Certified Ethical Hacker CEH (CEH) — Questions 76–150

Process injection is a sophisticated technique where an attacker writes malicious code into the address space of a legitimate, running process and then forces that process to execute it. The `WriteProcessMemory` API is crucial for writing the attacker's shellcode or payload into the target process's memory. Subsequently, `CreateRemoteThread` is commonly used to create a new thread within the remote process, directing its execution flow to the starting address of the newly injected code, thereby achieving execution within the target's context.

A rainbow table attack leverages precomputed tables that store chains of hash-to-plaintext reductions. This method significantly reduces the time required to crack passwords by performing a time-memory trade-off, avoiding the need to recompute every possible hash during the attack. Instead of brute-forcing, it looks up the target hash within the table to find the corresponding original password or a chain leading to it.

Time-based blind SQL injection involves injecting queries that cause a measurable time delay on the database server if a specific condition evaluates to true. By observing the server's response time, an attacker can infer the truthfulness of the injected statement, character by character. This method is crucial when no direct output or error messages are returned by the application, making it a viable technique for data exfiltration in blind scenarios.

Correct. Slowloris keeps many connections open to exhaust server resources.

While allowing loopback traffic (lo) is common for inter-process communication, an `ACCEPT` rule for all traffic on the loopback interface can be a significant security vulnerability. Malicious local processes or compromised applications could exploit this permissive rule to communicate with other local services, potentially bypassing more restrictive firewall rules designed for external interfaces. This allows attackers to pivot internally, escalating privileges or exfiltrating data without network-level firewall intervention.

Correct. ARP poisoning enables MITM, which can be used to hijack sessions.

The -sS option initiates a SYN scan, often referred to as a 'stealth scan,' because it does not complete the full TCP three-way handshake. Nmap sends a SYN packet and, if a SYN/ACK is received, immediately responds with an RST packet, preventing the target system from logging a fully established connection. This technique allows the penetration tester to identify open TCP ports while minimizing the footprint and avoiding detection by many intrusion detection systems and application logs.

A WHOIS lookup involves querying publicly accessible databases maintained by domain registrars and regional internet registries (RIRs) to retrieve information about a domain name or IP address. This process is entirely passive because the queries are directed at third-party databases, not the target's systems, ensuring no direct network traffic is sent to the target organization. Information gathered can include registrant contact details, registration and expiration dates, and nameservers.

Union-based SQL injection is an in-band technique where an attacker leverages the UNION SELECT SQL operator to combine the results of the original legitimate query with a malicious query. This allows the attacker to retrieve data from other tables or databases within the same database server, and have it returned directly in the application's HTTP response. The attacker can then extract sensitive information by carefully crafting the injected SELECT statement.

This is the core difference between the two approaches.

Ettercap is a comprehensive, open-source suite specifically designed for man-in-the-middle (MITM) attacks on local area networks, alongside network sniffing, content filtering, and active protocol dissection. It natively supports various MITM techniques, including robust ARP poisoning (ARP spoofing), which allows it to intercept traffic between two hosts by sending forged ARP replies. This capability makes Ettercap a primary and highly effective tool for manipulating network traffic flows and performing session hijacking or data interception.

The -sS option performs a SYN scan, which is Nmap's default and most common scanning method. This "half-open" scan sends a SYN packet to each target port and, if a SYN/ACK is received, the port is marked as open before a full TCP connection is established. This efficient technique quickly identifies open ports and infers service names based on standard port assignments, making it ideal for initial reconnaissance without completing the three-way handshake.

Burp Suite's Intruder tool is purpose-built for performing automated, highly configurable attacks against web applications, including fuzzing, brute-forcing, and enumeration. It allows users to define specific insertion points within a request and then systematically iterate through a list of payloads, observing the server's responses to identify vulnerabilities or weak points. Its advanced payload generation, attack types (e.g., Sniper, Battering Ram, Pitchfork, Cluster Bomb), and result analysis features make it the ideal choice for automated input testing.

Identifying files with SUID (Set User ID) or GUID (Set Group ID) bits set is a critical step for privilege escalation on Linux systems. When a program with the SUID bit is executed, it runs with the permissions of its owner, typically root, regardless of the user who initiated it. This allows a low-privileged attacker to execute specific binaries with elevated privileges, potentially exploiting vulnerabilities within those programs to gain a root shell or execute arbitrary commands as root.

Reaver is purpose-built to execute a brute-force attack against the Wi-Fi Protected Setup (WPS) PIN, exploiting a significant design flaw in the protocol. This vulnerability allows an attacker to test the first four digits and the subsequent three digits of the 8-digit PIN independently, drastically reducing the number of attempts required. Upon successfully guessing the correct PIN, Reaver can then extract the network's Pre-Shared Key (PSK), thereby compromising the Wi-Fi network's security.

Many IoT devices are deployed with factory-set usernames and passwords that are publicly known or easily guessable. Attackers leverage extensive databases of these default credentials to gain unauthorized access to devices, often en masse. This vulnerability allows for full device compromise, enabling actions like data exfiltration, device manipulation, or recruitment into botnets without requiring complex exploits.

Netcat performs a direct banner grab by establishing a raw TCP connection to the target port and simply displaying the initial data sent by the service. This method directly reads the service's self-reported version string, which is typically the most authoritative source. In contrast, Nmap's -sV (service version detection) relies on a database of signatures and probes, which can sometimes be outdated, incomplete, or misinterpret non-standard banners, leading to discrepancies compared to the service's actual response.

Polymorphic malware, such as a polymorphic virus, possesses the sophisticated ability to alter its internal code structure and signature with every new infection or replication. This mutation typically involves encrypting its payload with a different key and using a varying decryption routine, making each instance appear unique. This constant code transformation is a primary tactic to bypass traditional signature-based antivirus software, which relies on identifying fixed patterns, thereby significantly increasing its stealth and persistence within a system.

Email enumeration is a reconnaissance technique used to discover valid email addresses within an organization. When an email is sent to a non-existent address, the mail server often returns a Delivery Status Notification (DSN) or Non-Delivery Report (NDR) indicating the address was invalid. Conversely, the *absence* of such a bounce, or a specific DSN indicating a deferred delivery rather than an immediate rejection, can confirm the validity of an email address, making DSN responses a valuable tool for identifying active accounts.

Nessus scans are highly effective at identifying critical operating system vulnerabilities, such as the MS17-010 vulnerability, famously known as EternalBlue. This flaw in the Server Message Block (SMB) protocol allows unauthenticated remote code execution on vulnerable Windows systems. A successful scan would flag this specific vulnerability, indicating a severe risk of compromise and potential for widespread malware infection like WannaCry or NotPetya, making it the most relevant finding.

Enforcing HTTPS using TLS 1.2 or higher is the most effective solution for protecting credentials during transmission. TLS establishes an encrypted tunnel between the client and the server, ensuring confidentiality, integrity, and authenticity for all data exchanged, including login credentials. This robust encryption prevents eavesdropping, tampering, and man-in-the-middle attacks by encrypting the entire communication channel end-to-end.

Performing a WHOIS lookup is a classic passive reconnaissance technique because it queries publicly available databases maintained by domain registrars and registries. This action retrieves information such as domain owner, administrative contacts, nameservers, and registration dates without sending any packets directly to the target's servers or network. The data is simply pulled from a third-party repository, making it entirely non-intrusive and undetectable by the target.

Enum4linux is a specialized command-line utility explicitly engineered for enumerating information from Windows and Samba hosts. It leverages NetBIOS and SMB protocols to extract details such as user lists, group memberships, share names, operating system versions, and security policies. This tool is invaluable during the reconnaissance phase of a penetration test, providing critical insights into potential attack surfaces.

The presence of a 'cmd' parameter in the URL, especially when followed by a system command like 'id', strongly indicates that the web application is passing user-supplied input directly to an underlying operating system shell. This vulnerability arises when the application fails to properly sanitize or validate this input, allowing an attacker to append arbitrary shell commands using special characters such as semicolons, pipes, or ampersands. Consequently, the server executes these injected commands with the privileges of the web server process, potentially leading to remote code execution.

The FIN scan (-sF) is considered stealthy because it sends only a FIN packet to the target port without initiating a full TCP three-way handshake. If the port is open, it typically ignores the packet, while a closed port will respond with an RST/ACK. This technique often bypasses stateless firewalls and avoids logging on the target system, as no connection is ever established, making it less detectable.

Sending a request with a URL parameter pointing to an internal IP address is the correct method to test for Server-Side Request Forgery (SSRF). SSRF exploits occur when a web application fetches a remote resource based on user-supplied input. By providing an internal IP address (e.g., `127.0.0.1`, `10.0.0.1`) in a parameter that the server is expected to process and fetch, an attacker can determine if the server attempts to connect to that internal resource. Successful connection attempts, even if resulting in an error, indicate the presence of an SSRF vulnerability.

The snmpwalk command, especially when targeting the default MIB tree or the "system" group (OID 1.3.6.1.2.1.1), is highly effective at retrieving fundamental device information. This includes critical details like the operating system description (sysDescr), device hostname (sysName), system uptime (sysUpTime), and administrative contact information (sysContact). This makes it a primary method for initial reconnaissance to identify the type and version of the target system.

SUID (Set User ID) is a special permission bit on executable files that allows them to run with the permissions of the file's owner, rather than the user executing it. If a binary owned by root, like `find` or `nmap`, has SUID set and can be manipulated to execute arbitrary commands or spawn a shell, a low-privileged user can exploit this to gain root privileges. This is a highly effective and common method for local privilege escalation on Linux/Unix systems.

Cross-site request forgery (CSRF) is a vulnerability where an attacker tricks an authenticated user into submitting an unintended request to a web application. If the HTTP response implies that session cookies are sent on cross-site requests (e.g., via SameSite=None without Secure or HttpOnly flags) and the application lacks anti-CSRF tokens, the application becomes susceptible. An attacker can craft a malicious page that, when visited by the victim, forces their browser to send a request to the vulnerable site, leveraging the victim's active session.

The -D flag enables decoy scanning, an effective evasion technique where Nmap sends scan packets from multiple spoofed source IP addresses in addition to the attacker's real IP. By interspersing legitimate scan packets with numerous fake ones, this method aims to confuse Intrusion Detection Systems (IDS) and obscure the true origin of the scan. This makes it significantly harder for security analysts to pinpoint the actual attacker's machine amidst a flood of seemingly disparate scan attempts, thus providing a layer of anonymity.

Server Message Block (SMB) is the correct protocol targeted by enum4linux. This tool is specifically engineered to perform comprehensive enumeration against Windows systems, leveraging the SMB protocol to extract critical security-relevant information. It can identify user accounts, shared resources, group memberships, operating system versions, and even password policies, providing valuable insights for penetration testers. This makes SMB enumeration a foundational step in assessing Windows network security.

The birthday attack is a cryptographic attack that exploits the mathematics behind the birthday paradox to find collisions in hash functions more efficiently than a brute-force search. It works by generating a large number of distinct inputs and their corresponding hash outputs, then searching for two inputs that produce the same hash value. This probabilistic method significantly reduces the computational effort required to find a hash collision, making it a direct threat to the collision resistance property of hash functions.

The command `nmap -sU -p 161,162` specifically instructs Nmap to perform a UDP scan on ports 161 and 162. UDP port 161 is the well-known port for the Simple Network Management Protocol (SNMP) agent, used for management queries, while UDP port 162 is designated for SNMP trap messages, which are asynchronous notifications. Therefore, this scan is precisely configured to identify the presence and responsiveness of SNMP services and their associated trap listeners on the target.

The `nbtstat` command is a dedicated utility for querying NetBIOS over TCP/IP (NetBT) information, which provides name resolution and session services for legacy Windows networking components. When an analyst runs `nbtstat -a <IP_address>`, it specifically attempts to retrieve the NetBIOS name table from the specified remote host. This command directly interacts with the NetBIOS protocol to gather details like registered names and MAC addresses, making NetBIOS the correct answer.

The `nmap -sU` command explicitly instructs Nmap to perform a UDP scan, which is the correct interpretation of the provided syntax. This method sends UDP packets to target ports and analyzes the responses (or lack thereof) to determine if a port is open, closed, or filtered. Unlike TCP, UDP is connectionless, making port state determination more challenging and often slower, as open ports may not send a response, while closed ports typically return an ICMP Port Unreachable message.

The msfvenom command, particularly when generating a Windows payload like a reverse shell or Meterpreter, is designed to create a malicious program that provides remote access and control over a compromised system. This type of payload establishes a persistent backdoor, allowing an attacker to execute commands and exfiltrate data. Such a program, which often relies on social engineering or embedding within legitimate software to trick users into execution, perfectly aligns with the definition and functionality of a Trojan.

Leveraging error-based SQL injection with functions like CONVERT() or by employing double query techniques (e.g., using `EXTRACTVALUE` or `UPDATEXML` in MySQL) is highly effective when an application displays verbose database error messages. These methods intentionally trigger type conversion errors or XML parsing errors, forcing the database to include the results of an injected subquery within the error message itself. This allows the attacker to directly extract data, such as database version, table names, or user credentials, from the application's response.

The presence of `../` sequences in the URL path is a definitive indicator of a directory traversal (also known as path traversal) attack. This technique exploits vulnerabilities in file handling routines to access files and directories stored outside the intended web root directory by manipulating relative paths. The goal is often to read sensitive system files, such as `/etc/passwd`, or configuration files, leading directly to unauthorized information disclosure.

AXFR is the DNS query type for zone transfers. Allowing AXFR from unauthorized hosts is a misconfiguration.

SameSite cookies are an effective mitigation because they instruct the browser to restrict when cookies are sent with cross-origin requests. By setting `SameSite=Lax` or `SameSite=Strict`, the browser will not attach session cookies to requests initiated from a different site, thereby preventing an attacker's forged request from carrying the necessary authentication credentials to execute an unauthorized action.

Implementing per-record encryption keys derived from a master key combined with a unique salt is the most robust solution. This method ensures that each individual record is encrypted with a distinct, cryptographically unique key generated using a Key Derivation Function (KDF). Consequently, if one derived record key is ever compromised, only that specific record is affected, leaving all other records protected by their respective unique keys and the secure master key. This significantly limits the impact of any single key compromise, enhancing overall data security.

Asymmetric encryption is foundational for digital signatures, providing non-repudiation, integrity, and authenticity. The sender uses their unique private key to encrypt a hash of the message, creating the digital signature. Recipients then use the sender's publicly available corresponding public key to decrypt the signature and verify the message's integrity and the sender's identity. This process ensures the message originated from the claimed sender and has not been tampered with.

The `smbclient` utility is the standard command-line tool for interacting with SMB/CIFS shares, making it the most appropriate choice for this scenario. The syntax `//192.168.1.10/data` correctly specifies the target server and the known share name. The `-N` flag is crucial as it instructs `smbclient` to attempt a null session connection, meaning it tries to connect anonymously without requiring a username or password. This is the most direct and efficient method to test if the 'data' share is anonymously accessible, which is a common misconfiguration.

An application-layer (Layer 7) attack specifically targets the application layer of the OSI model, exploiting vulnerabilities or resource limitations within the application itself. The observation of a sudden increase in HTTP GET requests directed at a specific web page perfectly aligns with this definition. These requests consume server resources like CPU, memory, and database connections, ultimately leading to service degradation or denial for legitimate users without necessarily saturating network bandwidth.

Hashcat mode 1000 is the correct and standard choice for cracking NTLM (NT LAN Manager) hashes, which are the cryptographic one-way functions of a user's password used for authentication in Windows environments. These hashes are commonly extracted from the Security Account Manager (SAM) database, Active Directory's NTDS.DIT file, or captured via various network protocols. This mode directly targets the NTLM hash format, making it ideal for direct password recovery from stored hashes.

Running a dictionary attack using aircrack-ng with a wordlist is the correct approach because the captured WPA2 4-way handshake contains the necessary cryptographic elements, such as the ANonce, SNonce, and the Message Integrity Code (MIC). Aircrack-ng can iterate through a wordlist, calculate the Pairwise Master Key (PMK) and subsequent MIC for each potential Pre-Shared Key (PSK), and compare it to the MIC within the captured handshake. A match indicates the correct PSK has been found, allowing the attacker to decrypt network traffic.

This option accurately describes the dork's function. The 'inurl:confidential' operator specifically targets URLs that contain the string "confidential," which encompasses both the directory path and the filename components of a URL. When combined with 'filetype:pdf' and 'site:example.com', the dork precisely identifies PDF documents on the specified domain where "confidential" appears within their web address.

A Smurf attack is a distributed denial-of-service (DDoS) attack where an attacker sends a large number of Internet Control Message Protocol (ICMP) echo requests to a network's broadcast address. The crucial element is that the source IP address of these requests is spoofed to be the victim's workstation. Consequently, all hosts on the broadcast network respond to the victim's IP address with ICMP echo replies, overwhelming the workstation with traffic and causing a denial of service.

The `intitle:login` Google dork is a highly effective reconnaissance tool for attackers, specifically designed to locate web pages where the HTML `<title>` tag contains the word "login". This operator is crucial for identifying potential authentication interfaces, administrative panels, or other sensitive entry points on target systems. By focusing the search on page titles, it efficiently filters out irrelevant results, allowing attackers to quickly pinpoint web pages that likely require user credentials. This precision makes it an invaluable technique for initial information gathering and identifying potential attack vectors.

Masscan is exceptionally well-suited for rapid host discovery across vast IP ranges due to its asynchronous, custom-built TCP SYN scanner. It can transmit millions of packets per second, bypassing the operating system's network stack by using raw sockets to achieve unparalleled scanning speed. This makes it the optimal choice for identifying live hosts quickly over large networks or the entire internet.

The `aireplay-ng -0` command executes a deauthentication attack by sending specially crafted deauthentication frames to a target client or broadcast to all clients associated with an access point. This action forcibly disconnects the client from the Wi-Fi network. When the client automatically attempts to re-establish its connection, it performs the crucial WPA/WPA2 4-way handshake with the access point, which can then be captured by a monitoring tool like `airodump-ng` for subsequent offline cracking attempts.

SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.

Pretexting uses a fabricated scenario to obtain information.

theHarvester is designed to gather emails, subdomains, and other information from public sources.

Scareware displays fake alerts to trick users into paying for removal.

ldapsearch can retrieve all objects and attributes from an LDAP directory, especially with anonymous bind.

Session hijacking is a sophisticated attack where an attacker successfully obtains a legitimate user's valid session ID or token and then uses it to impersonate that user, gaining unauthorized access to their active session. By presenting the stolen, yet valid, session token to the web server, the attacker effectively bypasses the initial authentication process and can perform actions as if they were the legitimate user. This allows them to take over an already established and authenticated session without needing the user's credentials.

A Man-in-the-Middle (MITM) attack is precisely what occurs when an attacker intercepts communications between two parties, in this case, an MQTT client and broker, without either party being aware. Since MQTT is used without TLS, the communication channel is unencrypted, allowing the attacker to easily intercept, read, modify, or inject arbitrary fake messages into the cleartext data stream. This direct manipulation of active network traffic, including the injection of new, crafted messages, is the hallmark of a successful MITM attack.

Worms self-propagate across networks independently.

Cuckoo Sandbox is an open-source automated malware analysis system specifically designed for dynamic analysis. It executes suspicious files within an isolated virtual environment, commonly referred to as a sandbox, and meticulously monitors their runtime behavior. This includes observing API calls, network traffic, file system changes, and process interactions, providing a comprehensive report on the malware's actions and intent, which is the core objective of dynamic analysis.

SQLMap is an open-source penetration testing tool specifically designed to automate the detection and exploitation of SQL injection flaws and database server takeovers. It supports a wide array of SQL injection techniques, including boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries, and out-of-band methods. Its primary function is to identify vulnerable parameters, extract data, and even access the underlying file system or execute commands on the compromised database server, making it the definitive choice for automated SQLi.

The Nmap idle scan (-sI) is a highly stealthy technique that allows a penetration tester to scan a target without sending any packets directly from their own IP address. Instead, it leverages a "zombie" host's IP ID sequence to infer open ports on the target. By observing changes in the zombie's IP ID, the scanner can determine if the target responded to a forged packet sent from the zombie, thus achieving a truly blind scan, matching the 'si' flag in the command.

The WPA/WPA2 4-way handshake's primary function is to securely derive a unique set of session keys, including the Pairwise Transient Key (PTK) and Group Temporal Key (GTK), for encrypting subsequent data traffic. This critical process is achieved by exchanging nonces and cryptographic hashes, ensuring that the pre-shared key (PSK) itself is never transmitted over the air. By keeping the PSK off the network, the handshake effectively prevents eavesdroppers from capturing and compromising the long-term secret, thus establishing confidentiality and integrity for the wireless communication.

Directory traversal, also known as path traversal, is a web security vulnerability that allows an attacker to read arbitrary files on the server's file system. This is achieved by manipulating file paths in user-supplied input, typically using sequences like "../" (dot-dot-slash) to move up in the directory hierarchy, or its encoded forms. The objective is to access files and directories stored outside the intended web root directory, such as configuration files, source code, or system files like /etc/passwd.

Weak service permissions refer to overly permissive access control lists (ACLs) on a Windows service executable or its configuration, allowing non-privileged users to modify or replace the service binary. If an attacker can write to the service executable, they can replace it with a malicious payload, which will then execute with the service's elevated privileges (often `SYSTEM`) upon the next service restart or system reboot. This direct manipulation of the service binary is a classic and highly effective privilege escalation method.

Default credentials left unchanged represent a critical attack vector because many devices, especially in IoT, ship with easily guessable or publicly known usernames and passwords. Attackers can leverage automated scanning tools and credential stuffing techniques to gain unauthorized access, often leading to full device control, data exfiltration, or recruitment into botnets without requiring complex exploits.

Ransomware is a malicious software that encrypts a victim's files, rendering them inaccessible, and subsequently demands a payment, typically in cryptocurrency, in exchange for the decryption key. This type of attack is specifically designed for financial extortion by holding critical data hostage. It directly matches the description of encrypting files and demanding a ransom for their recovery.

The 250 SMTP response code indicates that the requested mail action was successful and completed. In the context of the VRFY command, a 250 response explicitly confirms that the specified user, such as 'root' or 'admin', is a valid and existing account on the server. This direct confirmation of user existence is precisely what the penetration tester is looking for during enumeration, making both accounts valid.

The process masquerades as a legitimate service (svchost.exe) to avoid detection, typical of a Trojan or backdoor.

RainbowCrack is a pioneering and highly specialized tool explicitly engineered for password cracking using the rainbow table technique. It not only performs efficient lookups against pre-computed rainbow tables but also includes functionalities for generating these large, memory-intensive tables for various hash algorithms. Its design is centered around the mathematical principles of rainbow tables, making it the definitive tool for both their creation and utilization in password recovery.

SQL injection attacks occur when an attacker inserts malicious SQL code into user input fields, which is then executed by the database. Proper input validation and sanitization are highly effective against this threat. Techniques such as using parameterized queries (prepared statements) or escaping special characters ensure that user-supplied data is treated strictly as data literals, preventing it from being interpreted as executable SQL commands and neutralizing the injection attempt.

snmpwalk is the correct and standard command-line utility for enumerating SNMP (Simple Network Management Protocol) information from a target device. The `-c public` option specifies the community string, which acts as a password for accessing SNMP data, with "public" being a common default. The `-v 2c` flag designates SNMP version 2c, a widely supported version, while `192.168.1.1` is the target IP address from which to retrieve Management Information Base (MIB) data. This command systematically queries the entire MIB tree, revealing device configurations, network statistics, and system details.

RainbowCrack is a specialized tool explicitly designed to utilize precomputed rainbow tables for efficient password recovery. It leverages the space-time trade-off inherent in rainbow table methodology, where extensive precomputation allows for exceptionally fast lookup during the cracking phase. By using these tables, RainbowCrack can quickly reverse NTLM hashes into their original plaintexts, provided the plaintext exists within the table's precomputed range, making it the most direct and effective tool for this specific task.

The "nbtstat -A" command is specifically designed to perform a remote NetBIOS name table query against a target identified by its *IP address*. This command sends a NetBIOS Adapter Status Request to the specified IP, retrieving the NetBIOS names registered by that host, including workgroup/domain membership and services. This direct query capability makes "nbtstat -A 192.168.1.10" the correct choice for enumerating NetBIOS information from a remote system. It directly fulfills the requirement to enumerate a remote host using its IP.

The primary purpose of repeatedly sending deauthentication packets in a WPA2 environment is to force connected clients to disconnect from the access point and then reinitiate the authentication process. This forced reconnection allows an attacker, who is passively monitoring the wireless traffic with tools like airodump-ng, to capture the WPA2 4-way handshake. This handshake contains cryptographic material that can then be used for offline brute-force or dictionary attacks to recover the Pre-Shared Key (PSK).