Certified Ethical Hacker CEH (CEH) — Questions 826–870

Adding -f to fragment IP packets instructs Nmap to split the TCP header across multiple smaller IP packets. This technique, known as IP fragmentation, can bypass stateless firewalls and basic Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) that are not configured to reassemble fragmented packets before inspection. By scattering the critical header information, it becomes more challenging for signature-based detection mechanisms to identify the scan pattern, thus aiding in evasion.

This is a critical characteristic of DNS amplification. The attacker sends small DNS queries to numerous open DNS resolvers, but crafts these queries to appear as if they originated from the victim's IP address. This IP spoofing ensures that when the resolvers send their much larger responses, they are directed to the legitimate victim's network, effectively overwhelming their bandwidth and causing a denial of service. Without spoofing, the responses would return to the attacker, nullifying the amplification effect.

A worm is a standalone malicious program designed to self-replicate and propagate across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to spread autonomously, often scanning for vulnerable systems and then infecting them to continue their replication cycle. This independent self-replication and network-based propagation are their defining characteristics, allowing them to consume network bandwidth and system resources rapidly.

Server-Side Request Forgery (SSRF) occurs when a web application is tricked into making requests to an arbitrary domain specified by an attacker. This vulnerability allows an attacker to induce the server-side application to make HTTP requests to an attacker-specified location, potentially targeting internal networks, cloud metadata services, or other external systems. The server acts as a proxy for the attacker, bypassing network segmentation or firewall rules that might otherwise block direct access.

Shodan's core functionality involves actively scanning the internet to identify open ports and then performing banner grabbing to collect detailed information from exposed services. This includes service banners (e.g., HTTP server versions, SSH daemon versions), operating system details, geographic location, and other configuration metadata. This rich metadata allows penetration testers to quickly identify potential vulnerabilities, misconfigurations, and the specific technologies running on internet-facing assets, forming a critical part of the reconnaissance phase.

Hashcat is an advanced offline password recovery utility renowned for its unparalleled speed, primarily achieved through extensive GPU acceleration. It supports a vast array of hash types, including NTLM, MD5, SHA-1, and bcrypt, and offers diverse attack modes such as dictionary, brute-force, mask, and hybrid attacks. This makes it exceptionally effective for cracking password hashes extracted from compromised systems or databases, enabling rapid auditing of password security.

A buffer overflow writes data beyond the intended buffer's boundaries, corrupting adjacent memory. This corruption can overwrite critical program data, function pointers, or the stack frame itself. When the program attempts to access or execute corrupted instructions or data, it leads to an illegal memory access, triggering a segmentation fault or an unexpected program termination.

A WHOIS lookup is a fundamental footprinting technique that queries public databases to retrieve registration details for domain names and IP addresses. This process reveals critical information such as the domain owner's name, organization, contact email, physical address, registration and expiration dates, and associated DNS name servers. Such data is invaluable for identifying potential targets, understanding organizational structure, and mapping network infrastructure during the initial reconnaissance phase.

dnsrecon is a powerful DNS enumeration script that can query multiple record types and perform subdomain brute-forcing.

smbclient is a powerful command-line utility that acts as an SMB/CIFS client, similar to a Windows file explorer. It is specifically designed to interact with SMB servers, allowing users to list available shares on a target machine using the "-L" option, connect to specific shares, and browse, upload, or download files. Its direct capability to query and display network shares makes it the most appropriate tool for SMB enumeration.

TCP sequence prediction involves an attacker guessing the next valid sequence number in a TCP connection. If the sequence numbers are predictable, the attacker can inject crafted packets into an established session, effectively hijacking it. By successfully predicting and sending packets with the correct sequence and acknowledgment numbers, the attacker can impersonate one of the legitimate communication parties, taking control of the session without needing to intercept initial authentication. This allows for unauthorized command execution or data manipulation within the active session.

Pretexting is a sophisticated form of social engineering where an attacker invents a believable, fabricated scenario (a "pretext") to manipulate a target into divulging information or performing an action. This often involves extensive research to create a credible backstory, a false identity, and a plausible reason for the interaction, making the target believe they are interacting with someone authorized or legitimate. The scenario's description of an attacker calling and using a fabricated scenario directly aligns with the definition of pretexting.

Correct. Ping flood sends high volumes of ICMP echo requests directly to targets, often with spoofed source IPs, matching the alert.

SQLMap is the standard tool for automated SQL injection detection and exploitation.

Infrastructure as a Service (IaaS) provides virtualized computing resources, such as virtual machines, networks, and storage, granting users significant control over the operating system and installed software. In an IaaS model, users frequently deploy and manage their own containerized applications, often having direct access to the container runtime and the host operating system. This elevated level of control means a successful container escape directly compromises the host VM or underlying physical server, rendering IaaS the most susceptible cloud service model for such an attack.

The -f option instructs Nmap to fragment the IP packets into smaller, non-standard-sized pieces. This technique can bypass stateless firewalls or Intrusion Detection Systems (IDS) that only inspect the initial fragments, as critical header information (like TCP flags or port numbers) might be split across multiple segments. When the fragmented packets reach the target, the operating system reassembles them before processing, potentially allowing the scan to proceed undetected by intermediate network devices.

Slowloris keeps many connections open slowly to exhaust server resources.

A rainbow table attack utilizes a precomputed table of hash chains to reverse cryptographic hash functions efficiently. Instead of brute-forcing each hash, the attacker looks up the target hash within the table, which maps hashes back to their original plaintext passwords. This method exploits a time-memory tradeoff, allowing for rapid password recovery without needing to compute every possible password combination during the attack.

Implementing TLS/SSL (Transport Layer Security/Secure Sockets Layer) encryption for all camera communications establishes a robust, end-to-end secure channel. This protocol encrypts the entire data stream, including sensitive video feeds, audio, control commands, and metadata, protecting them from unauthorized interception, eavesdropping, and tampering as they traverse public or untrusted networks. TLS/SSL also provides server authentication, ensuring the camera communicates with the legitimate server, and data integrity verification, confirming the data has not been altered in transit.

Ettercap is a highly effective tool for executing Man-in-the-Middle attacks by performing ARP poisoning, which redirects network traffic through the attacker's machine. Wireshark then perfectly complements Ettercap by passively capturing and analyzing all the intercepted traffic that is now flowing through the attacker. This combination allows for both the successful interception of communications and the detailed examination of the data, making it ideal for a comprehensive MITM attack.

Performing a WHOIS lookup involves querying publicly available domain registration databases, such as those maintained by ICANN-accredited registrars. This process retrieves information like domain ownership, administrative contacts, technical contacts, and registration dates without sending any packets directly to the target's servers or network infrastructure. Since the interaction is solely with third-party public records, it is a quintessential passive reconnaissance technique, leaving no trace on the target system itself.

Running a container with the `--privileged` flag effectively disables most of the security features and isolation mechanisms provided by the container runtime. This flag grants the container nearly all capabilities of the host, including direct access to host devices (e.g., `/dev`), the ability to mount host filesystems, and full control over the kernel's capabilities (like `CAP_SYS_ADMIN`). These elevated privileges provide direct and straightforward vectors for a penetration tester to break out of the container and gain control over the host system.

Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files and directories stored outside the intended root directory by manipulating file paths. This is typically achieved by injecting sequences like `../` (dot-dot-slash) into input parameters, enabling navigation upwards in the directory hierarchy to read sensitive system files or application configuration.

Custom request headers like X-Requested-With serve as an effective CSRF defense by leveraging browser security mechanisms. Modern browsers, adhering to the Same-Origin Policy and CORS specifications, prevent attackers from arbitrarily adding or modifying such custom headers in simple cross-origin requests. The server can then validate the presence and expected value of this header, rejecting any request originating from an unauthorized domain that lacks the legitimate header. This ensures that only requests from the legitimate origin, which can set the header, are processed.

This method correctly leverages a common sudo misconfiguration where a user is permitted to execute /usr/bin/less with root privileges. Inside less, typing '!' allows the execution of arbitrary shell commands. Since less is running as root via sudo, any command executed through '!', such as !/bin/bash, will also inherit root privileges, effectively spawning a root shell.

Slowloris attacks aim to exhaust server resources by maintaining numerous open, incomplete HTTP connections. Implementing a strict connection timeout for idle or slow-sending connections will effectively terminate these malicious sessions before they can consume all available server sockets indefinitely. Additionally, rate limiting the number of new connections or requests from a single source IP can prevent an attacker from establishing a sufficient volume of connections to overwhelm the server's capacity, thus mitigating the attack.

Hiding files is a core activity within the "Maintaining Access" phase of system hacking, specifically represented by the 'H' in the CHIPSET acronym. This involves employing various techniques, such as rootkits, steganography, or manipulating file attributes and permissions, to conceal malicious tools, backdoors, or data staging areas from legitimate users, administrators, and security software, thereby ensuring persistence and operational secrecy on the compromised system.

Elliptic Curve Cryptography (ECC) is an asymmetric encryption algorithm that derives its security from the mathematical properties of elliptic curves over finite fields, specifically the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP). It provides a robust framework for public-key cryptography, including encryption, digital signatures, and key exchange. ECC is highly efficient, offering equivalent security to RSA with significantly smaller key sizes, making it particularly well-suited for resource-constrained environments like mobile devices.

MAC flooding involves overwhelming a switch's Content Addressable Memory (CAM) table (also known as MAC address table) with a multitude of forged source MAC addresses. When the CAM table becomes full, the switch can no longer store new legitimate MAC-to-port mappings. Consequently, for any new incoming frames destined for an unknown MAC address, the switch resorts to broadcasting the frames out of all ports, effectively degrading its functionality to that of a network hub. This allows an attacker to capture traffic intended for other hosts on the segment.

When user-supplied data is rendered back to a client, output encoding converts special characters (like <, >, &, ", ') into their entity equivalents (e.g., &lt;, &gt;). This process prevents the browser from interpreting these characters as active content or HTML tags, effectively neutralizing any embedded malicious scripts and ensuring they are displayed as harmless text rather than executed.

Password spraying is a targeted attack where an attacker attempts a small number of common passwords against a large list of usernames. This technique is specifically designed to bypass account lockout policies by distributing login attempts across many accounts, rather than repeatedly failing on a single account. By trying 'Password123!' on hundreds of accounts, the attacker significantly increases their chances of finding a valid credential without triggering security alerts for excessive failed logins on one user. This method is highly effective against organizations with weak password policies and large user bases.

Ophcrack is purpose-built for cracking Windows LM and NTLM hashes, leveraging precomputed rainbow tables for highly efficient password recovery. Its specialization allows it to quickly reverse these specific hash formats by performing a time-memory trade-off, making it exceptionally fast for common passwords. The tool comes with pre-generated tables, significantly reducing the computational effort required compared to on-the-fly cracking methods.

Spear phishing is a highly targeted form of email-based social engineering where attackers craft personalized messages for a specific individual, such as a security analyst. These emails often leverage specific knowledge about the target, their role, or their organization, making the lure appear highly credible and increasing the likelihood of the recipient falling victim. The goal is typically to trick the individual into revealing sensitive information, clicking a malicious link, or downloading an infected attachment, directly aligning with the scenario described.

A fundamental characteristic of polymorphic viruses is their sophisticated use of encryption to conceal their malicious payload. This encryption renders the core malicious code unreadable to static analysis tools, making it difficult to identify based on fixed patterns. Crucially, the virus dynamically generates a new, unique decryption routine with each replication, ensuring that even the decryption stub constantly changes, further evading signature-based detection.

IP fragmentation involves splitting larger packets into smaller fragments, each with its own IP header, before transmission. This technique is primarily used by attackers to bypass network intrusion detection systems (IDS) and firewalls that perform signature-based analysis on full packets. By fragmenting packets, the IDS may only see partial data or fail to reassemble the fragments correctly, thus missing malicious signatures or policy violations that would otherwise trigger an alert.

Static analysis involves examining a file's properties and contents without executing it. Running the `strings` command extracts printable character sequences, providing clues about embedded text, URLs, or file paths. Uploading to VirusTotal leverages a multitude of static analysis engines and reputation databases to identify known malware signatures and indicators of compromise, all performed on the file at rest.

Time-based blind SQL injection is a technique where an attacker infers information by observing the time it takes for the database to respond to a query. This method involves injecting SQL commands that include conditional statements (e.g., IF or CASE) combined with time-delay functions (e.g., SLEEP() or WAITFOR DELAY). If the condition is true, the database introduces a noticeable delay, allowing the attacker to deduce the truthfulness of a statement bit by bit, even without direct error messages or data output.

A successful DNS zone transfer, initiated by an AXFR query, occurs when an authoritative name server provides a complete copy of its entire DNS zone file. This typically happens due to a security misconfiguration where the server allows unrestricted transfers to unauthorized clients. The output received by the penetration tester, containing all DNS records for the domain, is the direct result of such a successful transfer, providing a comprehensive enumeration of the domain's infrastructure.

Static analysis examines the file's binary, strings, and metadata without execution.

The -f (fragment packets) option is a potent evasion technique that instructs Nmap to split the TCP header across multiple, smaller IP fragments. This fragmentation can bypass rudimentary packet filtering rules and some stateful firewalls or Intrusion Detection Systems (IDS) that may struggle to correctly reassemble or inspect fragmented packets. By breaking the standard packet structure, it makes signature-based detection more challenging for network security devices.

ldapsearch is the correct tool because it is specifically designed for querying LDAP (Lightweight Directory Access Protocol) directories. It enables penetration testers to perform anonymous or authenticated queries to enumerate directory objects, including users, groups, and their associated attributes. This utility directly interacts with LDAP servers to retrieve the precise information required for user and group enumeration.

This payload, <script>alert('XSS')</script>, is the most direct and effective proof-of-concept for demonstrating a reflected Cross-Site Scripting (XSS) vulnerability. When the User-Agent header containing this string is reflected unencoded into the HTML response generated by the web application, the browser interprets the <script> tags and executes the embedded JavaScript. The alert('XSS') function then triggers a pop-up box, visually confirming that arbitrary client-side script execution is possible within the victim's browser context.

SNMP agents can provide a comprehensive list of running processes on a managed device. This information is typically found within the Host Resources MIB (RFC 2790), specifically by querying objects like `hrSWRunTable`. This table contains details such as process ID, name, path, and current status, which is crucial for system monitoring and troubleshooting.

Exploiting a local privilege escalation vulnerability on the web server to gain SYSTEM access provides full control over the underlying operating system. With SYSTEM privileges, an attacker can access memory, registry hives, or log files where the SQL Server service account credentials are often stored or cached. Since the SQL Server service account typically holds sysadmin privileges on its own instance to perform its functions, these credentials can then be used to log into the database with the highest level of access.