Certified Ethical Hacker CEH (CEH) — Questions 826–900

Clearing event logs removes evidence of attacker activity. Using rootkits hides malicious processes and files. Both are standard covering tracks techniques.

The combination of hardcoded credentials and unexpected MQTT traffic suggests an attacker has used default credentials to compromise the device and is exfiltrating data via MQTT.

Phishing is a social engineering technique where attackers send fraudulent emails that appear to come from legitimate sources to trick recipients into revealing sensitive information.

Option B is correct because when both port 80 (HTTP) and port 443 (HTTPS) report the same Apache httpd version (2.4.41), it strongly indicates that the same web server process is listening on both ports. Apache httpd can be configured to handle both plain HTTP and TLS-encrypted HTTPS traffic simultaneously, typically using separate VirtualHost directives or a single configuration that binds to both ports. The identical version string makes it unlikely that two separate web server instances are running, as they would often differ in patch level or configuration.

Option B is correct because an SMB null session (connecting to IPC$ without credentials) can be used to query the SAM database via the SAMR protocol, allowing an attacker to enumerate local user accounts and groups on a Windows system. This technique exploits the default configuration of older Windows versions or improperly secured systems where the null session is not restricted.

Directory traversal (also known as path traversal) exploits insufficient input validation to access files outside the web root by using '..' sequences.

In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.

Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into divulging information. In this case, the tester falsely claims to be from the IT department working on a critical system update, which is a classic pretext to gain trust and obtain the employee's password. This differs from other social engineering types because it relies on a constructed identity and false narrative rather than a technical lure or direct exchange.

Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization. The script executes once and is not stored, distinguishing it from stored XSS. DOM-based XSS would involve client-side JavaScript manipulation without server reflection.

Identify vulnerability, find offset, generate shellcode, craft exploit, execute.

Option A is correct because Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.

MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Option B is correct because Nmap's SYN scan (-sS) sends a SYN packet to the target port. When the probe receives no response or an ICMP unreachable message (e.g., type 3 code 13), Nmap classifies the port as 'filtered'. This typically indicates a firewall, ACL, or network filter is dropping the packets, preventing Nmap from determining whether the port is open or closed.

169.254.169.254 is the metadata IP address for cloud providers like AWS. The attacker is trying to retrieve instance metadata, which may contain credentials (e.g., IAM role credentials).

John the Ripper is the most efficient tool for performing a dictionary attack against password hashes retrieved from a system, such as those obtained from the SAM database or via enum4linux. It supports a wide range of hash types and can be configured to use custom wordlists, making it ideal for cracking the 'sqlsvc' account password in an internal penetration test.

The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.

Googledork (also known as Google Dork) is a tool specifically designed to automate Google dorking queries, which use advanced search operators to find vulnerable web applications and sensitive information exposed in search results. It systematically executes predefined dork queries against Google's index to identify SQL injection points, exposed configuration files, login pages, and other security weaknesses, making it the correct choice for this task.

Passive OS fingerprinting (Option B) is correct because it analyzes captured network traffic—such as TCP/IP packet headers, TTL values, window sizes, and DF flags—to infer the remote host's operating system without sending any packets. This technique relies on subtle differences in how various OS stacks implement RFC 793, making it ideal for stealthy reconnaissance where no direct contact with the target is permitted.

Static analysis examines code without execution; dynamic analysis observes behavior in a sandbox.

Unexpected redirections to malicious sites and mismatches between domain names and resolved IPs are signs of DNS spoofing. A full switch CAM table indicates MAC flooding, ARP cache poisoning is separate, and high DNS query volumes could indicate an amplification attack.

SSRF occurs when an attacker can induce the server to make HTTP requests to internal or external resources. This can lead to accessing internal services (e.g., cloud metadata endpoints) that are not normally accessible from the outside.

Maintaining Access is a recognized phase in the Ethical Hacking process, as defined by the EC-Council's CEH methodology. After gaining initial access, the ethical hacker must establish persistent access to the target system, often by installing backdoors, rootkits, or creating user accounts. This phase ensures the hacker can return to the system without repeating the exploitation steps, which is critical for simulating a real attacker's long-term presence.

Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.

Unrestricted file upload vulnerabilities allow attackers to upload executable files if the server does not validate the file type or execute permissions.

Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

Option C (http-malware-host) is correct because it checks the internal host's DNS cache or HTTP traffic against known malware domains, which can reveal if the outbound HTTPS connection is to a command-and-control server. Since the traffic is on port 443 (HTTPS), this script can identify malicious destinations without decrypting the traffic, making it ideal for confirming a reverse shell scenario.

Whaling targets high-profile individuals (e.g., CEO) with a crafted message.

In Nmap, a 'filtered' port status indicates that the port is being blocked by a firewall, IDS, or other network filtering device, preventing the probe from reaching the target service. The -sS (SYN stealth scan) sends a SYN packet; if no response is received or an ICMP unreachable (type 3, code 13) is returned, Nmap marks the port as filtered. This does not mean the port is open or closed—it means the scan could not determine the state due to filtering.

Option B is correct because the -f flag fragments packets into smaller 8-byte chunks, which can evade simple firewall rules that inspect packet headers for known signatures or block oversized packets. Option E is correct because the -D flag performs a decoy scan by spoofing multiple source IP addresses, making it difficult for a firewall to identify the true scanning host and block it.

The policy allows anyone (Principal: *) to read any object in the bucket, making it publicly accessible and a common misconfiguration.

Option B is correct because the attack exploits weak authentication on MQTT connections to AWS IoT Core. By implementing client certificate authentication, you ensure only registered devices with valid X.509 certificates can publish data, directly blocking the malicious PUT requests and write spikes. Revoking unregistered client IDs eliminates the invalid client IDs observed in the MQTT broker logs, closing the primary attack vector without disrupting legitimate sensor traffic.

Shodan is a search engine for internet-connected devices. It indexes banners from services like HTTP, SSH, and FTP, allowing security assessors to identify exposed industrial control systems (ICS) such as SCADA devices. Discovering ICS with default passwords is a legitimate reconnaissance use because it helps assess the security posture of critical infrastructure without active exploitation.

A Remote Access Trojan (RAT) is designed to provide an attacker with covert remote control over an infected system, often including a backdoor to bypass standard authentication mechanisms. This allows the attacker to execute commands, exfiltrate data, or use the system as a pivot point, which directly aligns with options D and E.

The `snmpwalk` command is used to retrieve a subtree of management information from an SNMP agent. By specifying `-c public` (the community string) and `-v2c` (SNMP version 2c), the command performs a GETNEXT request cycle to walk the entire MIB tree, enumerating all accessible OIDs and their values. Option D correctly identifies this as enumerating the MIB tree using the 'public' community string.

The correct answer is that the bucket policy or ACL is set to 'Everyone' with write permissions, a common misconfiguration leading to data exposure.

Ransomware specifically encrypts files and demands ransom. Other malware types may steal data or display ads but do not encrypt files for ransom.

CHPSET stands for Cracking, Hiding, Privilege escalation, Executing applications, Spying, Erasing tracks. Erasing tracks is the last phase, where attackers remove evidence of their activity.

enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.

Macof is a tool used to perform MAC flooding, which fills the switch's CAM table with fake MAC addresses, causing the switch to fail open and flood frames out all ports, enabling packet sniffing.

Masscan is the most suitable tool for this task because it is designed specifically for high-speed scanning of large address spaces, such as a /16 subnet (65,536 hosts). It uses asynchronous transmission and can send packets at rates exceeding 10 million packets per second, making it significantly faster than Nmap for raw host discovery across massive ranges.

Smurf attack sends ICMP echo requests to a broadcast address with the source IP spoofed as the victim, causing all hosts on the subnet to reply to the victim.

With full admin privileges, the tester can attempt to enumerate and abuse the permissions, such as creating users, accessing data, or escalating privileges further.

The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.

CHPSET: Cracking, Hiding, Privilege escalation, Executing, Spying, Erasing tracks. Hiding files involves techniques like ADS or steganography to conceal malicious files.

Ettercap includes a DNS spoofing plugin that allows the attacker to redirect DNS requests to arbitrary IP addresses.

Pretexting is a social engineering attack where the attacker creates a fabricated scenario (pretext) to impersonate an authority figure, colleague, or trusted entity in order to extract sensitive information. It relies on impersonation because the attacker assumes a false identity, such as a help desk technician or law enforcement officer, to gain the victim's trust and compliance.

SMiShing (SMS phishing) uses text messages to trick victims into clicking malicious links or providing personal information.

Scrubbing centers filter malicious traffic and forward clean traffic to the target, handling high-volume attacks effectively.

The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.

If a user has sudo rights to run vim as root, they can escape to a shell by typing `:!bash` within vim, gaining a root shell. This is a known sudo privilege escalation vector.

DNS amplification attack uses small queries to generate large responses, overwhelming the victim. The large response sizes and unusual outgoing queries from a single host indicate the host is being used as an amplifier in a DDoS attack.

enum4linux is a tool for enumerating SMB (Server Message Block) services on Windows. Disclosing usernames can enable attackers to perform password guessing or brute‑force attacks.

A file virus infects executable files and spreads when the infected file is executed. Worms spread without human action; Trojans disguise as legitimate software; ransomware encrypts files.

Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

Static analysis examines the malware without executing it. Strings, PEiD, and VirusTotal scan are static techniques.

Using comments or alternative encoding can bypass WAF rules. Inline comments like '/**/' can break up keywords.

A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

This is a classic indicator of an Insecure Direct Object Reference (IDOR) vulnerability, where an attacker can enumerate valid IDs by observing differences in responses.

Option D is correct because querying WHOIS databases is a passive reconnaissance technique that retrieves publicly available domain registration information (e.g., registrar, creation/expiration dates, name servers, and administrative contacts) without sending any packets to the target's systems. This aligns with the goal of gathering information without direct interaction, as defined in the CEH footprinting phase.

XXE can be used for reading local files (e.g., /etc/passwd), performing SSRF by making the server issue requests, and causing denial of service (e.g., billion laughs attack).

Rate limiting on the login endpoint is the best defense because it directly restricts the number of requests an attacker can send over a given time window, making brute-force attacks impractical. Unlike reactive measures like account lockout, rate limiting proactively throttles traffic at the network or application layer, preventing the attacker from even attempting many guesses. This approach is effective against distributed brute-force attacks where lockout policies can be bypassed by rotating IP addresses.

The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

WHOIS queries retrieve domain registration records from public databases like whois.iana.org or RDAP servers. Since the target server is never contacted directly — only public registries are queried — no packets are sent to the target's infrastructure, making it a purely passive reconnaissance technique.

Rate limiting on DNS servers limits the number of responses per source, reducing the impact of amplification. Scrubbing centers and anycast help with volumetric attacks, but rate limiting directly addresses amplification.

A polymorphic virus changes its code signature (using encryption/decryption) each time it replicates to evade signature-based detection, while retaining its functionality.

Whaling targets high-profile individuals like CEOs with personalized phishing emails. Spear phishing also targets specific individuals but not necessarily executives.

The request uses '../' to traverse directories (directory traversal) and attempts to read the /etc/passwd file, which is also a local file inclusion (LFI) attempt if the application includes files.

A RAT (Remote Access Trojan) allows an attacker to remotely control the infected system. The description of a hidden process connecting to a remote server for full control is characteristic of a RAT.

The correct answer is C because the combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.

Option B is correct. The SMTP VRFY command is used to verify if a user exists on the server, enabling user enumeration.

The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.

smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Windows file shares. It can list available shares with the `-L` option and, with valid credentials, enumerate users via the `-U` flag or by browsing the IPC$ share. This makes it a direct tool for SMB enumeration.

Option D is correct because the VRFY command asks the mail server to verify whether a given email address exists, EXPN expands a mailing list to reveal individual addresses, and RCPT TO (used in the SMTP transaction) can also be used to check address validity by observing the server's response. Together, these commands allow an attacker to enumerate valid email accounts on the server.