Certified Ethical Hacker CEH (CEH) — Questions 226–300

A file upload vulnerability arises when a web application permits users to upload files without sufficient validation of their type, content, or proper handling of their storage and execution. The ability for an attacker to upload a malicious PHP file, which is then executed by the web server, perfectly exemplifies this vulnerability. This allows for remote code execution (RCE) on the server, directly matching the described attack where a 'profile picture' turns out to be an executable script.

The `dnsrecon` utility, when invoked with the `-t axfr` flag, explicitly instructs the tool to attempt an AXFR (Asynchronous Full Zone Transfer) against the target domain. This command is specifically designed to enumerate all DNS records within a zone by requesting the entire zone file from the authoritative name servers. If successful due to misconfiguration, this provides a comprehensive map of the domain's infrastructure, including hostnames and IP addresses, which is highly valuable for reconnaissance.

This statement accurately describes the Nmap command's functionality. The -sS flag initiates a TCP SYN scan, a common and relatively stealthy method for port scanning that avoids completing the full TCP handshake. The -sV flag enables service version detection, attempting to determine the exact software and version running on open TCP ports. Additionally, the -O flag instructs Nmap to attempt OS fingerprinting, identifying the target's operating system. Finally, the -p 22,80,443,3389 option restricts the scan to precisely these four specified TCP ports.

The VRFY (Verify) command is an SMTP instruction specifically designed to query the mail server about the existence and validity of a particular mailbox name. A compliant server will respond by either confirming the user's full name and mailbox, or by indicating that the user does not exist. This direct feedback mechanism makes VRFY an ideal and explicit command for enumerating valid user accounts on a mail server.

Many IoT devices are manufactured with default usernames and passwords that are either hardcoded, easily guessable, or publicly known. Users often neglect to change these factory settings, creating a significant vulnerability that persists throughout the device's lifecycle. Attackers can leverage these weak or default credentials to gain unauthorized access, take control of the device, or integrate it into botnets without needing complex exploits.

This combination is a strong indicator of a rogue AP. The Basic Service Set Identifier (BSSID), which is the MAC address of the AP, contains an Organizationally Unique Identifier (OUI) that identifies the manufacturer. While a rogue AP might spoof an OUI to appear legitimate, an unusually high signal strength for an AP not registered within the network's inventory strongly suggests a physically close, unauthorized device. This discrepancy between a potentially legitimate-looking identifier and an anomalous physical presence is highly suspicious.

The Birthday attack leverages the mathematical 'birthday paradox' to significantly reduce the computational effort required to find two distinct inputs that produce the same hash output (a collision). For hash functions like MD5, which has a 128-bit output, finding a collision through brute force would theoretically require 2^64 attempts, making it practically feasible. This vulnerability undermines the integrity and collision resistance properties critical for cryptographic security, as demonstrated against MD5.

`enum4linux` is a dedicated Linux command-line utility specifically engineered to enumerate SMB (Server Message Block) information from Windows and Samba systems. It leverages the SMB protocol, primarily over TCP port 445, to gather critical intelligence such as user accounts, group memberships, available network shares, and password policies. This direct interaction with SMB services makes it the correct tool for detailed reconnaissance of SMB-based targets.

DNS amplification is a type of Distributed Denial-of-Service (DDoS) attack that leverages open DNS resolvers. An attacker spoofs the victim's IP address and sends small DNS queries to numerous vulnerable DNS servers. These servers then respond with significantly larger DNS records, often hundreds of times the size of the initial query, directing this amplified traffic to the spoofed victim, overwhelming their network bandwidth. This attack exploits the stateless nature of UDP.

Worms are a class of standalone malware that self-replicate and propagate across computer networks without requiring a host program or user intervention. They exploit network vulnerabilities or misconfigurations to spread automatically from one system to another, consuming bandwidth and system resources. This autonomous propagation is their defining characteristic, enabling rapid infection across interconnected devices.

The ability to upload and execute arbitrary files via WebDAV PUT requests constitutes a critical file upload vulnerability. WebDAV's PUT method allows clients to create or replace resources on the server. If this functionality is enabled without strict access controls, file type validation, or execution restrictions, an attacker can upload malicious scripts (e.g., web shells) and subsequently execute them, leading to remote code execution on the server.

ldapsearch is the correct command-line utility for querying LDAP (Lightweight Directory Access Protocol) directories, which Active Directory heavily utilizes for storing user, group, and computer information. During a penetration test, it allows an attacker to enumerate users, groups, and their attributes by directly querying a domain controller. This tool is indispensable for mapping out an organization's user base and understanding its structure within an Active Directory environment.

Null byte injection exploits the \x00 (or %00 in URL-encoded form) character, which is interpreted as a string terminator by many C-based functions and some older APIs. When used in a filename like "filename.php%00.jpg", the server's file type validation might see ".jpg" due to string processing, but the underlying file system or save function truncates the name at the null byte, resulting in "filename.php". This allows an attacker to upload a malicious file with a forbidden extension by effectively tricking the filter.

Server-Side Request Forgery (SSRF) occurs when a web application is coerced into making an HTTP request to an arbitrary URL specified by an attacker. This vulnerability allows an attacker to force the server to connect to internal or external systems, often bypassing firewalls or accessing sensitive internal services. The use of the file:// protocol in the URL parameter is a classic indicator, enabling the server to fetch local files from its own filesystem, effectively turning the server into a proxy for accessing internal resources.

The `nmap -sS -sV -O -p 22,80,443,3389` command initiates a TCP SYN scan, often termed a 'stealth scan,' which sends SYN packets without completing the full TCP handshake to identify open ports. Concurrently, the `-sV` flag attempts to detect the specific service and its version running on these ports, while `-O` endeavors to fingerprint the target's operating system. The `-p` flag precisely limits this comprehensive reconnaissance to only ports 22, 80, 443, and 3389, making it a highly targeted information gathering effort.

The 0.0.0.0/0 rule allows any IP address on the internet to attempt a connection to the database on the specified port (3306 for MySQL/MariaDB), representing a critical security vulnerability. By replacing it with a rule that permits inbound traffic only from the security group associated with the application servers, access is tightly controlled and limited to legitimate, internal components. This effectively eliminates the public exposure and directly addresses the network access vulnerability, adhering to the principle of least privilege.

ScoutSuite is an open-source multi-cloud security auditing tool specifically engineered to assess the security posture of cloud environments. It automatically collects configuration data from various cloud providers, including AWS, Azure, GCP, Alibaba Cloud, and OCI, and then identifies potential security 'gaps' or misconfigurations. The tool generates a comprehensive report highlighting risks against best practices and compliance frameworks, making it ideal for auditing cloud infrastructure.

XXE injection exploits vulnerabilities in XML parsers that are configured to process external entities within a Document Type Definition (DTD). By defining a `SYSTEM` entity that references a local file path, such as `/etc/passwd`, the attacker can compel the XML parser to read the content of that file. This content is then often returned within the application's response or an error message, enabling sensitive data exfiltration directly through XML processing.

-sS = SYN/stealth scan, -sV = version detection, -O = OS fingerprinting, -p 22,80,443,3389 = scan only these four ports. This is a targeted reconnaissance scan.

Masscan is designed for high-speed scanning of large address spaces.

The `wget http` command is a standard utility for retrieving content from web servers, and when directed at an S3 bucket URL, it attempts to access the bucket without any AWS authentication. If this command successfully lists the bucket's contents, it unequivocally indicates that the Amazon S3 bucket has been misconfigured with a bucket policy or Access Control List (ACL) that grants public "s3:ListBucket" permissions to "AllUsers" or "Everyone," allowing unauthenticated enumeration of its objects.

Slowloris is an application-layer denial-of-service attack designed to exhaust a web server's connection pool by holding open as many connections as possible for as long as possible. It achieves this by sending legitimate, but incomplete, HTTP requests, such as a partial GET request followed by sending additional HTTP headers at very slow intervals. This forces the server to keep these connections open, waiting for the full request, eventually preventing new legitimate connections from being established and rendering the server inaccessible.

A WHOIS lookup is a classic example of passive reconnaissance because it involves querying publicly available databases maintained by domain registrars and registries. This process retrieves information such as domain ownership, registration dates, and contact details without sending any packets directly to the target organization's network. Since the interaction is solely with a third-party database, the target system remains unaware of the information gathering attempt.

The exhibit clearly shows an attempt to manipulate a file path using `..%2f` sequences, which are URL-encoded representations of `../`. This technique aims to navigate outside of an intended directory and access restricted files, such as `/etc/passwd`, which stores user account information on Unix-like systems. Such an attack exploits inadequate input validation on user-supplied file paths, allowing an attacker to read or potentially write to arbitrary files on the server's file system.

Anycast routing effectively mitigates DDoS attacks by advertising the same IP address from multiple geographically dispersed servers. When a client initiates a connection, BGP (Border Gateway Gateway Protocol) directs traffic to the topologically nearest available Anycast node. This distribution dilutes the attack volume across numerous points of presence, making it significantly harder for attackers to overwhelm a single target and ensuring service continuity by absorbing the attack across a wide area.

DNS tunneling is a sophisticated data exfiltration technique that encapsulates arbitrary data within DNS queries and responses, creating a covert communication channel. Attackers use this method to bypass firewalls and intrusion detection systems that typically allow DNS traffic, enabling them to extract sensitive information from a compromised internal network to an external command-and-control server. This technique effectively hides data transfer in plain sight, making it a potent tool for stealthy data theft.

The primary purpose of performing a DNS zone transfer (AXFR or IXFR) is to replicate the entire set of DNS resource records (RRs) for a specific domain from a primary authoritative DNS server to a secondary authoritative DNS server. This process ensures that all secondary servers have an up-to-date, complete copy of the zone file, enabling them to authoritatively answer queries for the domain even if the primary server is unavailable. For ethical hackers, a successful zone transfer can reveal extensive network topology information.

DNSSEC (Domain Name System Security Extensions) directly addresses DNS spoofing by adding cryptographic digital signatures to DNS records. These signatures allow DNS resolvers to cryptographically verify the authenticity and integrity of DNS responses, ensuring that the data originated from the correct authoritative server and has not been tampered with in transit. This validation process establishes a chain of trust, making it possible to detect and reject forged or manipulated DNS information, thereby preventing spoofing attacks.

Enabling multi-factor authentication (MFA) for all users is the most effective defense against credential stuffing attacks. Even if an attacker successfully uses a stolen username and password combination, they will be unable to authenticate without possession of the second factor, such as a one-time code from an authenticator app, a hardware token, or a biometric verification. This additional layer of security renders the compromised credentials useless for unauthorized access, making it the strongest preventative measure.

The -sS flag initiates a TCP SYN scan, often referred to as a "stealth scan" because it does not complete the full TCP three-way handshake. Nmap sends a SYN packet and, if a SYN/ACK is received, it immediately sends an RST packet instead of the final ACK. This technique helps avoid logging on the target system as a full connection is never established, making it less intrusive and harder to detect by some firewalls and intrusion detection systems.

This approach is highly efficient and targeted for identifying devices running a specific service. A TCP SYN scan on port 22 (SSH) across the target IP range quickly identifies hosts listening on this port without establishing a full connection, thus minimizing network overhead and remaining relatively stealthy. Enabling version detection simultaneously gathers crucial information about the SSH service's software version, which is essential for identifying potential vulnerabilities without further extensive scanning.

The `nbtstat -a 192.168.1.50` command correctly utilizes the `-a` (adapter status) flag to query the NetBIOS name table of the remote host at the specified IP address. This command enumerates the NetBIOS names registered by that system, including unique names, group names, and the services running on it, often revealing the computer name, workgroup/domain, and even the MAC address. This information is crucial for understanding the NetBIOS identity of a remote machine on the network.

This method directly describes steganography, which is the art and science of hiding information within other non-secret messages or data. By embedding a secret message or an entire file within the seemingly innocuous data of a cover medium, such as an image, the existence of the hidden information is concealed. Techniques like Least Significant Bit (LSB) manipulation subtly alter the least significant bits of pixel data, making the embedded data visually imperceptible without specialized analysis tools.

MD5 is critically vulnerable to collision attacks, where two distinct input messages can be found that produce the exact same 128-bit hash output. Practical methods for generating such collisions have been demonstrated, allowing attackers to forge digital signatures or create malicious files that appear legitimate. This fundamental weakness in its collision resistance makes MD5 unsuitable for security-critical applications requiring integrity verification.

theHarvester is an open-source intelligence (OSINT) tool specifically engineered for gathering publicly available information, including email addresses, subdomains, hostnames, and employee names. It achieves this by querying various public data sources such as search engines (e.g., Google, Bing), PGP key servers, and social media platforms like LinkedIn. This targeted approach makes theHarvester highly effective during the reconnaissance phase for compiling lists of potential email targets from publicly accessible information.

Out-of-band SQL injection occurs when an attacker cannot retrieve data directly through the same communication channel used for the injection. Instead, the attacker leverages the database server's ability to make external network requests, such as DNS lookups or HTTP requests, to exfiltrate data to a server controlled by the attacker. This technique is particularly useful in blind scenarios where traditional in-band methods are not feasible, creating a separate channel for data retrieval.

The fallback mechanism in SSL/TLS implementations is the correct answer because many older SSL/TLS client implementations included a compatibility fallback mechanism. If the initial handshake with a preferred, stronger protocol version failed, the client would attempt to re-establish the connection using an older, less secure protocol version. An attacker exploits this by intercepting the initial ClientHello, blocking the server's preferred protocol response, and then tricking the client into initiating a connection with a vulnerable, older protocol like SSLv3, thereby enabling further exploitation.

Rootkit installation is a highly effective post-exploitation technique for maintaining persistent access and evading detection on a compromised Linux server. Rootkits often replace legitimate system binaries (like ls, ps, netstat) with malicious versions that filter out evidence of the attacker's activities, such as hidden processes or network connections. Concurrently, log cleaners are used to erase entries from system logs (e.g., /var/log/auth.log, /var/log/syslog) that would reveal the initial compromise or subsequent actions, ensuring the attacker's presence remains concealed.

When `dnsenum` successfully enumerates NS and MX records but subsequently fails to perform a zone transfer, it is a clear indication that the DNS server is active and the domain exists, but it is specifically configured to deny zone transfer requests from unauthorized hosts. This is a standard and recommended security practice, often implemented via `allow-transfer` directives, to prevent attackers from obtaining a full list of domain records.

dnsrecon is a dedicated DNS enumeration script specifically designed to gather extensive information about DNS infrastructure. It actively attempts various DNS queries, including brute-forcing subdomains, checking for wildcards, and crucially, attempting zone transfers (AXFR requests) against identified name servers. This tool is specifically built to uncover misconfigured DNS servers that might inadvertently disclose internal network details through successful zone transfers, making it highly effective for this task.

LoRaWAN (Long Range Wide Area Network) is the optimal choice for IoT sensors in a remote facility with limited power because it is specifically engineered for low-power, wide-area (LPWAN) applications. It provides exceptional long-range communication capabilities, often spanning several kilometers in rural settings, combined with extremely low power consumption. This allows sensors to operate efficiently for many years on small batteries, perfectly aligning with the requirements for remote, power-constrained IoT deployments.

Shodan is a powerful OSINT search engine that passively collects information about internet-connected devices, services, and their configurations by continuously scanning the entire internet. Users can then query this vast database to discover exposed ports, vulnerable services, and device metadata without directly interacting with the target, making it a prime example of open-source intelligence.

Pacu is an advanced open-source exploitation framework specifically engineered to automate various penetration testing tasks within Amazon Web Services (AWS) environments. It provides a modular approach, allowing testers to enumerate resources, identify misconfigurations, and execute post-exploitation activities against AWS services like EC2, S3, IAM, and Lambda. This automation significantly streamlines the process of discovering and exploiting security weaknesses in complex AWS deployments.

Hypertext Transfer Protocol Secure (HTTPS) is the secure version of HTTP, utilizing Transport Layer Security (TLS), or its deprecated predecessor SSL, to encrypt communication between a web browser and a server. This encryption protects the confidentiality and integrity of data exchanged, including sensitive information like login credentials, financial transactions, and personal data, by preventing unauthorized eavesdropping and tampering. HTTPS ensures that an attacker cannot easily intercept and read the web traffic, thereby securing user interactions and preventing data compromise.

XML External Entity (XXE) injection is the correct answer because the scenario describes an attacker leveraging an XML parser to process user-supplied XML containing references to external entities. By defining an external entity that points to a local file path, such as file:///etc/passwd, the vulnerable parser is tricked into reading the content of that file. This content is then embedded within the XML document's response, leading to the unauthorized disclosure of sensitive server-side information.

Anti-VM and sandbox evasion techniques are employed by malware to determine if it is executing within a virtualized environment or an automated analysis sandbox, which often have deliberately limited resources. Checking for low CPU core counts, minimal RAM, small disk sizes, or generic hardware identifiers are common heuristics used by malware to detect these environments. If such conditions are met, the malware may alter its behavior, remain dormant, or self-terminate to avoid detection and analysis, thus preserving its efficacy.

When a session token expires, the server invalidates the associated user session, meaning it no longer recognizes the client as authenticated. This is a common security measure to limit the window of opportunity for session hijacking. Upon receiving a request with an expired or invalid session token, the application's security logic often redirects the user to the login page (HTTP 302 Found) to prompt re-authentication and establish a new, valid session. This behavior directly aligns with the observed 302 redirect.

Tailgating is physically following someone through a secure entrance.

SNMP uses UDP ports 161 (agent) and 162 (manager).

Ransomware is a malicious software that encrypts a victim's files, rendering them inaccessible, and then demands a ransom payment, typically in cryptocurrency, for the decryption key. This type of malware explicitly holds data hostage, threatening permanent data loss if the payment is not made within a specified timeframe. Its defining characteristic is the encryption of user data and the subsequent extortion attempt.

Many IoT devices rely on lightweight communication protocols such as MQTT or CoAP, which frequently lack built-in encryption or robust authentication by default. This inherent insecurity allows attackers to easily eavesdrop on sensitive data transmissions, inject malicious commands, or spoof device identities through simple network sniffing. Such vulnerabilities directly compromise data confidentiality, device integrity, and command authenticity, making them prime targets for unauthorized access and control.

-L lists shares, -N uses null session.

Traceroute is a fundamental network diagnostic tool that maps the path a packet takes to reach a destination by strategically manipulating the IP packet's Time To Live (TTL) field. It sends a series of packets, starting with a TTL of 1 and incrementing it, causing intermediate routers to decrement the TTL to zero and respond with an ICMP Time Exceeded message. Each ICMP response reveals an intermediate router (hop), effectively tracing the full network path hop-by-hop and identifying the sequence of devices. This method is precisely designed for network topology discovery.

Intruder is specifically designed for automating customized attacks against web applications by systematically injecting multiple payloads into designated insertion points within HTTP requests. It excels at tasks like brute-forcing credentials, fuzzing parameters for injection vulnerabilities (SQLi, XSS), and enumerating valid inputs by delivering a large number of varied payloads and analyzing the responses. Its highly configurable payload generation and attack types make it the ideal tool for automated vulnerability discovery.

theHarvester is a specialized command-line tool explicitly engineered for passive information gathering, or Open Source Intelligence (OSINT), by querying public data sources. It systematically extracts valuable intelligence such as email addresses, subdomains, hostnames, employee names, and banner information from search engines like Google and Bing, as well as public databases like Shodan and Hunter.io, without directly interacting with the target network.

Password spraying is a low-and-slow attack strategy where an attacker uses a small, curated list of extremely common or default passwords against a very large number of usernames within a target system. The primary goal is to avoid triggering account lockout thresholds, which typically activate after multiple failed login attempts on a *single user account*, by distributing the password attempts horizontally across many accounts.

A rootkit is a collection of tools designed to obtain and maintain privileged access on a computer while actively hiding its presence from administrators and security software. It achieves this by replacing legitimate system binaries with malicious versions, hooking system calls to manipulate output (e.g., hiding processes or files), and modifying log files to erase traces of its activity. This comprehensive subversion of the operating system allows an attacker to maintain persistent, stealthy control over the compromised Linux system.

Masscan is specifically engineered for high-performance, asynchronous SYN scanning across vast IP ranges. Its custom TCP/IP stack allows it to send SYN packets and process SYN-ACK responses at rates exceeding millions of packets per second, far surpassing traditional scanners. This design enables rapid discovery of open ports across entire internet segments or all 65,535 ports on numerous targets, making it ideal for large-scale reconnaissance.

Directory listing, when enabled on an Apache server, allows an attacker to browse the contents of a directory like a file system. This directly exposes the names and potentially the content of all files within that directory, including configuration files (e.g., .env, web.config), backup files (.bak, .zip), log files, or even source code, which could contain credentials or other sensitive data. Unauthorized access to such files represents a significant information disclosure vulnerability.

Clearing the Security event log directly addresses the goal of erasing evidence because this log specifically records critical system events, including successful and failed login attempts, privilege escalations, object access, and other security-relevant actions. By deleting these entries, an attacker effectively removes the digital breadcrumbs that forensic investigators would use to reconstruct the timeline and nature of the intrusion. This action significantly hinders incident response and attribution efforts.

A Smurf attack is a classic denial-of-service technique that exploits ICMP echo requests and network broadcast addresses. The attacker sends ICMP echo requests to a network's broadcast address, spoofing the source IP to be the victim's address. All hosts on that broadcast network then reply to the victim's spoofed IP, creating a massive flood of ICMP echo replies that overwhelms the victim's network bandwidth and resources.

A strong indicator of SSRF is when the server's response to an external request inadvertently includes data or error messages that clearly originate from internal network addresses, such as http://localhost/ or http://192.168.x.x/. This suggests the application processed a user-supplied URL that pointed to an internal resource, and then relayed the internal resource's content or status back to the attacker, confirming the server's ability to access and return data from its private network.

Exploiting a vulnerable SUID binary is a direct privilege escalation vector.

If find has SUID root, the -exec option runs commands with root privileges, spawning a root shell.

The '-a' (all) option in enum4linux is specifically designed to perform a full suite of enumeration functions against a target Windows or Samba system. This includes gathering a detailed user list, available SMB share names, operating system version information, the configured password policy, and comprehensive group memberships for identified users and groups. This comprehensive output provides critical intelligence for subsequent penetration testing phases.

Banner grabbing on port 22, typically used for SSH, is a fundamental reconnaissance technique. By connecting to the port and observing the initial response, an attacker can identify the specific SSH server software and its version number. This version information is crucial for cross-referencing against public vulnerability databases (e.g., CVEs) to discover known exploits, potentially leading to unauthorized access or privilege escalation if an outdated or misconfigured version is in use.

SQLMap is the industry-standard open-source penetration testing tool specifically designed to automate the process of detecting and exploiting SQL injection flaws and taking over database servers. It supports a wide array of SQL injection techniques, including boolean-based blind, time-based blind, error-based, UNION query, stacked queries, and out-of-band injections across various database management systems. Its robust capabilities extend beyond mere detection, enabling database fingerprinting, data fetching, file system access, and even command execution on the underlying operating system, making it highly specialized for this attack vector.

Error-based SQL injection is a technique where an attacker intentionally causes the database to generate error messages that contain sensitive information. By crafting malicious SQL queries that violate database constraints or syntax rules, the application's response will include detailed error messages, such as those from MySQL's EXTRACTVALUE or UPDATEXML functions, which inadvertently disclose database contents. This method directly "returns data" by embedding it within the visible error output.

Anti-CSRF tokens are unique, unpredictable, secret values generated by the server and embedded into forms or AJAX requests. When a user submits a request, the server verifies that the token received matches the one issued for that specific session. This mechanism prevents attackers from forging requests, as they cannot predict or obtain the valid token required for a successful submission from the legitimate user's browser session. Without a valid token, the server rejects the request, effectively blocking the CSRF attack.

Stored, or persistent, XSS is the most dangerous type, as the malicious script is permanently saved on the target server, typically in a database, comment section, or forum post. Once stored, the payload is delivered to every user who accesses the affected web page, without requiring any further interaction from the attacker. This allows for widespread and long-term compromise, as the script executes automatically each time the vulnerable content is rendered by a user's browser.

Directory traversal, also known as path traversal, is an attack that allows an attacker to access files and directories stored outside the intended web root directory. This is achieved by manipulating variables that reference files with "dot-dot-slash" (`../`) sequences, or similar absolute path representations, to navigate the file system. The URL pattern `../` precisely exemplifies this technique, enabling the attacker to move up the directory hierarchy to access unauthorized files.

Disabling specific older TLS versions like 1.0 and 1.1 on the server directly removes the server's capability to negotiate these protocols. If the server does not support or offer these versions, an attacker cannot force a client and server to communicate using them, thereby eliminating the target for a downgrade attack. This is a fundamental server-side configuration best practice for security.

A 'closed' port indicates that the target host is reachable and received Nmap's probe, but no application is currently listening on that specific port. For TCP scans, the target typically responds with an RST (reset) packet, confirming the port's accessibility while explicitly stating that no service is active there. This state is crucial as it differentiates between an inactive port and one that is blocked by a firewall, accurately reflecting the scenario where the host is up but the service is not running.

A brute force attack is a systematic password cracking technique that attempts every possible character combination within a defined character set and length until the correct password is found. This method guarantees finding the password if given enough time and computational resources, as it exhaustively explores the entire search space. Its primary drawback is the immense computational power and time required, especially for longer and more complex passwords.

MD5 produces a 128-bit hash value, which means its collision resistance against a birthday attack is approximately 2^64 operations. This level of complexity is well within the reach of modern computing resources, allowing for practical collision finding within a reasonable timeframe. Consequently, MD5 is widely considered cryptographically broken and highly vulnerable to birthday attacks, making it unsuitable for security-critical applications requiring collision resistance.