Certified Ethical Hacker CEH (CEH) — Questions 826–900

Aircrack-ng reads the captured 4-way handshake (the PMKID or EAPOL exchange) and tests each candidate passphrase from the wordlist by deriving the PBKDF2 key and verifying the MIC, directly satisfying the dictionary-attack requirement against WPA2.

Polymorphic viruses are specifically designed with a mutation engine that generates a different, functionally identical variant of the virus body with each replication. This constant alteration of their code signature, including instruction sequences and encryption routines, makes it extremely challenging for traditional signature-based antivirus software to identify and block them. The primary goal of this mutation is to bypass detection mechanisms that rely on fixed patterns.

macof, a tool within the dsniff suite, is specifically engineered to execute MAC flooding attacks against network switches. It operates by rapidly generating and transmitting a massive number of Ethernet frames, each containing a unique, randomly generated source MAC address. This malicious activity aims to exhaust the switch's Content Addressable Memory (CAM) table, forcing the switch to enter a "fail-open" or "hub mode" state. In this state, the switch broadcasts all incoming traffic to every connected port, thereby allowing an attacker to passively sniff all network communications.

This is the precise definition of a password spraying attack. Attackers employ this technique by taking a small list of commonly used passwords (e.g., 'Password123', 'Summer2023!') and attempting each of these passwords against a large number of different user accounts within the same system. The primary goal is to avoid triggering account lockout thresholds, which are typically set per-account, by only attempting one or two passwords per user before moving on to the next account.

Querying the hash against an online repository like MalwareBazaar or VirusTotal's hash search allows the analyst to check if the file is known malware without uploading the file itself. This preserves confidentiality and provides quick results. If the hash matches a known sample, the analyst can obtain additional information such as family, behavior, and indicators of compromise.

Reflected XSS occurs when user input is included in the response to the same request without proper output encoding, causing the browser to execute it. The tester's observation that the parameter is echoed back and executes when the crafted link is opened is the defining characteristic of this type.

The `inurl:login` dork instructs Google to return results where the string "login" appears anywhere within the URL path or filename. Web developers commonly incorporate terms like "login," "signin," or "authenticate" into the URL structure to designate their authentication pages. This makes `inurl:login` a highly precise and efficient method for directly identifying and locating the entry points for user authentication within various web applications.

This scenario perfectly illustrates Server-Side Request Forgery (SSRF). The attacker manipulates a vulnerable web application to force the server itself to initiate HTTP requests to an arbitrary internal or external destination. In a cloud environment, targeting the internal metadata service (e.g., http://169.254.169.254/latest/meta-data/) is a common and critical SSRF exploitation technique, allowing the retrieval of sensitive information like IAM role credentials. This effectively turns the compromised server into a proxy for internal network reconnaissance and privilege escalation.

This is a classic example of a hybrid password attack, combining elements of a dictionary attack with a targeted brute-force component. By taking words from a dictionary file and systematically appending numerical sequences (e.g., 'password123', 'summer2024'), the attack efficiently targets common user password patterns that involve adding digits to memorable words. This method significantly expands the attack surface beyond a simple dictionary without resorting to a full, computationally expensive brute-force approach.

A Remote Access Trojan (RAT) like 'svch' establishes a covert communication channel, often a backdoor, allowing an attacker to remotely control the compromised system. It facilitates unauthorized access to files, execution of commands, and monitoring of user activity, effectively turning the victim's machine into a remote puppet. This capability to open a backdoor and send information is a hallmark of RAT functionality, enabling persistent and stealthy control.

Business email compromise (BEC) is a sophisticated scam where an attacker impersonates a high-level executive to trick employees into transferring funds or revealing sensitive information. In this case, the attacker spoofed the CEO's email to request payroll direct deposit changes. BEC often targets employees in finance, HR, or payroll who have the authority to act on such requests. The use of a credential harvesting link is a common BEC tactic to steal login credentials.

ScoutSuite is a multi-cloud auditing tool that queries provider APIs to enumerate configuration weaknesses across AWS, Azure, GCP and others. It satisfies the stem's auditing criterion by producing a security posture report without exploiting the environment.

enum4linux is a dedicated command-line tool specifically designed for enumerating information from Windows and Samba hosts using NetBIOS and SMB protocols. It effectively leverages null sessions and other SMB/RPC queries to extract a wealth of data, including user lists, group memberships, share names, OS version, service pack level, and even password policies. This makes it an ideal choice for detailed reconnaissance against Windows systems to uncover potential vulnerabilities and gather intelligence.

The "public" community string is the universally recognized and default read-only community string for SNMPv1 and SNMPv2c agents. This string allows an SNMP manager to query and retrieve various operational statistics and configuration details from a network device's Management Information Base (MIB) without the ability to alter any settings. Due to its widespread default configuration, "public" is frequently targeted by attackers seeking to gather network intelligence.

SQLMap automates SQL injection exploitation and database fingerprinting, satisfying the stem's requirement for both capabilities in one tool. It detects injection points, identifies the backend database management system, and extracts data through techniques such as boolean-blind, time-blind, error-based and union-based injection, removing the need for manual payload crafting during penetration tests.

Reaver is specifically designed to exploit the design flaw in Wi-Fi Protected Setup (WPS) by performing a brute-force attack against the WPS PIN. This 8-digit PIN, often split into two smaller, independently verifiable sections, significantly reduces the number of attempts required to guess it. Successful exploitation allows Reaver to recover the WPA/WPA2 Pre-Shared Key (PSK), granting unauthorized access to the network.

Using MQTT over TLS (Transport Layer Security), often referred to as MQTTS, is the standard and most effective method to secure MQTT communications against eavesdropping. TLS establishes an encrypted tunnel between the MQTT client and broker, ensuring that all data exchanged is confidential and cannot be read by unauthorized parties. Furthermore, TLS provides data integrity verification, preventing tampering, and offers server authentication through certificates, confirming the identity of the broker to the client.

A kernel-level rootkit operates within the operating system's kernel, granting it the highest level of privilege and control. By hooking system calls, specifically `read()` operations, the rootkit can intercept requests from the FIM agent to read the compromised binary. Instead of returning the modified, malicious content, the rootkit presents the *original*, untampered content of the binary to the FIM system. This sophisticated deception ensures that the FIM system calculates the expected hash, thus reporting no integrity violation, while the malicious binary continues to execute its payload.

An HTTP flood is a Layer 7 (Application Layer) Distributed Denial of Service (DDoS) attack that overwhelms a web server by sending a massive volume of legitimate-looking HTTP GET or POST requests. These requests consume the server's CPU, memory, and bandwidth resources, making it unable to respond to legitimate user traffic. Unlike lower-layer attacks, it targets the specific application protocol, mimicking normal user behavior to evade simple network-level defenses.

The Repeater tool in Burp Suite is specifically designed for manually modifying and reissuing individual HTTP requests. It allows security testers to fine-tune request parameters, headers, or body content and observe the server's response in real-time. This iterative process is crucial for exploring application logic, testing for specific vulnerabilities, or confirming exploit conditions step-by-step.

This statement is correct because, within the AWS shared responsibility model, the customer is solely responsible for the "security in the cloud." For S3, this explicitly includes defining and implementing appropriate access controls and permissions. This involves configuring S3 bucket policies, Access Control Lists (ACLs), and AWS Identity and Access Management (IAM) policies to restrict who can access, modify, or delete data within their S3 buckets. A misconfiguration in these controls directly leads to data exposure.

Credential stuffing is a highly effective attack where threat actors automate login attempts using large lists of username and password pairs previously compromised in data breaches from other services. If the web application allows valid usernames to be tested against these breached password lists without adequate detection or rate limiting, it becomes vulnerable to users who reuse their credentials across multiple platforms. This leverages the common user habit of password reuse.

Ettercap performs ARP poisoning to place itself between hosts and the DNS server, then intercepts DNS queries and returns forged replies, satisfying the local-network DNS spoofing requirement. Its integrated sniffing and filtering plugins make this man-in-the-middle attack practical without additional tooling.

The Nmap idle scan fundamentally relies on the zombie host's IP ID sequence incrementing predictably for each outgoing packet. If the zombie's IP ID sequence is not strictly incremental or is reset by unrelated network traffic, the attacker cannot reliably infer the target port's status. This predictability is crucial because the scan deduces open/closed ports based on whether the zombie's IP ID increments by one (indicating no RST from target) or by two (indicating a RST from target, causing the zombie to send a RST back).

Password spraying is a sophisticated attack technique where a small number of very common passwords are systematically tried against a *large number of different user accounts* or a single account from *many different IP addresses*. This method is specifically designed to evade account lockout thresholds by distributing attempts across many targets or sources, preventing any single account or IP from exceeding the lockout limit. The 'repeated login attempts' observed in logs align perfectly with this strategy, as attackers aim to find weak passwords without triggering immediate detection.

The presence of TKIP (Temporal Key Integrity Protocol) as the group cipher is indeed a significant security vulnerability. TKIP was designed as a transitional solution for WPA to bridge the gap from WEP, but it incorporates known weaknesses, including a flawed Message Integrity Code (MIC) and vulnerabilities in its key mixing function. Consequently, it has been deprecated by the IEEE 802.11i standard and should not be used in secure wireless networks.

This command queries Google's public resolver at 8.8.8.8 for the domain's MX records and displays only the answer section. The DNS request goes to the resolver, not to any hospital-controlled server, so it remains passive relative to the target. The MX records then reveal mail providers and sometimes SaaS tenants, exactly the intelligence required.

Insecure Direct Object Reference (IDOR) occurs when an application exposes a direct reference to an internal implementation object, such as a file, database key, or directory, and fails to implement proper authorization checks. An attacker can manipulate these references, often found in URL parameters, form fields, or API requests, to access or modify resources belonging to other users or unauthorized data. This vulnerability directly exploits the application's trust in user-supplied object identifiers without verifying the user's permission to access that specific object, leading to unauthorized information disclosure or modification.

The command `nbtstat -a 192.168.1.10` (or `-A` for adapter status) is precisely used to query the NetBIOS name table of a remote host. This query retrieves a list of NetBIOS names registered by the target machine, including the computer name, workgroup/domain name, and services like the Messenger service or File and Print Sharing, along with their associated types and status. This provides valuable information about the remote system's identity and active NetBIOS services.

Remote code execution (RCE) via SMB vulnerabilities is a highly relevant threat when TCP port 445 is found open, as this port is the standard for Server Message Block (SMB) communication. SMB implementations, particularly older versions or unpatched systems, have been historically plagued by critical RCE vulnerabilities, such as EternalBlue. A Nessus scan detecting an open port 445 would prompt an ethical hacker to investigate for specific SMB vulnerabilities that could allow an attacker to execute arbitrary code on the target system.

SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow an executable file to run with the permissions of its owner (SUID) or group (SGID), rather than the user executing it. If a program owned by root has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that program's execution. Attackers can exploit misconfigured or vulnerable SUID/SGID binaries, such as those that allow arbitrary command execution or shell escapes, to elevate their privileges to root or another privileged user.

Stored XSS, also known as persistent XSS, occurs when a malicious script is permanently saved on the target server, typically within a database, comment section, or user profile. When a victim's browser requests the page containing this stored payload, the server retrieves the malicious script and delivers it as part of the legitimate web page content. Consequently, the victim's browser executes the script, allowing the attacker to steal cookies, deface the website, or redirect users, making it a highly impactful and widespread attack.

Enumeration is the active process of extracting detailed information from a target system or network, such as user accounts, group memberships, network shares, running services, and open ports. This granular data provides critical intelligence to identify potential attack vectors and misconfigurations, laying the groundwork for subsequent vulnerability analysis and exploitation attempts. It moves beyond simple port scanning to actively query services for specific configuration details.

When an attacker runs `nslookup` without specifying a query type, the command often defaults to querying A records but will frequently display Mail Exchanger (MX) records if they are configured for the domain, as these are critical for email routing. MX records explicitly list the mail servers responsible for accepting email on behalf of a domain and assign a numerical preference value, indicating the priority for delivery. This allows email clients to attempt delivery to the lowest-preference server first, ensuring redundancy and load balancing.

When a client encounters an "untrusted root CA" error, it signifies that the digital certificate presented by the server cannot be validated against the client's pre-installed list of trusted Certificate Authorities. In a Man-in-the-Middle (MitM) attack, an adversary intercepts communication and presents a fraudulent certificate, often self-signed or issued by an attacker-controlled CA, to the client. This rogue certificate will naturally fail the trust chain validation, leading to the observed error as the client cannot establish a secure, authenticated connection to the legitimate server.

X25519 is an ephemeral Diffie-Hellman key exchange, which provides forward secrecy. In TLS 1.3, forward secrecy is mandatory for all cipher suites. The use of X25519 ensures that session keys are not compromised even if the server's long-term private key is later compromised, making this statement true.

This command correctly utilizes `snmpwalk` to perform comprehensive SNMP enumeration. The `-v 2c` flag specifies the use of SNMPv2c, a widely adopted version, and `-c public` employs the common default read-only community string. Crucially, initiating the walk with `.1` as the starting Object Identifier (OID) instructs `snmpwalk` to traverse and retrieve all available information from the entire Management Information Base (MIB) tree on the target device, which is the precise objective of thorough SNMP enumeration.

Reflected Cross-Site Scripting (XSS) attacks are typically initiated when an attacker crafts a malicious URL containing the injected script and then tricks a victim into clicking it. This delivery mechanism is crucial because the malicious payload is not persistently stored on the server. Instead, the victim's browser sends the crafted URL to the vulnerable web application, which then reflects the script back in the immediate HTTP response, executing it in the victim's browser context.

Reflected Cross-Site Scripting (XSS) occurs when a malicious script, typically injected through a URL parameter or form input, is immediately processed by the server and returned within the HTTP response to the user's browser without proper sanitization. The script is not stored on the server; instead, it "reflects" off the server back to the user who made the request. The web server log showing the script directly in the request and implying an immediate response aligns perfectly with this non-persistent, server-side reflection mechanism.

Cloning a legitimate site and harvesting credentials via a sent link is credential phishing. The Social Engineering Toolkit automates the fake login page, but the attack category remains phishing, defined by deceptive messaging that induces victims to surrender sensitive information.

Enum4linux is a powerful enumeration tool specifically designed to interact with the Server Message Block (SMB) and Common Internet File System (CIFS) protocols. It leverages various SMB functionalities, such as querying NetBIOS name services, enumerating shares, listing users, and extracting operating system information from Windows and Samba hosts. This direct interaction with SMB/CIFS allows it to gather critical reconnaissance data for security assessments.

Masscan is specifically engineered for extremely high-speed network scanning, capable of scanning vast IP address spaces, including the entire internet, in minutes. It achieves this by employing an asynchronous, stateless approach to transmit SYN packets at a rapid rate, making it ideal for quickly identifying live hosts and open ports across large address ranges. Its primary strength lies in its ability to conduct broad reconnaissance efficiently, far surpassing other tools for sheer scanning velocity when the objective is rapid host discovery.

Enabling port security on switches is the most effective defense against MAC flooding attacks. This feature allows administrators to configure a maximum number of MAC addresses permitted to be learned on a specific switch port. When the configured limit is exceeded, the switch can be configured to take action, such as shutting down the port, restricting further MAC address learning, or generating an alert, thereby preventing the attacker from overflowing the CAM table.

This option is correct because the command's `-v2c` flag precisely identifies SNMP version 2c, which offers significant improvements over SNMPv1, including enhanced bulk data transfer and more detailed error messages. Concurrently, the `-c public` flag accurately specifies the community string as 'public', a widely known default often targeted by attackers for initial reconnaissance during penetration tests.

Polymorphic viruses are a sophisticated type of malware designed to evade signature-based detection by constantly changing their executable code while retaining their original functionality. They achieve this through a 'mutation engine' that encrypts the virus body with a different key and decryption routine for each new infection. This process ensures that every new instance of the virus has a unique signature, making it extremely challenging for traditional antivirus software to identify based on static patterns.

Adding -f to fragment IP packets instructs Nmap to split the TCP header across multiple smaller IP packets. This technique, known as IP fragmentation, can bypass stateless firewalls and basic Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) that are not configured to reassemble fragmented packets before inspection. By scattering the critical header information, it becomes more challenging for signature-based detection mechanisms to identify the scan pattern, thus aiding in evasion.

An expired certificate causes browser warnings and breaks trust, potentially disrupting customer transactions. Renewing and deploying a valid certificate restores secure HTTPS communication and resolves the immediate availability and trust issue. This is the direct remediation for the finding and aligns with standard certificate lifecycle management.

This is a critical characteristic of DNS amplification. The attacker sends small DNS queries to numerous open DNS resolvers, but crafts these queries to appear as if they originated from the victim's IP address. This IP spoofing ensures that when the resolvers send their much larger responses, they are directed to the legitimate victim's network, effectively overwhelming their bandwidth and causing a denial of service. Without spoofing, the responses would return to the attacker, nullifying the amplification effect.

A worm is a standalone malicious program designed to self-replicate and propagate across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to spread autonomously, often scanning for vulnerable systems and then infecting them to continue their replication cycle. This independent self-replication and network-based propagation are their defining characteristics, allowing them to consume network bandwidth and system resources rapidly.

Server-Side Request Forgery (SSRF) occurs when a web application is tricked into making requests to an arbitrary domain specified by an attacker. This vulnerability allows an attacker to induce the server-side application to make HTTP requests to an attacker-specified location, potentially targeting internal networks, cloud metadata services, or other external systems. The server acts as a proxy for the attacker, bypassing network segmentation or firewall rules that might otherwise block direct access.

Shodan's core functionality involves actively scanning the internet to identify open ports and then performing banner grabbing to collect detailed information from exposed services. This includes service banners (e.g., HTTP server versions, SSH daemon versions), operating system details, geographic location, and other configuration metadata. This rich metadata allows penetration testers to quickly identify potential vulnerabilities, misconfigurations, and the specific technologies running on internet-facing assets, forming a critical part of the reconnaissance phase.

Hashcat is an advanced offline password recovery utility renowned for its unparalleled speed, primarily achieved through extensive GPU acceleration. It supports a vast array of hash types, including NTLM, MD5, SHA-1, and bcrypt, and offers diverse attack modes such as dictionary, brute-force, mask, and hybrid attacks. This makes it exceptionally effective for cracking password hashes extracted from compromised systems or databases, enabling rapid auditing of password security.

A buffer overflow writes data beyond the intended buffer's boundaries, corrupting adjacent memory. This corruption can overwrite critical program data, function pointers, or the stack frame itself. When the program attempts to access or execute corrupted instructions or data, it leads to an illegal memory access, triggering a segmentation fault or an unexpected program termination.

A SYN flood is a type of DoS attack where an attacker sends a succession of SYN requests with spoofed source IPs to a target. The server allocates resources for each half-open connection, eventually exhausting its connection table and denying service to legitimate users. This matches the scenario perfectly.

A WHOIS lookup is a fundamental footprinting technique that queries public databases to retrieve registration details for domain names and IP addresses. This process reveals critical information such as the domain owner's name, organization, contact email, physical address, registration and expiration dates, and associated DNS name servers. Such data is invaluable for identifying potential targets, understanding organizational structure, and mapping network infrastructure during the initial reconnaissance phase.

smbclient is a powerful command-line utility that acts as an SMB/CIFS client, similar to a Windows file explorer. It is specifically designed to interact with SMB servers, allowing users to list available shares on a target machine using the "-L" option, connect to specific shares, and browse, upload, or download files. Its direct capability to query and display network shares makes it the most appropriate tool for SMB enumeration.

TCP sequence prediction involves an attacker guessing the next valid sequence number in a TCP connection. If the sequence numbers are predictable, the attacker can inject crafted packets into an established session, effectively hijacking it. By successfully predicting and sending packets with the correct sequence and acknowledgment numbers, the attacker can impersonate one of the legitimate communication parties, taking control of the session without needing to intercept initial authentication. This allows for unauthorized command execution or data manipulation within the active session.

Pretexting is a sophisticated form of social engineering where an attacker invents a believable, fabricated scenario (a "pretext") to manipulate a target into divulging information or performing an action. This often involves extensive research to create a credible backstory, a false identity, and a plausible reason for the interaction, making the target believe they are interacting with someone authorized or legitimate. The scenario's description of an attacker calling and using a fabricated scenario directly aligns with the definition of pretexting.

SQLMap automates detection and exploitation of SQL injection in web applications, fingerprinting the backend DBMS and dumping data via crafted payloads. This directly matches the stem's requirement for a tool specifically built to automate SQL injection detection and exploitation, rather than general web scanners.

Infrastructure as a Service (IaaS) provides virtualized computing resources, such as virtual machines, networks, and storage, granting users significant control over the operating system and installed software. In an IaaS model, users frequently deploy and manage their own containerized applications, often having direct access to the container runtime and the host operating system. This elevated level of control means a successful container escape directly compromises the host VM or underlying physical server, rendering IaaS the most susceptible cloud service model for such an attack.

The -f option instructs Nmap to fragment the IP packets into smaller, non-standard-sized pieces. This technique can bypass stateless firewalls or Intrusion Detection Systems (IDS) that only inspect the initial fragments, as critical header information (like TCP flags or port numbers) might be split across multiple segments. When the fragmented packets reach the target, the operating system reassembles them before processing, potentially allowing the scan to proceed undetected by intermediate network devices.

A rainbow table attack utilizes a precomputed table of hash chains to reverse cryptographic hash functions efficiently. Instead of brute-forcing each hash, the attacker looks up the target hash within the table, which maps hashes back to their original plaintext passwords. This method exploits a time-memory tradeoff, allowing for rapid password recovery without needing to compute every possible password combination during the attack.

Implementing TLS/SSL (Transport Layer Security/Secure Sockets Layer) encryption for all camera communications establishes a robust, end-to-end secure channel. This protocol encrypts the entire data stream, including sensitive video feeds, audio, control commands, and metadata, protecting them from unauthorized interception, eavesdropping, and tampering as they traverse public or untrusted networks. TLS/SSL also provides server authentication, ensuring the camera communicates with the legitimate server, and data integrity verification, confirming the data has not been altered in transit.

Performing a WHOIS lookup involves querying publicly available domain registration databases, such as those maintained by ICANN-accredited registrars. This process retrieves information like domain ownership, administrative contacts, technical contacts, and registration dates without sending any packets directly to the target's servers or network infrastructure. Since the interaction is solely with third-party public records, it is a quintessential passive reconnaissance technique, leaving no trace on the target system itself.

Running a container with the `--privileged` flag effectively disables most of the security features and isolation mechanisms provided by the container runtime. This flag grants the container nearly all capabilities of the host, including direct access to host devices (e.g., `/dev`), the ability to mount host filesystems, and full control over the kernel's capabilities (like `CAP_SYS_ADMIN`). These elevated privileges provide direct and straightforward vectors for a penetration tester to break out of the container and gain control over the host system.

Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files and directories stored outside the intended root directory by manipulating file paths. This is typically achieved by injecting sequences like `../` (dot-dot-slash) into input parameters, enabling navigation upwards in the directory hierarchy to read sensitive system files or application configuration.

Custom request headers like X-Requested-With serve as an effective CSRF defense by leveraging browser security mechanisms. Modern browsers, adhering to the Same-Origin Policy and CORS specifications, prevent attackers from arbitrarily adding or modifying such custom headers in simple cross-origin requests. The server can then validate the presence and expected value of this header, rejecting any request originating from an unauthorized domain that lacks the legitimate header. This ensures that only requests from the legitimate origin, which can set the header, are processed.

This method correctly leverages a common sudo misconfiguration where a user is permitted to execute /usr/bin/less with root privileges. Inside less, typing '!' allows the execution of arbitrary shell commands. Since less is running as root via sudo, any command executed through '!', such as !/bin/bash, will also inherit root privileges, effectively spawning a root shell.

Slowloris attacks aim to exhaust server resources by maintaining numerous open, incomplete HTTP connections. Implementing a strict connection timeout for idle or slow-sending connections will effectively terminate these malicious sessions before they can consume all available server sockets indefinitely. Additionally, rate limiting the number of new connections or requests from a single source IP can prevent an attacker from establishing a sufficient volume of connections to overwhelm the server's capacity, thus mitigating the attack.

Hiding files is a core activity within the "Maintaining Access" phase of system hacking, specifically represented by the 'H' in the CHIPSET acronym. This involves employing various techniques, such as rootkits, steganography, or manipulating file attributes and permissions, to conceal malicious tools, backdoors, or data staging areas from legitimate users, administrators, and security software, thereby ensuring persistence and operational secrecy on the compromised system.

Elliptic Curve Cryptography (ECC) is an asymmetric encryption algorithm that derives its security from the mathematical properties of elliptic curves over finite fields, specifically the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP). It provides a robust framework for public-key cryptography, including encryption, digital signatures, and key exchange. ECC is highly efficient, offering equivalent security to RSA with significantly smaller key sizes, making it particularly well-suited for resource-constrained environments like mobile devices.

MAC flooding involves overwhelming a switch's Content Addressable Memory (CAM) table (also known as MAC address table) with a multitude of forged source MAC addresses. When the CAM table becomes full, the switch can no longer store new legitimate MAC-to-port mappings. Consequently, for any new incoming frames destined for an unknown MAC address, the switch resorts to broadcasting the frames out of all ports, effectively degrading its functionality to that of a network hub. This allows an attacker to capture traffic intended for other hosts on the segment.

When user-supplied data is rendered back to a client, output encoding converts special characters (like <, >, &, ", ') into their entity equivalents (e.g., &lt;, &gt;). This process prevents the browser from interpreting these characters as active content or HTML tags, effectively neutralizing any embedded malicious scripts and ensuring they are displayed as harmless text rather than executed.

Password spraying is a targeted attack where an attacker attempts a small number of common passwords against a large list of usernames. This technique is specifically designed to bypass account lockout policies by distributing login attempts across many accounts, rather than repeatedly failing on a single account. By trying 'Password123!' on hundreds of accounts, the attacker significantly increases their chances of finding a valid credential without triggering security alerts for excessive failed logins on one user. This method is highly effective against organizations with weak password policies and large user bases.

Ophcrack is purpose-built for cracking Windows LM and NTLM hashes, leveraging precomputed rainbow tables for highly efficient password recovery. Its specialization allows it to quickly reverse these specific hash formats by performing a time-memory trade-off, making it exceptionally fast for common passwords. The tool comes with pre-generated tables, significantly reducing the computational effort required compared to on-the-fly cracking methods.