Certified Ethical Hacker CEH (CEH) — Questions 376–450

Clearing the System event log is a common anti-forensic technique used by attackers to remove traces of their activity. While specific password change events are typically found in the Security event log, the System log records critical operational events, errors, and warnings that could indirectly indicate system tampering or actions taken during an intrusion. Erasing this log directly removes a significant source of forensic evidence.

Maintaining Access is a phase after gaining initial entry.

Submitting the file's cryptographic hash (e.g., SHA256) to VirusTotal is an optimal initial step because it leverages a vast, aggregated threat intelligence database. This service quickly checks the hash against numerous antivirus engines, sandboxes, and community submissions, providing immediate insight into whether the file is known malware, its common names, and associated behaviors without requiring local execution or extensive analysis. This rapid identification is critical for efficient incident response triage.

Rootkits often replace system binaries to conceal their presence.

Netcraft is highly effective at identifying a website's hosting provider and geographical location. It achieves this by performing comprehensive DNS queries, correlating IP address ranges with registered Autonomous System Numbers (ASNs), and cross-referencing this data with known internet service providers and their physical infrastructure locations. This capability provides critical intelligence regarding the operational footprint and jurisdictional context of a target.

DNS tunneling is a sophisticated data exfiltration technique where malicious actors encode arbitrary data within DNS queries and responses, effectively creating a covert communication channel. This method leverages the legitimate and often unfiltered nature of DNS traffic (UDP port 53) to bypass firewalls and intrusion detection systems. A significant spike in outbound DNS traffic, especially with unusually large query sizes or frequent requests to suspicious domains, is a direct indicator of data being fragmented and transmitted out of the network via this covert channel.

Hardware keyloggers are physical devices designed to be inconspicuous, often resembling a standard cable adapter or a small inline dongle. They are typically inserted directly between the keyboard's cable and the computer's keyboard port (e.g., USB or PS/2). A direct physical examination of this connection point is the most reliable and often the only method to visually identify and remove such a device, as it bypasses all software-based detection limitations.

This dork finds URLs containing 'login.php'.

Implementing CSRF tokens involves embedding a unique, unpredictable, and secret value within each HTML form or AJAX request that modifies server-side state. The server generates this token and associates it with the user's session, then validates its presence and correctness upon submission. If the submitted token does not match the expected value, the server rejects the request, effectively preventing attackers from forging legitimate requests without knowledge of the specific token.

The -sS flag instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. This method sends a SYN packet to the target port; if a SYN/ACK is received, Nmap knows the port is open but does not complete the three-way handshake by sending an ACK. This technique often bypasses non-stateful firewalls and avoids full connection logs on the target system, making it less detectable than a full TCP connect scan.

Disconnecting the computer from the network is the immediate and most critical first step in containing a ransomware infection. This action severs the malware's ability to communicate with command-and-control (C2) servers, preventing further encryption key exchange, data exfiltration, or the reception of additional malicious instructions. Crucially, it also stops the ransomware from spreading laterally across the network to other systems or encrypting shared network drives, thereby limiting the scope of the compromise and preventing further damage.

LFI (Local File Inclusion) is the primary vulnerability, as the `include` function directly incorporates a local file path derived from user input, allowing an attacker to traverse directories (e.g., `../../`) and include arbitrary files from the server's file system. Null byte injection (`%00`) is crucial here because it can bypass the `.php` extension automatically appended by the application. By injecting `%00` after the desired file path (e.g., `/etc/passwd%00`), the server's string handling may truncate the string at the null byte, effectively ignoring the unwanted `.php` extension and including the specified file.

Parameterized queries, also known as prepared statements, are the most effective defense because they fundamentally separate SQL code from user-supplied data. The database engine pre-compiles the SQL query structure, treating all subsequent user input as literal data values, not executable code. This prevents malicious input from altering the query's intent, making SQL injection attacks virtually impossible against properly implemented parameterized queries.

IAM misuse directly describes scenarios where an attacker exploits existing, often overly permissive, Identity and Access Management (IAM) configurations to gain unauthorized access or elevate privileges. This frequently involves assuming an IAM role that has a trust policy configured to allow a compromised identity (e.g., another role, user, or service principal) to assume it, granting the attacker the permissions associated with that role. Such an action is a direct form of privilege escalation within the cloud environment, leveraging misconfigured trust relationships or policies.

AES (Advanced Encryption Standard) is correctly classified as a symmetric block cipher, meaning it utilizes the same secret key for both encrypting and decrypting data. It processes data in fixed-size blocks and supports key lengths of 128, 192, or 256 bits, making it highly efficient for bulk data encryption. Its widespread adoption as a standard for secure communication underscores its robust symmetric properties.

MD5, or Message-Digest Algorithm 5, is a widely known cryptographic hash function that produces a 128-bit hash value. It is definitively considered cryptographically broken due to the discovery of practical collision attacks, notably demonstrated in 2004. These vulnerabilities mean MD5 can no longer reliably guarantee data integrity or be used for digital signatures, making it unsuitable for secure applications.

Capturing packets and analyzing TTL values is a classic passive OS fingerprinting technique because it involves observing existing network traffic without sending any new packets to the target system. By passively sniffing packets that the target has already transmitted as part of its normal communication, an analyst can examine the Time-To-Live (TTL) field in the IP header. Different operating systems initialize TTL to distinct default values (e.g., 64, 128, 255), allowing for OS identification without any direct interaction or traffic generation.

enum4linux is a highly effective tool specifically designed for enumerating information from Windows and Samba hosts. It acts as a wrapper script, consolidating the functionality of various underlying utilities such as smbclient, rpcclient, and net to extract a wide array of details. This includes user lists, group memberships, share names, password policies, and even operating system information, making it an indispensable resource for comprehensive Server Message Block (SMB) enumeration during penetration tests.

Utilizing the file:// protocol within an SSRF vulnerability allows an attacker to force the vulnerable server to read local files from its own filesystem. By supplying a URL like file:///etc/passwd or file:///C:/Windows/System32/drivers/etc/hosts, the server processes this internal URI, retrieves the specified file's content, and potentially returns it in the application's response. This method directly exploits the server's ability to handle local file system requests.

The `nbtstat -A` (or `-a`) command is specifically designed to query a remote host's NetBIOS name table, displaying the NetBIOS names registered by that host. Each NetBIOS name is 16 characters long, with the 16th character (the suffix) indicating the service or application type associated with that name, such as `<20>` for a file server or `<00>` for a workstation service. This allows an analyst to identify active NetBIOS services on the target IP address, providing crucial reconnaissance information.

Stored XSS, also known as Persistent XSS, occurs when a malicious script is permanently saved on the target server, typically within a database. When other users access the vulnerable web page that retrieves and displays this stored data (e.g., feedback, comments, forum posts), the malicious script is delivered to their browsers and executed automatically. This makes it a highly dangerous form of XSS as it can impact a large number of users without requiring individual interaction with a crafted link.

Whaling is a specialized form of phishing attack specifically designed to target high-ranking individuals within an organization, such as CEOs, CFOs, or other senior executives. These attacks are often highly sophisticated, leveraging extensive research to craft convincing lures that exploit the target's position of authority and access to sensitive information or financial assets. The scenario involving the impersonation of a CEO directly aligns with the definition of whaling, as it targets a "big fish" with significant organizational power.

Pretexting involves an attacker fabricating a believable scenario and a false identity to manipulate a victim into divulging sensitive information. The attacker creates a detailed backstory, often impersonating someone in authority or a trusted entity, to establish a sense of legitimacy and urgency. This elaborate setup is designed to overcome the victim's skepticism and directly solicit specific data, like a password, through social engineering.

Low detection rate suggests it may be new malware; further analysis is warranted.

A SYN flood is a classic Denial-of-Service (DoS) attack that exploits the TCP three-way handshake. Attackers send a large volume of TCP SYN requests to a target server, often with spoofed source IP addresses. The server responds with SYN-ACK packets and allocates resources to maintain a half-open connection, waiting for the final ACK that never arrives, eventually exhausting its connection table and preventing legitimate connections.

XML External Entity (XXE) injection is a vulnerability that allows an attacker to interfere with an application's processing of XML data containing external entity references. By crafting malicious XML input, an attacker can exploit improperly configured XML parsers to include arbitrary files from the server's filesystem, initiate Server-Side Request Forgery (SSRF) attacks, or even execute remote code in certain environments. This directly leverages the application's use of XML for data transmission, making it the most relevant attack type when XML entity manipulation is implied.

Creating a specific firewall rule to block traffic originating from the thermostat's unique MAC address destined for the identified external IP address is a precise and effective containment strategy. This action immediately isolates the suspicious communication without impacting the functionality of other legitimate devices on the network or preventing further internal analysis of the compromised thermostat. It allows for targeted mitigation while preserving operational continuity and forensic evidence.

A Certificate Authority (CA) is a trusted third party that issues, manages, and revokes digital certificates. Its primary role within a Public Key Infrastructure (PKI) is to verify the identity of entities (users, devices, services) and bind their public keys to that identity through a signed digital certificate. CAs are fundamental to establishing trust in a PKI, as relying parties implicitly trust certificates signed by a CA they recognize.

SMTP user enumeration via VRFY is a technique where an attacker uses the VRFY (verify) command to query the mail server for the existence of specific usernames. A successful VRFY command typically elicits a "250 OK" response along with the full name or email address of the user if the account exists, whereas an invalid user often results in a "550 No such user" or similar error. This differential response allows an attacker to systematically build a list of valid user accounts on the system, which can then be used for further attacks like brute-forcing or phishing.

Account lockout after failed attempts is a highly effective mitigation against brute-force attacks because it directly prevents an attacker from making an unlimited number of password guesses for a specific account. After a predefined threshold of incorrect login attempts is reached, the system temporarily or permanently disables access for that user, forcing the attacker to cease their automated guessing against that particular target. This significantly increases the time and resources required for a successful compromise.

Patching all clients and access points is the recommended and most effective countermeasure against Key Reinstallation Attacks (KRACK). These patches specifically modify the WPA2 protocol's 4-way handshake implementation to prevent the reinstallation of an all-zero or previously used cryptographic key. By fixing this logic flaw, devices can properly establish and maintain secure, unique session keys, thereby mitigating the attack vector.

A rainbow table attack leverages large, precomputed tables containing hash chains generated using a specialized reduction function. These tables map hashes back to their original plaintext values by performing a lookup rather than real-time computation. When a target hash is found within the table, the corresponding chain is traversed to recover the original password, making it highly efficient for cracking hashes quickly without needing to recompute every possible password combination.

MQTT with TLS provides a robust and efficient solution for securing data in transit for IoT devices by encrypting the communication channel. TLS (Transport Layer Security) ensures confidentiality, data integrity, and server authentication, protecting MQTT control messages and payloads from eavesdropping and tampering. This combination leverages MQTT's lightweight publish-subscribe model with strong cryptographic security, making it ideal for constrained environments.

Its primary purpose is to gather emails and subdomains associated with a domain.

An evil twin attack precisely describes the scenario where an attacker sets up a rogue access point that mimics a legitimate one by using the same Service Set Identifier (SSID). The objective is to deceive unsuspecting users into connecting to the malicious AP, allowing the attacker to intercept their network traffic, capture credentials, or inject malware.

The Nmap -f (fragment) option instructs the scanner to split the TCP header of outgoing packets across several small IP fragments. This technique aims to bypass simple, stateless packet filters or intrusion detection systems (IDS) that only inspect the initial fragment of a packet. By distributing critical header information, such as port numbers or flag settings, across multiple fragments, a basic IDS might fail to reassemble the full packet and thus miss the malicious intent, allowing the scan to proceed undetected.

Slowloris holds connections open to exhaust server resources.

The enumeration of the Guest account SID is directly evidenced by the enum4linux output showing a Security Identifier (SID) ending with the Relative Identifier (RID) 501. RID 501 is a well-known, universal identifier for the Guest account on Windows systems. Successfully retrieving this specific SID confirms that the penetration tester has identified the unique identifier for the Guest account on the target machine, a key piece of reconnaissance information.

WHOIS queries public databases, no direct interaction with target.

Username enumeration occurs when a web application's login mechanism provides distinct responses or behaviors for valid versus invalid usernames. This difference, which could manifest as varying HTTP status codes, specific error messages (e.g., "Username exists" vs. "Invalid credentials"), or even subtle timing discrepancies, allows an attacker to systematically test usernames and identify which ones correspond to existing accounts. Once valid usernames are identified, they become targets for subsequent brute-force attacks or credential stuffing.

Vishing, a portmanteau of "voice" and "phishing," is a social engineering attack that utilizes voice communication, typically over telephone calls or Voice over IP (VoIP), to trick individuals. Attackers often impersonate trusted entities like banks, government agencies, or technical support to manipulate victims into revealing sensitive personal or financial information, or to perform actions like installing malicious software. Its defining characteristic is the direct, real-time vocal interaction with the target.

RainbowCrack is specifically engineered to utilize precomputed rainbow tables for rapid offline hash cracking. This technique capitalizes on a significant time-memory trade-off, where extensive upfront computation generates large tables that allow for near-instantaneous reversal of hashes back to their plaintext passwords. This makes it an exceptionally efficient method for processing large volumes of captured hashes, often yielding results in mere seconds.

A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and potentially altering the communication between two parties who believe they are directly communicating with each other. The attacker positions themselves between the victim and the legitimate server, intercepting all traffic and often impersonating both ends. This allows for real-time eavesdropping, data modification, and session hijacking, directly matching the scenario of an attacker intercepting communication.

The TCP SYN scan (-sS), also known as a "half-open" scan, is highly effective and stealthy because it initiates a TCP handshake but does not complete it. It sends a SYN packet and, upon receiving a SYN/ACK, immediately sends an RST, preventing full connection logging. This two-phase approach is optimal: initially scanning only the three known allowed ports across the subnet efficiently identifies active hosts, then a comprehensive SYN scan on all 65535 ports of *only* the live hosts provides a detailed service map while minimizing overall network footprint and detection risk.

Dynamic analysis involves executing the suspicious malware sample within a controlled environment, such as a sandbox or virtual machine, to observe its real-time behavior. This approach monitors system calls, network communications, file system modifications, and registry changes as the malware runs, providing critical insights into its operational characteristics and potential impact. By observing execution, analysts can understand how the malware interacts with its environment and what malicious actions it attempts.

This command's primary purpose is to extract NTLM password hashes from a compromised Windows system, typically targeting the Security Account Manager (SAM) database or the Local Security Authority Subsystem Service (LSASS) memory. Once extracted, these hashes can be transferred to an attacker-controlled machine for offline cracking using tools like Hashcat or John the Ripper. Offline cracking allows for brute-force or dictionary attacks without directly interacting with the target system, reducing detection risk and computational burden on the victim.

Rate limiting restricts the number of requests accepted from a source.

SUID privilege escalation occurs when a root-owned executable has its SUID bit set, allowing any user to execute it with the effective privileges of the file owner, typically root. Attackers can exploit this by finding or creating such binaries, then using them to spawn a root shell or execute arbitrary commands with elevated privileges. This is a common post-exploitation technique for maintaining root access or escalating from a low-privileged user, making it a highly plausible method for a compromised Linux system.

Erasing tracks, also known as anti-forensics or covering one's tracks, is a critical post-exploitation phase where an attacker attempts to remove or alter evidence of their presence and activities on a compromised system. This often involves deleting or modifying system logs, clearing command history, manipulating timestamps, or using secure deletion tools to prevent forensic analysis and maintain stealth. The goal is to avoid detection and hinder incident response efforts by making it difficult to reconstruct the attack chain.

Directory traversal, also known as path traversal, is an attack that allows an attacker to access files and directories stored outside the web root directory. The `../` sequences in the request are a clear indicator, as they instruct the server to navigate up the directory hierarchy. By repeatedly using `../`, the attacker attempts to escape the restricted web directory and access sensitive system files like `/etc/passwd`.

Hashcat is universally recognized as the world's fastest and most advanced password recovery utility, meticulously engineered to exploit the massive parallel processing power of modern Graphics Processing Units (GPUs). It supports an extensive and ever-growing list of hash algorithms and attack modes, including dictionary, brute-force, mask, and hybrid attacks, making it exceptionally efficient for high-speed cracking operations. Its highly optimized kernel code and ability to scale across multiple GPUs position it as the premier tool for rapid password hash analysis and recovery.

Passive reconnaissance uses publicly available information without direct interaction.

Targeted at a specific individual with personalized content.

Cross-Site Request Forgery (CSRF) exploits a user's authenticated session to force their browser to send an unwanted request to a vulnerable web application. A common defense against CSRF involves the server inspecting the HTTP Referer header to verify that the request originated from the application's own domain, preventing requests from external, malicious sites. An analyst successfully bypassing this Referer header check by manipulating or omitting it directly demonstrates a CSRF vulnerability, as the server's origin validation mechanism has been defeated.

A successful DNS zone transfer (AXFR or IXFR) is designed to replicate the entire DNS zone file from a primary (master) DNS server to a secondary (slave) DNS server. This process inherently exposes all resource records (A, AAAA, MX, NS, SOA, SRV, TXT, etc.) configured for that specific domain. Consequently, an attacker who successfully performs an unauthorized zone transfer gains comprehensive knowledge of the domain's network infrastructure and hosts.

Customers retain full responsibility for classifying their data based on sensitivity and implementing appropriate encryption mechanisms for their data, both at rest and in transit. This is a crucial "security in the cloud" responsibility because only the customer understands the regulatory, compliance, and business impact of their specific data. While the cloud provider offers encryption tools, the customer must configure and manage these data protection controls.

A dictionary attack is the most practical method for cracking WPA2-PSK when a 4-way handshake has been captured. Tools like Aircrack-ng take a wordlist and for each entry, derive the Pairwise Master Key (PMK) using PBKDF2 with the SSID as a salt. This derived PMK is then used to reconstruct the Message Integrity Code (MIC) from the captured handshake. If the calculated MIC matches the one in the captured handshake, the wordlist entry is confirmed as the correct Pre-Shared Key (PSK).

EXPN can reveal valid addresses from mailing lists; RCPT TO is another alternative.

RSA (Rivest-Shamir-Adleman) is a foundational asymmetric encryption algorithm that relies on the mathematical difficulty of factoring the product of two large prime numbers. It employs a distinct public key for encryption and a corresponding private key for decryption, enabling secure communication and digital signatures without prior key exchange. This public/private key pair structure is the defining characteristic of asymmetric cryptography, making it a correct example.

A Decoy scan is specifically designed to obscure the true source of a port scan by interspersing the attacker's real IP address with several spoofed IP addresses. The target receives scan packets appearing to originate from multiple hosts simultaneously, including the attacker's actual IP and numerous fake decoys. This technique generates significant noise in IDS logs, making it challenging to distinguish the legitimate attacker from the fabricated sources, potentially flagging one of the decoy IPs as the source.

Simple Network Management Protocol (SNMP) is a foundational protocol for managing and monitoring network devices, and it predominantly uses UDP for its operations. SNMP agents typically listen for manager requests on UDP port 161, while managers receive asynchronous notifications (traps and informs) on UDP port 162. Enumeration tools like `snmpwalk` specifically target UDP port 161 to query and retrieve the entire Management Information Base (MIB) tree from compliant devices, confirming its relevance to a service on UDP 161.

Aircrack-ng is specifically engineered to exploit the cryptographic weaknesses inherent in the WEP protocol, primarily by collecting a sufficient number of Initialization Vectors (IVs). It leverages statistical attacks, such as the FMS attack, to deduce the WEP key from patterns observed in these IVs, which are often reused or predictable due to WEP's design flaws. The tool then performs a brute-force or dictionary attack on the derived key space, making it highly effective when a large volume of IVs has been captured.

Token impersonation using RottenPotato is a highly effective local privilege escalation technique on Windows systems. It exploits the `SeImpersonatePrivilege`, often held by services like IIS or SQL Server, by leveraging NTLM relay attacks against local COM/DCOM services. This allows an attacker to trick a privileged process, typically running as `NT AUTHORITY\SYSTEM`, into authenticating to a malicious listener, enabling the attacker to impersonate the resulting SYSTEM token and gain full administrative control.

The NetBIOS suffix <20> (hexadecimal) is specifically registered by a computer running the Server service, which is fundamentally responsible for sharing files and printers over the network. When `nbtstat -a` reveals a <20> entry for a target IP address, it strongly indicates that the machine is configured to act as a file server, making its shared resources available to other network clients. This is the definitive indicator for a file server role.

The command macof -i eth0 specifically performs MAC flooding by continuously sending frames with randomly generated source MAC addresses to exhaust the switch's Content Addressable Memory (CAM) table. When the CAM table overflows, the switch typically enters a "fail-open" mode, behaving like a hub by broadcasting all incoming traffic out of all ports. This allows an attacker connected to any port on the switch to capture and analyze all network traffic, effectively bypassing the switch's normal segmentation.

The absence of Transport Layer Security (TLS) means that all MQTT communication, including connection requests, published messages, and subscription acknowledgments, is transmitted in cleartext over the network. Any attacker with network access can easily intercept and read these unencrypted messages using packet sniffers. This direct exposure of sensitive data, commands, or telemetry being exchanged between IoT devices and the MQTT broker constitutes an immediate and severe loss of message confidentiality.

A Man-in-the-Middle (MITM) attack occurs when an attacker intercepts communication between two parties, impersonating each to the other. If a client is configured to trust an untrusted or compromised Certificate Authority (CA), an attacker can leverage this trust to issue fraudulent SSL/TLS certificates for legitimate domains. This allows the attacker to decrypt, inspect, and re-encrypt traffic, effectively becoming the "man in the middle" without the client's browser raising certificate warnings, thereby compromising confidentiality and integrity.

Burp Intruder is specifically engineered to automate custom, payload-driven attacks against web applications. Users define "payload positions" within a base request, then configure various payload sets and attack types (e.g., Sniper, Battering Ram, Pitchfork) to systematically inject values into those positions. This powerful tool is ideal for brute-forcing, fuzzing, credential stuffing, and other repetitive tasks requiring automated request modification and response analysis.

Cracking passwords is a critical component of system hacking, often employed to gain initial unauthorized access to a system or to elevate privileges once inside. This involves using various techniques like brute-force, dictionary attacks, or rainbow tables against hashed credentials obtained from a target. Successful password cracking directly facilitates unauthorized authentication, enabling an attacker to impersonate legitimate users and access system resources.

A CSRF token is a unique, unpredictable, and secret value generated by the server and included with every state-changing request, typically embedded in hidden form fields or request headers. The server validates this token upon receiving the request, ensuring it matches the token associated with the user's session. Since a malicious attacker operating from a different origin cannot obtain or guess this secret token, they cannot craft a valid forged request that the server would accept, thereby effectively preventing CSRF attacks.

Disabling unnecessary URL schemas, such as `file://`, `dict://`, `gopher://`, or `ftp://`, is a crucial mitigation for Server-Side Request Forgery (SSRF). By restricting the protocols the server can use to make outbound requests, the attack surface is significantly reduced. This prevents attackers from leveraging the vulnerability to access local files, perform port scanning, or interact with internal services using non-HTTP protocols, thereby blocking common exploitation vectors.

Uses open DNS resolvers to amplify traffic to the victim.