Certified Ethical Hacker CEH (CEH) — Questions 151–225

The `Content-Security-Policy: frame-ancestors 'none'` directive is a modern and highly effective mitigation against clickjacking. This policy explicitly instructs the browser that the resource cannot be embedded within any frame, iframe, object, embed, or applet by any domain, including its own. By preventing the target page from being loaded in a hidden or overlaid frame, it directly thwarts attempts to trick users into performing unintended actions.

theHarvester is a passive OSINT tool that collects emails, subdomains, IPs, and names from public sources like Google, Bing, and LinkedIn.

Changing the default community string, such as 'public', immediately invalidates the attacker's current enumeration attempt, as they would no longer possess the correct credential for SNMPv2c access. Simultaneously, restricting SNMP access to specific, authorized IP addresses through Access Control Lists (ACLs) provides an additional layer of defense. This combination ensures that only trusted management stations can even attempt to communicate with the SNMP agent, significantly reducing the attack surface and preventing unauthorized information disclosure.

Maltego is a comprehensive graphical link analysis tool specifically engineered for open-source intelligence (OSINT) and forensic investigations. It excels at aggregating data from diverse public sources, including DNS records, social media, and WHOIS information, to uncover relationships between entities. Its unique strength lies in visualizing these connections through interactive graphs, enabling analysts to identify patterns and build a detailed profile of a target without direct interaction.

The -sn (no port scan) flag, also known as a ping sweep, is specifically designed for host discovery by sending ICMP echo requests, TCP SYN packets to common ports, or ARP requests on local networks. It efficiently identifies live hosts with minimal network overhead and without initiating any full port scans, thereby significantly reducing the likelihood of detection by network security monitoring tools.

The appearance of the 'id' command's output, such as user and group IDs, directly within the web application's response is a definitive indicator of successful command injection. This demonstrates that an arbitrary operating system command was not only executed on the server but also that its standard output was captured and reflected back to the attacker, providing undeniable proof of remote code execution.

Segmenting IoT devices onto a separate Virtual Local Area Network (VLAN) or subnet is a critical security best practice. This isolation prevents an attacker who successfully compromises an IoT device from easily moving laterally to other, more sensitive parts of the network, such as corporate servers or personal computers. By containing potential breaches within a dedicated segment, the overall impact of an attack is significantly reduced.

A network switch operates at Layer 2 (Data Link Layer) and intelligently forwards frames only to the specific port associated with the destination MAC address. Unlike a hub, which broadcasts all traffic to every connected port, a switch isolates traffic flows. Therefore, even if an analyst's network interface is in promiscuous mode, it will only receive broadcast traffic, multicast traffic it has joined, and unicast traffic specifically destined for its own MAC address, making passive sniffing of other hosts' unicast traffic impossible without additional active techniques like port mirroring or ARP poisoning.

This statement is correct because a misconfigured S3 bucket policy or ACL can grant `s3:GetObject` permissions to the `AllUsers` principal, effectively making the bucket publicly readable. In such cases, anyone with an internet connection can retrieve objects directly by knowing or guessing their specific URL, without requiring any AWS authentication. This represents a significant data exposure risk, as the data is accessible to unauthenticated users.

This is the correct and most precise filter for enumerating user objects within an LDAP directory, including Active Directory. The `(objectClass=user)` filter specifically targets entries classified as user accounts, ensuring that only relevant user objects are returned. This command effectively identifies and lists all user accounts under the specified base DN, fulfilling the requirement to enumerate users.

The --dbs option is the correct command-line switch in sqlmap for enumerating and displaying the names of all available databases on the target database management system (DBMS) server. It leverages identified SQL injection vulnerabilities to extract this high-level structural information, providing a foundational understanding of the server's data organization. This is a crucial initial step in reconnaissance for a penetration tester, revealing the scope of potential data stores.

Aircrack-ng is a comprehensive suite of tools specifically designed for auditing wireless networks, including capturing and cracking WPA/WPA2 PSK handshakes. It directly processes the captured 4-way handshake file (typically a .cap file) and attempts to crack the Pre-Shared Key (PSK) using dictionary attacks against the cryptographic nonce and EAPOL frames. Its aircrack-ng component is the definitive tool for performing dictionary-based brute-force or wordlist attacks against the captured WPA2 handshake.

SMiShing is a specialized form of phishing that utilizes Short Message Service (SMS) text messages to deceive individuals. Attackers send fraudulent text messages, often containing malicious links or requests for personal information, by impersonating legitimate organizations like banks, government agencies, or delivery services. Given that the employee received a "text message" claiming to be from a specific entity, SMiShing precisely describes this attack vector.

Reflected XSS occurs when an attacker's malicious script, typically delivered via a URL parameter or HTTP header, is immediately echoed back by the web server in its HTTP response without proper sanitization. The victim's browser then interprets and executes this script as part of the legitimate page content. This non-persistent attack requires the victim to click a specially crafted link or visit a malicious site that sends the crafted request, making it a single-request, single-response vulnerability.

The exhibit demonstrates SQL injection in a SOAP service, as the `userId` parameter in the request contains the payload '1 OR 1=1'. This classic SQL injection technique manipulates the backend SQL query, causing the `WHERE` clause to always evaluate to true. Consequently, the application returns all user records, bypassing intended access controls and confirming the vulnerability.

The Nmap idle scan (`-sI`) fundamentally relies on the zombie host's IP ID sequence number incrementing predictably by one for each packet it sends. The attacker sends spoofed SYN packets to the target, appearing to originate from the zombie. If the zombie is not truly idle and sends its own packets for other reasons, its IP ID sequence will increment unpredictably, making it impossible for the attacker to discern whether an IP ID increment was due to the target's response or the zombie's independent activity, thus leading to unreliable or false results.

The TCP connect scan (-sT) performs a full three-way handshake (SYN, SYN-ACK, ACK) with the target port, relying on the operating system's native `connect()` system call. If a port is genuinely open, the handshake completes. If a spoofed SYN-ACK is received, the scanner's subsequent ACK will likely be ignored by the true target, or the target will send a RST if the port is closed. This full interaction allows the scanner to observe the actual target's response to a completed connection attempt, thereby reliably determining the port's true state even if initial SYN-ACKs were manipulated.

Ransomware is a specific type of malicious software meticulously designed to encrypt a victim's files or lock access to their computer system. Its primary objective is extortion, demanding a ransom payment, typically in cryptocurrency, in exchange for a decryption key or restoration of access. Failure to pay often results in permanent data loss or continued system lockout, making it a highly destructive threat.

SQLMap is the standard tool for automated SQL injection detection and exploitation.

A de-authentication attack floods a target client or access point with de-authentication frames, forcing the client to disconnect from the legitimate Wi-Fi network. Immediately following this disconnection, an attacker's "evil twin" access point, which mimics the legitimate network's SSID, becomes the most attractive network for the now-disconnected client. The client then automatically connects to this rogue AP, allowing the attacker to serve a fake login page to capture credentials or redirect traffic.

The Social Engineering Toolkit (SET) is an open-source framework specifically engineered to perform various social engineering attacks, including spear-phishing, website attack vectors, and credential harvesting. It automates the creation of malicious web pages, email templates, and other deceptive elements crucial for a successful social engineering campaign. Therefore, SET is precisely designed to create and manage the components and execution of phishing and social engineering attacks.

VirusTotal is a web-based service that aggregates many antivirus products and online scan engines to check for viruses and other types of malicious content. A security analyst can submit a file's cryptographic hash (e.g., MD5, SHA1, SHA256) to VirusTotal, which then queries its extensive database and provides immediate detection results from numerous security vendors. This capability directly addresses the need to determine if a suspicious file is known malware by comparing its hash against a vast repository of threat intelligence.

Analyzing the Time-To-Live (TTL) and TCP window size fields from packets already captured from network traffic is a classic passive OS fingerprinting method. This technique does not involve sending any new packets to the target system; instead, it infers the operating system by examining the initial TTL values (which decrement per hop) and the advertised TCP window sizes, both of which often have distinct default values across different OS implementations. By observing these characteristics in legitimate, ongoing communications, an attacker can identify the OS without direct interaction.

A dictionary attack systematically attempts to log in using a predefined list of common passwords, often targeting specific user accounts like 'admin'. The observation of repeated failed login attempts to a Windows system is a classic indicator of such an attack in progress. Each incorrect password guess contributes to the failed attempt count, making this attack type directly align with the described scenario.

ScoutSuite is an open-source multi-cloud auditing tool specifically designed to assess the security posture of cloud environments. It enumerates resources and identifies potential misconfigurations, policy violations, and security weaknesses across major providers like Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). This comprehensive scanning helps organizations proactively identify and remediate risks within their cloud infrastructure.

A Certificate Authority (CA) serves as a trusted third party in a Public Key Infrastructure (PKI), primarily responsible for verifying the identity of entities (users, servers, organizations) and binding that identity to their public key. Upon successful verification, the CA issues a digital certificate, which it then cryptographically signs using its own private key. This digital signature assures recipients that the certificate is authentic, has not been tampered with, and was indeed issued by the stated CA, thereby establishing a chain of trust.

A Trojan backdoor establishes a hidden communication channel, allowing an attacker remote access and control over a compromised system. This type of malware is designed for persistence and stealth, often using less common or seemingly legitimate protocols like LDAP (Lightweight Directory Access Protocol) or DNS for command and control (C2) or data exfiltration. The "unusual amount of traffic" could stem from the attacker issuing commands, transferring files, or exfiltrating data through this covert channel, making it a strong candidate for a sustained, anomalous traffic pattern.

dnsenum is a powerful and comprehensive tool specifically designed for DNS enumeration during penetration tests. It automates various techniques, including attempting AXFR (Asynchronous Zone Transfer) requests, brute-forcing subdomains from a wordlist, performing reverse lookups on IP ranges, and querying for multiple DNS record types like MX, NS, and A records. This multi-faceted approach allows it to gather extensive information about a target's DNS infrastructure efficiently.

SUID (Set User ID) abuse is the correct technique because the SUID permission bit, when set on an executable file in Linux, allows any user to execute that binary with the effective user ID (EUID) of the file's owner, rather than the user who invoked it. If a binary owned by root has the SUID bit set and contains a vulnerability (e.g., insecure command execution, buffer overflow), an attacker can exploit it to execute commands or gain a shell with root privileges. This directly matches the scenario of finding a Linux binary with the SUID bit during a security assessment.

WPA3, introduced in 2018, significantly enhances wireless security by implementing Simultaneous Authentication of Equals (SAE), also known as the Dragonfly handshake. This robust key exchange protocol provides strong protection against offline dictionary attacks by making it computationally infeasible to guess passwords without an active connection. Furthermore, SAE ensures forward secrecy, meaning that even if the long-term key is compromised, past session data remains encrypted and secure.

RSA (Rivest–Shamir–Adleman) is a foundational asymmetric cryptographic algorithm, distinguished by its use of a mathematically linked pair of keys: a public key for encryption and a private key for decryption. This unique public/private key architecture allows anyone to encrypt data using the public key, but only the holder of the corresponding private key can decrypt it, correctly classifying it as an asymmetric scheme.

Configuring egress filtering on the network firewall is a highly effective and proactive measure. This technique inspects and blocks outbound traffic destined for known malicious domains or IP addresses, preventing the compromised IoT device from establishing command and control (C2) communications or exfiltrating data, thereby containing the threat at the network perimeter.

Burp Suite Intruder is specifically engineered for automating customized attacks against web applications by systematically injecting various payloads into designated request parameters. It enables testers to define specific insertion points and choose from multiple attack types (e.g., Sniper, Battering Ram, Pitchfork, Cluster Bomb) to iterate through wordlists or generate dynamic payloads, making it ideal for discovering vulnerabilities such as SQL injection, cross-site scripting, or brute-forcing credentials.

Masscan is purpose-built for ultra-fast port scanning, capable of scanning the entire internet in minutes by employing an asynchronous, stateless design that sends packets at an extremely high rate. It achieves this speed by operating like a network driver, transmitting packets directly and listening for responses, making it exceptionally efficient for quickly discovering open ports across massive IP address ranges, which is crucial for rapid reconnaissance in large-scale penetration tests.

ScoutSuite is a comprehensive open-source multi-cloud security auditing tool designed to identify misconfigurations and potential vulnerabilities across various cloud providers, including AWS, Azure, GCP, Alibaba Cloud, and OCI. It maps out the attack surface of cloud environments by fetching configuration data via API calls and presenting it in an intuitive, interactive HTML report. This allows security professionals to quickly assess the security posture and compliance of their cloud infrastructure.

Token impersonation is a direct privilege escalation technique enabled by the `SeTcbPrivilege`, also known as 'Act as part of the operating system'. This powerful privilege allows a process to create a new access token for any user or even the SYSTEM account, effectively assuming their security context. An attacker with this privilege can create a token representing a higher-privileged user and then execute commands or access resources with those elevated permissions.

In the cloud shared responsibility model, configuring security groups and firewall rules is a critical customer responsibility, falling under "security in the cloud." Security groups act as virtual firewalls at the instance level, controlling inbound and outbound traffic, while network access control lists (NACLs) operate at the subnet level. Customers must meticulously define these rules to protect their virtual machines, applications, and data from unauthorized network access and potential threats, ensuring proper isolation and secure communication pathways.

Performing a WHOIS lookup involves querying publicly accessible databases maintained by domain registrars and registries. This action retrieves domain registration details such as registrant contact information, administrative contacts, technical contacts, and registration dates without sending any packets directly to the target's infrastructure. Since the interaction is solely with a third-party public database, it constitutes passive reconnaissance.

Shodan is a specialized search engine that passively collects and indexes banner information from internet-connected devices, services, and industrial control systems worldwide. It allows ethical hackers to perform reconnaissance by searching for specific device types, open ports, software versions, and potential vulnerabilities without directly interacting with the target. This passive data collection makes it an excellent tool for initial footprinting, providing valuable insights into a target's external attack surface.

Firmware reversing involves extracting the embedded software from an IoT device, often through JTAG, UART, or memory chip dumping. Attackers then use tools like Ghidra or IDA Pro to analyze the binary code, searching for hardcoded credentials, cryptographic keys, backdoors, or exploitable buffer overflows and format string vulnerabilities. This process can uncover critical weaknesses that allow unauthorized access or control over the device.

Setting SameSite cookies to Lax or Strict significantly mitigates CSRF by controlling when cookies are sent with cross-site requests. Lax mode sends cookies only with top-level navigations (typically GET requests) and not with cross-site POST requests or iframes, preventing most forged state-changing requests. Strict mode offers even stronger protection by never sending cookies with any cross-site requests, ensuring the session cookie is only included for same-site origins.

This is static analysis.

Nmap sends packets directly to the target, making it active.

Dedicated infrastructure filters out attack traffic.

Ophcrack is a dedicated and highly effective tool specifically engineered for cracking Windows LM and NTLM password hashes by leveraging pre-computed rainbow tables. It comes pre-packaged with extensive rainbow tables optimized for various Windows password complexities, allowing for rapid password recovery without requiring significant computational power for brute-forcing. Its user-friendly interface and specialized focus make it the go-to solution for offline Windows password cracking using this method.

This is correct because Maltego primarily functions as an Open Source Intelligence (OSINT) gathering tool. It aggregates publicly available information from various internet sources, such as DNS records, WHOIS databases, social media profiles, and search engines, without initiating any direct network connections or probes to the target's infrastructure. This method allows testers to build a comprehensive organizational footprint discreetly, minimizing the risk of detection by the target's security systems.

RSA is a foundational asymmetric cryptographic algorithm, distinguished by its use of a mathematically linked public and private key pair. The public key can be freely distributed for encryption or signature verification, while the private key is kept secret for decryption or digital signing. This unique key separation allows for secure communication and authentication without prior key exchange, making it the correct classification.

Passive search via search engine.

A dictionary attack involves systematically attempting to log in using a predefined list of common words, phrases, or previously leaked passwords against a target username or set of usernames. This method leverages the widespread use of weak, easily guessable passwords by users, making it a highly efficient strategy for gaining unauthorized access. It is particularly effective when systems lack robust password policies or account lockout mechanisms to deter repeated login failures.

The WPA2 cracking process, once the 4-way handshake is captured, relies entirely on an offline dictionary attack against the derived Pairwise Master Key (PMK) hash. If the Pre-Shared Key (PSK) used by the target network is not present within the provided wordlist, the attack will inevitably fail to find a match. This is a fundamental limitation of dictionary attacks; they are only as effective as the comprehensiveness and relevance of the wordlist used to guess the password.

An ICMP flood, also known as a "ping flood," is a classic volumetric Denial-of-Service (DoS) attack where an attacker overwhelms a target system or network with a massive volume of ICMP echo request (ping) packets. The goal is to consume all available bandwidth or processing resources, preventing legitimate traffic from reaching the target. Often, these requests use spoofed source IP addresses to hide the attacker's identity and complicate mitigation efforts.

Blocking the attacker's IP address directly at the firewall provides the most immediate and effective containment for an ongoing resource exhaustion attack originating from a single source. A firewall operates at the network layer, allowing it to drop all packets from the specified IP address before they even reach the web server or application. This action instantly severs the attacker's connection and prevents any further malicious requests from impacting the application's availability, making it the optimal immediate response.

When Nmap reports a port as 'filtered', it signifies that the TCP or UDP probes sent to that port did not elicit any response from the target host. This behavior is characteristic of network security devices, such as firewalls (both network-based and host-based) or routers configured with Access Control Lists (ACLs), which are designed to silently drop incoming packets that do not match allowed rules. The probes are effectively absorbed into a "black hole," preventing Nmap from determining the true state of the port.

Attackers send small queries with spoofed source IP to open DNS resolvers, which reply with large responses to the victim.

Elliptic Curve Cryptography (ECC) is an asymmetric encryption algorithm that relies on the mathematical properties of elliptic curves over finite fields to create public and private key pairs. Its security is based on the difficulty of solving the elliptic curve discrete logarithm problem, allowing it to provide comparable security strength to RSA with significantly smaller key sizes. This efficiency makes ECC particularly well-suited for resource-constrained environments like mobile devices and for securing TLS connections.

Wireshark is the industry-standard graphical user interface (GUI) tool specifically designed for both capturing and interactively analyzing network packets in real-time or from saved capture files. It provides extensive protocol dissection capabilities, allowing analysts to drill down into individual packet headers and payloads, apply complex filters, and visualize network conversations. Its comprehensive features make it indispensable for network troubleshooting, security analysis, and protocol development.

John the Ripper is a dedicated, open-source password cracking tool specifically engineered to detect weak passwords in various systems. It excels at processing lists of password hashes, employing sophisticated techniques such as dictionary attacks, brute-force methods, and single crack modes to efficiently recover the original plaintext passwords from their hashed representations.

The SUID bit makes the script run as root, so it can read /etc/shadow. Users can exploit this to get hashes.

After discovering open SMB shares, the next logical step in a penetration test is to enumerate specific details about the SMB service. enum4linux is a specialized tool designed for this purpose, leveraging various SMB/Samba enumeration techniques. The -a flag instructs enum4linux to perform all available enumeration options, including listing users, groups, shares, and security policies, which provides critical information for subsequent exploitation attempts. This comprehensive enumeration helps identify valid usernames, potential weak policies, and further attack vectors.

Analyzing reverse proxy logs (e.g., NGINX, HAProxy) is crucial because they capture detailed information about incoming HTTP/HTTPS requests, including source IPs, user agents, request methods, and target URLs/API endpoints. Identifying a sudden, high volume of requests directed at a specific API endpoint, especially with diverse source IPs or suspicious user agents, strongly indicates a Layer 7 (application-layer) DDoS attack. This diagnostic step directly confirms the attack type and pinpoints the targeted service, enabling highly focused and effective countermeasures.

Electronic Codebook (ECB) mode encrypts each fixed-size block of plaintext independently using the same secret key. It does not employ any chaining mechanism between blocks, nor does it require an Initialization Vector (IV) or nonce. The only potential increase in data length results from padding the final plaintext block to meet the cipher's block size, making it the mode that introduces the absolute minimum cryptographic overhead and data expansion.

Burp Proxy is the core component for intercepting all HTTP/S traffic between the browser and the target application. It allows a penetration tester to view, analyze, and manually modify individual requests and responses in real-time before they reach their destination. This direct interception and on-the-fly modification capability is fundamental for understanding application behavior and initiating various attacks, often serving as the initial capture point for other Burp tools.

An Evil Twin attack is precisely characterized by an attacker setting up a rogue access point (AP) that mimics the SSID and other characteristics of a legitimate, trusted Wi-Fi network. The objective is to trick unsuspecting users into connecting to the attacker's fake AP, believing it to be the legitimate one. Once connected, the attacker can intercept, monitor, or manipulate all network traffic, potentially capturing credentials or injecting malicious content.

LDAP enumeration queries directory services.

Reaver exploits a critical design flaw within the Wi-Fi Protected Setup (WPS) protocol, specifically its PIN authentication mechanism. The 8-digit WPS PIN is validated in two halves, allowing an attacker to brute-force the first four digits and then the last three (the eighth digit is a checksum) independently. This significantly reduces the total number of attempts required from 10^8 to approximately 10^4 + 10^3, making the PIN susceptible to a practical brute-force attack that reveals the WPA2 PSK.

Ransomware encrypts files and demands ransom.

In a DNS amplification attack, the attacker crafts DNS queries but sets the source IP address of these queries to that of the intended victim. This IP spoofing is fundamental because it ensures that when the legitimate, but often misconfigured, DNS resolvers respond to these queries, the large response packets are directed back to the victim's IP address, effectively flooding their network interface. Without source IP spoofing, the amplified traffic would return to the attacker, defeating the purpose of the denial-of-service attack.

This scenario directly indicates Remote File Inclusion (RFI) because the application is fetching and executing or displaying content from an external, attacker-controlled HTTP server (http://attacker.com). RFI vulnerabilities allow an attacker to inject a remote URL into an include statement, causing the web server to download and process the specified file. This can lead to arbitrary code execution, data exfiltration, or defacement if the included file contains malicious scripts.

Telnet is an application-layer protocol and command-line utility that establishes a raw Transmission Control Protocol (TCP) connection to a specified port on a remote host. Upon successful connection, many network services are configured to immediately send an initial banner containing information such as the service type and version. This direct, interactive connection capability makes Telnet an effective tool for manually identifying unknown services by observing these initial banners.

A polymorphic virus is specifically designed to evade detection by antivirus software through its ability to change its internal structure and signature with each new infection. It achieves this by encrypting its own code and using a different decryption routine or "mutation engine" for each instance. This constant mutation of its executable code and decryption stub makes it extremely difficult for traditional signature-based antivirus scanners to identify it consistently, as its binary pattern is never the same.

A preimage attack is a cryptanalytic technique where an attacker, given a specific hash output (H), attempts to find an input message (M) such that H(M) = H. This directly violates the one-way property of a secure hash function, which dictates that it should be computationally infeasible to reverse the hashing process. Successfully performing a preimage attack compromises the integrity and authenticity guarantees provided by the hash, as an attacker could forge a message with a desired hash.

theHarvester excels at collecting crucial Open Source Intelligence (OSINT) such as email addresses, subdomains, and employee names by leveraging various public data sources. It systematically queries search engines like Google and Bing, social networks like LinkedIn, and specialized platforms like Shodan or Hunter.io, providing valuable initial reconnaissance data for penetration testers. This data is instrumental for crafting targeted phishing campaigns or identifying potential attack surfaces.

Customers are directly responsible for the configuration of Identity and Access Management (IAM) roles and permissions within their cloud environment. This involves defining users, groups, and roles, assigning appropriate permissions based on the principle of least privilege, and regularly auditing access policies. Proper IAM configuration is critical for controlling who can access what resources and is a primary customer security control.