Certified Ethical Hacker CEH (CEH) — Questions 226–300

The TCP handshake shown is for the 4-way handshake messages: first two messages (AP nonce and supplicant nonce) are exchanged, then the third message is the encrypted GTK, followed by ACK. The encrypted payload indicates the handshake is complete.

AWS is responsible for the physical host and network infrastructure; the customer manages the guest OS, applications, and security groups.

WHOIS queries are a classic passive reconnaissance technique because they retrieve publicly registered domain ownership data from WHOIS databases (e.g., registrar, creation date, name servers) without sending any packets directly to the target's infrastructure. This information is stored by third-party registries and is accessible via standard WHOIS protocol (RFC 3912) or web-based lookup tools, making it completely non-intrusive.

Shodan is a search engine specifically designed for footprinting and reconnaissance by scanning and indexing internet-connected devices, such as IoT devices, servers, and industrial control systems. It allows attackers to gather information about open ports, services, and banners without direct interaction with the target, making it a primary tool for passive reconnaissance in the CEH context.

Default credentials, insecure protocols like MQTT, and firmware reversing are all common IoT attack vectors. SQL injection is more typical for web applications.

CSRF tokens ensure the request originates from the legitimate site; SameSite cookies prevent the browser from sending cookies on cross-site requests.

Static analysis examines the binary without execution. Inspecting file metadata, searching for suspicious strings, and analyzing the file's structure (e.g., using PEiD) are static techniques. Monitoring registry changes and network connections require execution (dynamic analysis).

Option C is correct because an Nmap SYN scan sends raw SYN packets to target ports and analyzes the responses (SYN-ACK for open, RST for closed). This actively probes the target network, generating traffic that can be detected by intrusion detection systems, which is the defining characteristic of active reconnaissance.

Rate limiting restricts traffic per source, scrubbing centers filter malicious traffic, and anycast disperses traffic across multiple nodes to absorb attacks.

Privilege escalation is a core phase in the CEH system hacking methodology (CHPSET), which stands for Cracking, Hacking, Privilege Escalation, System Hacking, Erasing Tracks, and Tunneling. After initial access is gained, an attacker must escalate privileges (e.g., from a standard user to root or SYSTEM) to gain full control over the target system. This is achieved through techniques like exploiting kernel vulnerabilities, token manipulation, or using tools such as Metasploit's getsystem.

Ophcrack is specifically designed to crack Windows LM and NTLM password hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing each password individually, making it the correct choice for this targeted task.

Maltego is a tool that collects publicly available information from sources like DNS records, WHOIS databases, and social media without directly interacting with the target's systems. This aligns with passive reconnaissance, which relies on open-source intelligence (OSINT) and does not send any packets to the target's network. The CEH defines passive reconnaissance as gathering information without engaging the target, making option A correct.

Asymmetric cryptography uses key pairs (public and private). RSA is a well-known asymmetric algorithm. AES, 3DES, and RC4 are symmetric algorithms.

Option A is correct because Google dorking with `site:shopsmart.com filetype:php` is a passive reconnaissance technique that leverages cached or indexed pages in Google’s search engine. This can reveal the old `/dev/test.php` page or other PHP files that may still be accessible via cached content, even if the live server returns a 404. It maximizes information gain without sending any direct traffic to the target, thus avoiding alarms.

The `attrib +h +s` command sets both the hidden and system file attributes, which by default causes Windows Explorer and standard `dir` commands to omit the file from directory listings. This is a built-in, native technique that requires no third-party tools and is effective for basic concealment from casual inspection.

This is a dictionary attack because the attacker uses a predefined list of common usernames and passwords (a dictionary) against the SSH service. Unlike a brute-force attack that tries all possible combinations, a dictionary attack only tests likely entries from a wordlist, making it faster but limited to the dictionary's contents.

If the PSK is not in the wordlist, dictionary attacks will fail. Other steps (capture, cracking) were done correctly.

A distributed ICMP flood (ping flood) uses multiple sources to overwhelm a target with ICMP echo requests. Spoofed source addresses and varying packet sizes are common characteristics.

The attack is a resource exhaustion or application-layer DoS attack, where repeated requests to a database-backed endpoint (e.g., /product?id=1, /product?id=2) cause high CPU usage due to expensive ORM queries. The immediate best course is to block the single attacking IP at the firewall, as it stops the malicious traffic at the network perimeter with minimal overhead, preserving server resources for legitimate users.

When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

A DNS amplification attack uses open DNS resolvers to send large responses to a spoofed victim IP, amplifying traffic. The characteristics include UDP, port 53, spoofed source, and many sources (amplifiers).

RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. SHA-256 is a hash function.

These attacks target wireless networks and devices.

Wireshark is the standard tool for capturing and analyzing network packets in pcap format.

John the Ripper is a dedicated password cracking tool that supports dictionary attacks against various hash types, including Windows NTLM hashes. It takes the list of hashes and compares them against a wordlist of candidate passwords, making it the best choice for this task.

Option C is correct because the SUID bit on the 'backup' script, owned by root and world-executable, allows any user to execute it with root privileges. If the script reads /etc/shadow (which is normally root-only) and writes the output to a world-readable file, an attacker can exploit this to exfiltrate password hashes. This is a classic SUID abuse scenario where a privileged binary or script is used to access sensitive files.

The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.

Options B and D are correct. John the Ripper and Hashcat are well-known password cracking tools.

Option B is correct because the symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.

ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

An evil twin attack involves setting up a rogue access point that mimics a legitimate SSID to intercept traffic and capture credentials.

LDAP enumeration is a valid enumeration technique because it involves querying a Lightweight Directory Access Protocol (LDAP) service to extract information about users, groups, computers, and other objects from a directory service like Microsoft Active Directory. Attackers use tools such as ldapsearch or ADExplorer to anonymously or authenticatedly browse the directory tree, revealing usernames, group memberships, and organizational units, which are critical for planning further attacks.

Reaver is designed to exploit the WPS PIN brute-force vulnerability, where an attacker can recover the WPS PIN and then derive the WPA/WPA2 PSK.

Ransomware encrypts files and demands ransom, typically in cryptocurrency.

TCP sequence prediction is a core technique in session hijacking where an attacker predicts or sniffs the TCP sequence numbers used by the client and server to inject forged packets and take over an established TCP session. By correctly guessing the next sequence number, the attacker can spoof the client's IP address and send malicious commands that the server accepts as legitimate traffic.

DNS amplification uses open DNS resolvers, spoofs the victim's IP, and exploits small queries to generate large responses, thereby amplifying traffic.

RFI allows inclusion of remote files via HTTP/HTTPS URLs. Directory traversal with ../ is more typical of LFI. Inclusion of local files like /etc/passwd indicates LFI, not RFI.

Telnet can be used to connect to any TCP port, including port 4444, to manually interact with a service and retrieve its banner. Banners often reveal the service name, version, and other identifying information, which is critical for footprinting and reconnaissance. Even though the traffic is encrypted, the initial banner may be sent in cleartext before encryption begins, or the connection attempt itself can reveal the service type.

Polymorphic viruses change their code signature (using mutation engines) each replication to avoid detection.

Birthday attack exploits hash collisions, preimage attack finds an input that hashes to a given output, and collision attack finds two inputs with same hash. Man-in-the-middle is not specific to hash functions, and dictionary attack is a password cracking technique, not pure cryptanalysis.

TheHarvester is an open-source intelligence (OSINT) tool designed to gather publicly available information from search engines, PGP key servers, and social platforms. The command `-d example.com -b google,linkedin` instructs it to scrape Google and LinkedIn for email addresses, subdomains, and employee names associated with the target domain, which are classic footprinting data used in reconnaissance.

The customer is responsible for security IN the cloud, including configuring IAM policies, encryption, and access controls.

The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.

Option D is correct because the `-t axfr` flag in `dnsrecon` specifically attempts a DNS zone transfer (AXFR query) against the target domain's authoritative nameservers. A successful zone transfer returns all DNS records, including all subdomains, making it the most direct and effective method for subdomain enumeration via DNS zone transfer.

Option C is correct because the command uses the -sS flag for a TCP SYN scan (stealth scan), -sV for service version detection, and -O for OS fingerprinting, targeting only the four specified ports (22, 80, 443, 3389) across the 192.168.1.0/24 subnet. This combination performs a half-open TCP scan on those ports, probes open ports to identify service versions, and attempts to determine the operating system based on TCP/IP stack responses.

Option D is correct because a DNS server that allows recursive queries from the internet can be exploited in a DNS amplification attack, a type of denial-of-service (DoS) attack. The attacker sends a small query with a spoofed source IP (the victim's IP) to the open recursive resolver, which responds with a much larger response (e.g., using the ANY record type), amplifying traffic up to 50-100 times. This floods the victim's network, making the DNS server an unwitting participant in the attack.

Option D is correct because the VRFY command is specifically designed to verify whether a mailbox exists on an SMTP server. By issuing VRFY followed by usernames (root, admin, user1), the attacker can enumerate valid email users based on the server's responses (e.g., 250 or 251 for valid, 550 for invalid). This is a classic SMTP user enumeration technique.

Default credentials (e.g., admin/admin) and insecure protocols (e.g., MQTT without TLS) are frequently exploited in IoT.

A rogue AP often has a higher signal strength than expected, especially if it's placed closer to users. Additionally, a mismatch between the BSSID and the known legitimate AP can indicate spoofing.

The birthday attack exploits the birthday paradox in probability theory to find two different inputs that produce the same MD5 hash value (a collision) with significantly less effort than a brute-force preimage attack. For an n-bit hash, the birthday attack requires only about 2^(n/2) operations, making MD5's 128-bit output vulnerable to collisions in roughly 2^64 attempts, which is computationally feasible today.

enum4linux uses SMB and RPC calls to enumerate shares, users, groups, and other information. It can enumerate SMB shares via smbclient or rpcclient.

Amplification attacks exploit protocols that respond with larger payloads than the request, magnifying traffic. NTP and DNS are common examples.

Worms are standalone self-replicating malware that spread across networks without needing to attach to host files.

WebDAV with PUT enabled allows attackers to upload arbitrary files, including web shells, leading to remote code execution.

ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.

This is a null byte injection attack, where the %00 (null byte) terminates the string, bypassing extension checks to upload a PHP file.

This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.

Option C is correct. The -sS flag performs a TCP SYN (stealth) scan, -sV detects service versions, -O attempts OS fingerprinting, and -p restricts scanning to ports 22, 80, 443, and 3389. This combination identifies open ports, service versions, and OS on the target subnet.

The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.

ScoutSuite is an open-source multi-cloud security auditing tool that checks for common misconfigurations.

The payload defines an external entity (XXE) that reads a local file, indicating an XML External Entity (XXE) injection vulnerability.

Option B is correct because the `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.

Set up RADIUS, create WLAN, configure AP to use RADIUS, enable, test.

Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.

An S3 bucket with public listing enabled allows anyone to list objects via HTTP GET requests.

Slowloris sends partial HTTP requests to keep connections open, exhausting the server's connection pool.

Token impersonation allows a process to assume the security context of another user. Tools like `incognito` can list available tokens and impersonate them, often to gain administrator privileges.

WHOIS lookup is a passive reconnaissance technique because it queries public domain registration databases (via WHOIS protocol, RFC 3912) to obtain information such as registrar, registrant contact details, name servers, and expiration dates. This process does not send any packets directly to the target's infrastructure; instead, it relies on third-party data sources, making it undetectable by the target.

The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Anycast routing allows traffic to be directed to the nearest or best-performing server among multiple locations, helping absorb DDoS traffic.

The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.

DNS zone transfer (AXFR) is a mechanism defined in RFC 1034 and 1035 that allows a secondary DNS server to replicate the entire zone file from a primary authoritative server. The primary purpose is to obtain all DNS records for a domain, which is critical for reconnaissance during the footprinting phase, as it reveals subdomains, mail servers, and other infrastructure without brute-forcing.

DNSSEC adds cryptographic signatures to DNS data, preventing spoofed responses.

Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.