Certified Ethical Hacker CEH (CEH) — Questions 751–825

Option D is correct because the Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

The USB Rubber Ducky is a device that acts as a keyboard and can execute keystroke injection attacks. The other tools are not specifically designed for this purpose.

Option C is correct because many IoT devices ship with default usernames and passwords (e.g., 'admin/admin') or hard-coded credentials embedded in firmware. Attackers can easily discover these through simple web searches or Shodan scans, then gain unauthorized access to the device and potentially the entire network.

A worm is a standalone malware that replicates itself to spread to other computers, often via network vulnerabilities.

The hping3 command with the -S flag sends TCP SYN packets to port 80 on 10.0.0.1. Receiving SYN-ACK replies indicates that the target responded with the second step of the TCP three-way handshake, which only occurs when the port is open and listening. This confirms that port 80 is open on the target host.

A Smurf attack sends a spoofed ICMP echo request to the broadcast address with the victim's IP as the source, causing all hosts to reply to the victim. The other options do not fit this description.

LFI can lead to remote code execution (via log poisoning), local file disclosure (e.g., /etc/passwd), and session hijacking (by including session files). Port scanning is not a direct impact of file inclusion.

SameSite=Strict prevents the browser from sending cookies for cross-site requests, which blocks CSRF attacks.

These are the five phases of ethical hacking as per EC-Council.

CSRF tokens are the most effective defense because they are unique, unpredictable values embedded in each form or request that the server validates. Without a valid token, the server rejects the request, preventing an attacker from forging a legitimate user's action even if the victim is authenticated.

This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.

The VRFY command in SMTP (RFC 821) asks the server to verify whether a mailbox exists. A response starting with '252' indicates the user is valid, while '550 5.1.1' means the user does not exist. By comparing these responses, the attacker can enumerate valid usernames on the mail server, which is exactly what the output shows.

Option C is correct because the absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

The command `hping3 -S -p 80 --flood 192.168.1.100` sends a high volume of TCP SYN packets to port 80 of the target without completing the three-way handshake. The `--flood` flag disables packet rate limiting, causing a rapid stream of SYN packets that exhausts the target's connection queue, effectively performing a SYN flood denial-of-service (DoS) attack against the web server.

DDoS mitigation strategies include rate limiting, using scrubbing centers, and anycast routing to distribute traffic.

Option A is correct. Ophcrack is specifically designed to crack LM and NTLM hashes using rainbow tables. John the Ripper and Hashcat are also good but Ophcrack is optimized for Windows hashes and precomputed tables.

Adware displays unwanted advertisements and often comes bundled with other software, causing system slowdowns and pop-ups. Spyware may also cause ads but focuses on data theft. Ransomware encrypts files, and a worm spreads without user interaction.

enum4linux and smbclient are tools that interact with SMB/CIFS services to enumerate shares, users, and other information. John the Ripper is a password cracker, Nmap is a port scanner (can perform SMB enumeration via scripts but is not specifically designed for it), and SNMPwalk is for SNMP.

Tailgating (or piggybacking) is when an unauthorized person follows an authorized person into a restricted area without proper authentication.

B is correct because a Slowloris DDoS attack works by opening many connections to a target web server and keeping them open for as long as possible, sending partial HTTP requests to tie up server resources. This results in normal traffic volume but with connections that remain open for extended periods, preventing legitimate users from connecting.

The commands VRFY and EXPN are SMTP (Simple Mail Transfer Protocol) commands defined in RFC 821 and RFC 5321. VRFY is used to verify whether a mailbox exists on the server, while EXPN expands a mailing list alias to reveal its members. Since the tester connected to port 25 (the default SMTP port) and issued these commands, SMTP is the protocol being targeted.

Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where rainbow tables allow rapid reversal of hashes without brute-forcing each password individually. This makes it the correct choice for the scenario described.

First check rules, add drop rule, verify, save, then test.

HTTP response splitting requires that attacker input is reflected in the response headers (e.g., via CRLF injection). The application must not sanitize CRLF sequences. The attacker can then inject headers to separate the response into two HTTP responses, enabling cache poisoning or XSS.

SMiShing is phishing via SMS text messages.

A brute force attack systematically tries every possible combination of characters until the correct password is found. This is a fundamental technique in the password cracking phase, often used when no prior knowledge of the password exists. It is computationally expensive but guaranteed to succeed given enough time.

SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.

Macof is a tool used for MAC flooding, which fills the switch's CAM table with fake MAC addresses, causing it to fail open and broadcast traffic to all ports.

Pacu is an exploitation framework for AWS, used after initial access to escalate privileges, pivot, and maintain access. It is not typically used for initial reconnaissance (Nmap, ScoutSuite) or reporting.

Banner grabbing is a technique used to extract service banners that often include software name and version details. The primary purpose is to determine the version of a running service, as this information allows an attacker to identify known vulnerabilities specific to that version for further exploitation.

Prepared statements (parameterized queries) and stored procedures (if properly parameterized) prevent SQL injection by separating data from code.

Phishing is the broad category of sending fraudulent emails to trick recipients. Using SET for email campaigns is a common phishing technique.

Differential cryptanalysis is a chosen-plaintext attack that analyzes how differences in plaintext pairs affect the resulting ciphertext differences, exploiting statistical biases to recover the encryption key. It is a fundamental cryptanalytic technique, particularly effective against block ciphers like DES.

Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.

Option B is correct because the command `nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24` performs a TCP SYN scan (`-sS`) on only the four specified ports, enables service version detection (`-sV`), and attempts OS fingerprinting (`-O`). This is a stealthy half-open scan that does not complete the TCP three-way handshake, combined with banner grabbing and OS detection, limited to the given port list.

A Server-Side Request Forgery (SSRF) attack occurs when an attacker manipulates a vulnerable server into making HTTP requests to arbitrary destinations, often bypassing network segmentation to access internal resources (e.g., 127.0.0.1, RFC 1918 addresses) or external services. The server acts as a proxy, allowing the attacker to interact with systems that are not directly reachable, such as cloud metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/) or internal databases.

ARP spoofing (or ARP poisoning) involves sending forged ARP replies to associate the attacker's MAC with the IP of a legitimate host (here, the gateway). This enables MITM attacks.

Boot, mount, navigate, replace file, reboot to exploit.

Option B is correct because OSINT sources like Shodan and social media provide publicly available information without interacting with the target's systems, keeping the reconnaissance passive and undetected. Option C is correct because passive reconnaissance via DNS records (e.g., using cached or third-party DNS databases) avoids querying the target's authoritative DNS servers, thus not generating logs or alerts on the target's infrastructure.

Injection (A03:2021) covers various injection flaws, including Remote File Inclusion (RFI). RFI is a type of injection where user input is used to include a remote file, leading to code execution.

Option C is correct because gelatin molds can replicate the exact ridge and valley patterns of a fingerprint, which many capacitive and optical fingerprint scanners read. This bypasses the biometric authentication without requiring the user's cooperation, making it the most direct method to defeat the scanner itself.

Deauthentication attacks force clients to reconnect, allowing capture of the WPA/WPA2 4-way handshake during reconnection, which is needed for offline cracking.

MAC flooding sends many Ethernet frames with different source MAC addresses to fill the switch's CAM table, forcing it into hub mode (flooding all traffic).

Option B is correct because it addresses both weaknesses: a mantrap prevents tailgating at the main entrance (physical security), and requiring MFA for password reset requests mitigates the social engineering attack by adding an authentication factor beyond just a phone call. This combination directly counters the observed vulnerabilities—unattended reception and weak identity verification—without over-engineering or leaving gaps.

--dbs enumerates database names; --batch uses default options without interactive input.

Scrubbing centers filter malicious traffic, rate limiting reduces impact, and anycast distribution spreads traffic across multiple servers. Blackholing drops all traffic (including legitimate), and IP spoofing is an attack technique.

Restricting zone transfers to authorized IP addresses only is the most effective countermeasure because it directly controls which DNS servers are allowed to request a full copy of the zone data. By configuring an allow-transfer list (e.g., using the 'allow-transfer { trusted_servers; };' directive in BIND), the primary DNS server will reject zone transfer requests from any unauthorized IP, preventing attackers from enumerating all DNS records.

Burp Proxy is the component that intercepts and allows modification of requests/responses in transit.

With 'public' (read-only) access, the analyst can read MIB values (SNMPwalk) and enumerate system information using tools like snmpcheck. Writing is not possible with read-only community.

SSRF can allow access to internal services (like metadata endpoints) and potentially lead to remote code execution if internal services are compromised.

OSINT (Open Source Intelligence) using WHOIS queries is a passive reconnaissance technique that gathers domain registration details from public WHOIS databases without interacting with the target's systems. This aligns with the requirement to use public records and avoid direct contact, making it the correct choice for footprinting.

Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.

The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.

NetBIOS enumeration (nbtstat) and SMB enumeration (enum4linux, smbclient) are both Windows-oriented. LDAP enumeration is for directory services, not exclusively Windows; SMTP is mail; NFS is Unix/Linux.

WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

Option B is correct because the scenario describes a Windows service executable with weak file permissions that allow the 'Everyone' group to modify it. This directly enables an attacker to replace the legitimate executable with a malicious one, which will then be executed with SYSTEM privileges when the service starts. This is the classic 'weak service binary permissions' privilege escalation vector, often exploited using tools like `icacls` or `accesschk` to identify the vulnerability.

-sU performs a UDP scan, -sV attempts service version detection on the specified UDP ports (53=DNS, 161=SNMP, 162=SNMP trap).

A downgrade attack occurs when an attacker forces the client and server to negotiate a lower, less secure version of a protocol (e.g., from TLS 1.2 to TLS 1.0) to exploit vulnerabilities in the older version.

The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.

The firewall log shows user jdoe accessing a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not on the usual file server subnet. This indicates the attacker has physically entered the building or restricted area by following an authorized person (tailgating) and then connected a rogue device to the internal network to perform lateral movement. Tailgating is the social engineering attack that relies on gaining physical access by exploiting trust or courtesy, which aligns with the unauthorized internal IP and SMB activity.

Log manipulation is the act of altering or deleting log entries to hide evidence of an intrusion. This is part of the covering tracks phase.

A de-authentication attack targets the management frames in IEEE 802.11 wireless networks. An attacker sends forged de-authentication frames to disconnect a client from an access point, often as a precursor to capturing the WPA handshake or launching an evil twin attack. This is a wireless-specific attack because it exploits the unencrypted nature of 802.11 management frames.

Token impersonation is the correct technique because it allows an attacker to steal or duplicate an access token from a process running with SYSTEM privileges. Once the attacker has a token with SYSTEM integrity level, they can use Windows API calls such as ImpersonateLoggedOnUser or DuplicateTokenEx to execute code in the security context of that token, effectively escalating privileges to SYSTEM.

Baiting involves leaving a physical device (e.g., USB drive) in a location where the victim will find and use it, often with enticing labels.

The SNMP community strings 'public' and 'private' are default read-only and read-write credentials defined in SNMPv1 and SNMPv2c. An attacker who can SNMPwalk the device with these strings can enumerate the entire MIB tree, including system configuration, routing tables, interface details, and user accounts. This directly exposes sensitive configuration information, making C the primary concern.

Option C is correct because the scenario describes a classic reflected Cross-Site Scripting (XSS) vulnerability. The application accepts user input and displays it directly in the browser without sanitization, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. This is the defining characteristic of XSS, not SQL injection or command injection, which target server-side interpreters.

B is correct because 'Hiding files' is a key phase in the CHPSET (Cracking, Hiding, Privilege Escalation, Sniffing, Executing, Targeting) system hacking methodology. After gaining access and escalating privileges, the attacker must hide malicious files, processes, or evidence to avoid detection by security tools or administrators. This step often involves techniques like file attribute manipulation, rootkits, or steganography to conceal the presence of the attacker on the compromised system.

Worms are standalone malware that replicate across networks autonomously, unlike viruses that require a host file.

SSRF occurs when an application fetches user-controlled URLs without proper validation. The attacker used it to access cloud metadata endpoints (like AWS IMDS) to retrieve temporary credentials.