulation ensures that subsequent client connections intended for the legitimate domain are instead directed to the attacker-controlled host.

This precisely defines Server-Side Request Forgery (SSRF), a vulnerability where a web application is tricked into making HTTP requests to an attacker-specified location. The server, acting on behalf of the attacker, can then access internal network resources, metadata services, or other systems that are typically inaccessible from the external internet. This allows for internal network reconnaissance, port scanning, and potential data exfiltration by bypassing firewall restrictions.

Exploitation involves leveraging identified vulnerabilities to achieve a specific objective, such as gaining unauthorized access, escalating privileges, or exfiltrating sensitive data. Burp Suite Repeater is an indispensable tool for this phase, allowing testers to meticulously modify request parameters, headers, or body content with crafted payloads. This precision enables the confirmation and exploitation of vulnerabilities like SQL injection, cross-site scripting, or authentication bypasses by observing the server's direct, often vulnerable, responses.

Unrestricted file upload is the correct answer because it directly describes the vulnerability where a web application allows users to upload files without adequately validating their type, size, or content. This critical flaw enables an attacker to upload malicious files, such as web shells or scripts, to the server. Once uploaded, these files can often be executed by the web server, leading to severe consequences like remote code execution, server compromise, or defacement.

Erasing tracks, also known as covering tracks or anti-forensics, is a post-exploitation phase where an attacker attempts to remove or alter evidence of their presence and activities on a compromised system. Clearing Windows event logs is a quintessential example of this technique, as it directly eliminates critical forensic data that incident responders rely on to understand the attack timeline, methods, and scope. This action aims to hinder detection and attribution, making it significantly harder for security teams to reconstruct the incident.

Whaling is a highly sophisticated form of phishing specifically designed to target high-profile individuals within an organization, such as CEOs, CFOs, or other senior executives. Attackers meticulously craft personalized emails, often impersonating a trusted entity or a critical business contact, to trick these high-value targets into divulging sensitive information or authorizing fraudulent transactions. The objective is typically significant financial gain or access to critical corporate data, leveraging the executive's authority and access.

The 'filtered' state in an Nmap SYN scan is a critical indicator that the probe packet sent by Nmap did not receive any response from the target host. This typically occurs when a network filtering device, such as a firewall, an Intrusion Detection System (IDS), or an access control list (ACL) on a router, intercepts and drops the SYN packet. Consequently, Nmap cannot determine if the port is open or closed because the communication path is obstructed.

The -f flag enables packet fragmentation, splitting the TCP header across multiple small IP packets. This technique can bypass older or less sophisticated stateless firewalls and intrusion detection systems (IDS) that are not configured to reassemble fragmented packets before inspection. By breaking the packet into smaller, non-contiguous pieces, the firewall might only see incomplete headers or data, allowing the full packet to pass through undetected and reassemble at the target.

The bucket policy explicitly grants `s3:GetObject` permission to `Principal: "*"`, which signifies anonymous public access. This configuration allows any user on the internet, without authentication, to retrieve all objects stored within the S3 bucket. Such unrestricted read access poses a significant security risk, potentially exposing sensitive data to unauthorized parties and violating data privacy regulations.

Implementing client certificate authentication on AWS IoT Core mandates that all devices present a valid, trusted X.509 certificate to establish a secure, authenticated connection before publishing data. This cryptographic identity verification prevents unauthorized entities from injecting malicious PUT requests by ensuring only provisioned and registered sensors can interact with the platform. Revoking any unregistered client IDs further tightens security by invalidating any potential rogue or compromised credentials.

An idle scan (-sI) is highly effective for evading stateful firewalls because the attacker never directly sends packets to the target. Instead, it leverages a "zombie" host's IP ID sequence to infer open ports on the target. The target's firewall sees packets originating from the trusted zombie, which may already have legitimate traffic flowing, or simply doesn't see unsolicited probes from an unknown source. This indirect method allows the attacker to map the target's ports without revealing their own IP address, making detection and blocking by stateful firewalls significantly more challenging.

A fundamental feature of many Remote Access Trojans (RATs) is the establishment of a backdoor. This backdoor provides a covert method for the attacker to regain access to the compromised system, often bypassing standard authentication mechanisms like usernames and passwords. This ensures persistent control, even if the initial exploit vector is patched or the user changes credentials, facilitating long-term surveillance or data exfiltration.

The `snmpwalk` utility is specifically designed to query an SNMP agent and traverse its Management Information Base (MIB) tree. By sending a series of GETNEXT requests, it systematically retrieves all Object Identifiers (OIDs) and their corresponding values accessible through the agent. The `c public` argument specifies the community string "public," which is a common default or weak credential used to gain read-only access for enumeration purposes. This command effectively maps the device's configuration and status information.

When a security engineer observes repeated log entries indicating unauthorized activity, an attacker's immediate priority after gaining access is often to eliminate or alter these digital footprints. Erasing tracks involves anti-forensic techniques like clearing event logs, modifying timestamps, or injecting benign entries to obscure malicious actions. This critical step aims to delay detection, complicate incident response, and prevent security personnel from understanding the full scope of the breach.

enum4linux is a powerful Perl script specifically designed for enumerating information from Windows and Samba hosts, making it ideal for SMB share enumeration during penetration tests. It consolidates multiple SMB-specific enumeration techniques, including querying for user lists, group memberships, operating system information, and crucially, listing available SMB shares and their permissions. This tool leverages protocols like NetBIOS and SMB to gather comprehensive details, providing a focused and efficient approach to discovering shared resources.

The 'python macof' command correctly executes a MAC flooding attack. This attack rapidly generates and sends frames with unique, spoofed source MAC addresses, overwhelming the switch's Content Addressable Memory (CAM) table. Once the CAM table is full, the switch enters a 'fail-open' mode, behaving like a hub by broadcasting all incoming traffic to every port, thereby enabling an attacker to sniff network traffic.

Masscan is purpose-built for extremely high-speed network scanning, capable of scanning the entire internet in minutes by operating asynchronously and sending raw packets. Unlike traditional scanners, it does not maintain a full TCP connection state, allowing it to saturate network links with SYN packets and quickly identify open ports across vast IP address ranges. This stateless, raw packet approach makes it the optimal choice for rapid, large-scale port discovery when speed is the paramount requirement.

Spoofed ICMP to broadcast address causing amplification.

The `nbtstat` command is a dedicated utility for diagnosing and troubleshooting NetBIOS over TCP/IP (NBT) name resolution issues and displaying NetBIOS name table information. When executed with the `-a` (adapter status) or `-A` (adapter status by IP address) switch followed by an IP address, `nbtstat` queries the remote machine for its NetBIOS name table. This process reveals registered names, services, and often MAC addresses, directly constituting NetBIOS enumeration and making it the correct answer.

Hiding files is a crucial post-exploitation activity within the system hacking methodology, designed to conceal malicious tools, backdoors, rootkits, or exfiltrated data on a compromised system. This action ensures the attacker's continued access and persistence by making their presence difficult for defenders to detect through standard system monitoring. It is a fundamental technique for maintaining a covert foothold and preventing the discovery of persistent mechanisms.

Ettercap is a comprehensive and versatile suite specifically designed for Man-in-the-Middle attacks on switched LANs. It excels by implementing robust ARP spoofing to redirect traffic between two hosts through the attacker's machine, effectively placing itself in the middle. Beyond simple interception, Ettercap includes powerful plugins for active manipulation, such as DNS spoofing, content filtering, and packet injection, making it a primary tool for intercepting, analyzing, and altering network communications in real-time. Its integrated framework directly supports the actions needed for a successful MITM attack.

SMiShing is the precise term for a phishing attack conducted via Short Message Service (SMS) text messages. In this method, attackers send deceptive text messages, often containing malicious links or requests for personal information, to mobile phone users. The goal is to trick recipients into clicking links that install malware, redirect to fraudulent websites, or directly provide sensitive data, perfectly matching the described scenario of a text message claiming bank account issues.