Certified Ethical Hacker CEH (CEH) — Questions 451–525

Attackers often clear or modify logs to hide their activities.

The "host 10.0.0.5" filter inherently captures traffic where 10.0.0.5 is either the source or the destination IP address, encompassing both inbound and outbound communications. Coupled with "port 80", which identifies standard HTTP traffic, this command precisely targets all HTTP conversations involving the specified host, regardless of direction.

A Backdoor Trojan is malware disguised as legitimate software that, once executed, creates a covert entry point into a compromised system, bypassing normal authentication mechanisms. The "unusual outbound traffic" combined with the execution of `cmd.exe /c` on a non-standard port like 4444 is a classic indicator of a Remote Access Trojan (RAT) or backdoor establishing a command-and-control (C2) channel. This setup allows an attacker to remotely issue commands and control the compromised machine, aligning perfectly with the observed remote shell activity.

The output from a DNS query for MX records explicitly shows multiple entries, each specifying a mail exchanger (mail server) and an associated preference value. These preference values, such as 10 and 20, dictate the order in which sending mail servers should attempt delivery, with lower numbers indicating higher priority. This configuration confirms the existence of two distinct mail servers and establishes a prioritized delivery mechanism, providing both redundancy and a defined failover sequence for incoming email.

If the smart thermostat utilizes an unauthenticated MQTT broker, an attacker can directly publish arbitrary control commands (e.g., set temperature, change mode) to the device's designated topic. Concurrently, subscribing to the device's telemetry topics allows the attacker to intercept sensitive data like temperature readings, occupancy status, or operational logs. This demonstrates both device control compromise and data exfiltration without requiring any prior authentication or credentials, making it a primary and immediate vulnerability in many IoT deployments.

Cloud providers expose internal metadata services (e.g., AWS EC2 metadata service at `http://169.254.169.254/latest/meta-data/`) that contain highly sensitive information about the instance, including temporary security credentials, instance roles, and network configurations. An SSRF vulnerability allows an attacker to force the vulnerable server to make requests to this internal, unauthenticated endpoint. This enables the exfiltration of critical data, such as IAM role credentials, which can lead to significant compromise and privilege escalation within the cloud environment.

A backdoor Trojan establishes a covert communication channel, granting an attacker persistent remote access and control over the compromised system. This persistent access necessitates regular, often low-volume, communication with a Command and Control (C2) server to receive commands, exfiltrate data, or update its status. The observed 'gradual increase in network traffic' is highly indicative of such C2 activity, as the attacker intermittently interacts with the backdoor over time, leading to a subtle but sustained rise in outbound or inbound connections.

This statement accurately describes the core differences. Reflected XSS is non-persistent because the malicious payload is delivered via a crafted URL or form submission and is immediately reflected in the server's response, requiring the victim to click a specific link. In contrast, Stored XSS is persistent; the malicious script is permanently saved on the target server (e.g., in a database) and is then served to any user who accesses the vulnerable web page, affecting multiple users without individual interaction beyond visiting the compromised page.

An SNMP walk often reveals the community string, especially if it's a default or commonly used value. The string "cisco" is a well-known default or weak community string, making it highly susceptible to discovery by attackers. Gaining access with such a string allows an attacker to perform extensive reconnaissance, retrieve sensitive device configuration, and potentially monitor network traffic. This represents a significant security vulnerability that should be remediated immediately.

The sender's private key is the correct cryptographic component used to create a digital signature. This unique, secret key is applied to a hash of the email content, producing a signature that proves the sender's identity and ensures message integrity. Only the legitimate sender possesses this key, thereby providing non-repudiation and guaranteeing authenticity to the recipient.

This prevents the enumeration technique entirely.

XML External Entity (XXE) injection occurs when an XML parser processes a DOCTYPE declaration that defines an external entity, allowing the attacker to include content from external URIs or local files into the XML document. By defining an entity that points to a file path like `/etc/passwd`, the server's XML parser will attempt to resolve and embed the file's content within the XML response or process it internally. This vulnerability leverages the server's ability to fetch resources specified within the DTD, leading to information disclosure or even server-side request forgery.

Nessus is a leading commercial vulnerability scanner designed to identify security weaknesses across a wide range of systems and applications. It actively probes targets for misconfigurations, missing security patches, default credentials, and known vulnerabilities (CVEs) by comparing system responses against an extensive, frequently updated vulnerability database. Its comprehensive reporting capabilities provide actionable insights for remediation, making it an essential tool for proactive vulnerability management programs.

A backdoor Trojan is designed to provide covert remote access to a compromised system, often establishing persistent communication channels with Command and Control (C2) servers. This communication frequently occurs over encrypted protocols like HTTPS to evade detection and blend with legitimate network traffic. The observed significant increase in outbound HTTPS traffic to multiple IP addresses is highly characteristic of a backdoor Trojan actively exfiltrating data, receiving commands, or updating its C2 infrastructure.

Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on LANs, specifically designed for ARP poisoning. It actively injects forged ARP replies into the network, tricking hosts into believing the attacker's MAC address is associated with the gateway's IP, and vice-versa. This redirection allows Ettercap to intercept, analyze, and even modify traffic between victims, making it a primary tool for detecting and executing ARP-based attacks.

Stored Cross-Site Scripting (XSS), also known as Persistent XSS, occurs when a malicious script is permanently saved on the target server, typically within a database, message board, or comment section. When any user subsequently accesses the affected web page, the server retrieves and delivers the stored malicious payload along with the legitimate content. This script then executes automatically in the victim's browser, impacting all users who view the compromised data without requiring any specific interaction from them beyond page access.

SHA-1 (Secure Hash Algorithm 1) generates a 160-bit (20-byte) hash value, typically represented as a 40-character hexadecimal string. Historically, SHA-1 was a prevalent cryptographic hash function used for digital signatures and integrity verification, making it a common answer in questions about specific hash lengths. Despite its past widespread adoption, SHA-1 is now considered cryptographically insecure due to practical collision attacks and has been deprecated for most security-critical applications.

Advanced Encryption Standard (AES) is the correct answer because it is a symmetric block cipher that processes data in fixed-size blocks of 128 bits. AES supports various key sizes, including 128, 192, and 256 bits, providing strong security. Its design as a robust and efficient block cipher has established it as the global standard for symmetric encryption, fulfilling both the symmetric classification and the 128-bit block size requirement.

Aircrack-ng is the definitive suite of tools for auditing wireless networks, specifically engineered for tasks like cracking WPA/WPA2-PSK keys. After capturing a complete 4-way handshake, the `aircrack-ng` component can efficiently perform dictionary attacks or brute-force attempts. It takes a wordlist and iteratively computes the Pairwise Master Key (PMK) for each candidate password, comparing the resulting Message Integrity Check (MIC) with the one contained within the captured handshake to validate the correct passphrase.

In-band SQL injection is SQLMap's default and preferred method because it allows the attacker to retrieve data directly through the same communication channel used for the original query. This category includes UNION-based attacks, which append a malicious SELECT statement to the original query to return additional data, and error-based attacks, which force the database to return error messages containing query results. These methods are generally the fastest and most efficient for data extraction when applicable, providing immediate feedback.

The 'filtered' state in Nmap output precisely indicates that Nmap was unable to ascertain whether a port is open or closed because its probes did not elicit a response. This condition commonly arises when a firewall or other packet filtering device is actively dropping or rejecting the scan packets directed at port 3389, thereby preventing Nmap from completing its state determination process. This is the most accurate interpretation of a 'filtered' port, signifying an unknown state due to network obstruction.

Ettercap supports ARP poisoning, MITM, and sniffing.

AWS Identity and Access Management (IAM) is the core service for securely controlling access to AWS resources. It enables administrators to define granular permissions by creating users, groups, and roles, and attaching policies that specify which actions are allowed or denied on specific resources. IAM is fundamental for ensuring that only authorized entities can interact with AWS services and data, making it the correct solution for managing access control.

SYN scan sends SYN and stops after receiving SYN-ACK, leaving the connection half-open (SYN_RECV).

Pretexting is a sophisticated social engineering attack where an attacker creates a believable, fabricated scenario, known as a 'pretext,' to manipulate a target into divulging sensitive information or performing a specific action. This often involves extensive research to build a convincing backstory and impersonate a legitimate individual or authority. The attacker maintains an interactive conversation, adapting the narrative to overcome skepticism and extract specific details, such as a password, under the guise of solving a problem or verifying identity.

The `ettercap -M arp:remote` command is specifically designed to execute a man-in-the-middle (MITM) attack by poisoning the ARP caches of both the target host and the network gateway. By sending forged ARP replies, the attacker's machine convinces the target that it is the gateway, and convinces the gateway that it is the target. This redirection ensures all traffic flowing between the target and the internet passes through the attacker, enabling interception and potential manipulation.

The ldapsearch command is the primary utility for querying LDAP-compliant directories, including Microsoft Active Directory. The provided syntax ldapsearch -x -h 10.0.0.3 -b dc=co specifically targets an LDAP server at IP 10.0.0.3 for anonymous (simple) bind, searching within the base distinguished name dc=co. This operation is precisely how security analysts enumerate Active Directory users, groups, computers, and their associated attributes, making it the correct method for this task.

Polymorphic malware is specifically designed to alter its internal structure and appearance with each new infection. This constant mutation means that the virus's binary code, and consequently its cryptographic hash or signature, changes every time it replicates. This characteristic is fundamental to its ability to evade signature-based antivirus detection systems, which rely on identifying fixed patterns.

Reaver is a dedicated tool for exploiting the Wi-Fi Protected Setup (WPS) vulnerability. It systematically brute-forces the 7-digit WPS PIN in two halves, significantly reducing the number of attempts required compared to a full 8-digit PIN. Once the correct WPS PIN is identified through this process, Reaver can then request and display the WPA2 Pre-Shared Key (PSK) directly from the access point, effectively compromising the network's security.

Cross-Site Request Forgery (CSRF) attacks trick authenticated users into submitting unintended requests to a web application, leveraging their existing session. CSRF tokens are unique, unpredictable, and secret values generated by the server and embedded within forms or request headers. Upon submission, the server validates the token, ensuring the request originated from the legitimate application and user, thereby preventing an attacker's forged request from being processed.

The 'Options -Indexes' directive explicitly disables the automatic generation of directory listings when a default index file (such as index.html or index.php) is not found within a directory. By removing the 'Indexes' option, the web server is configured to return a '403 Forbidden' error instead of displaying the contents of the directory to the client. This is the direct and intended method for preventing directory browsing in Apache, effectively mitigating information disclosure risks.

SYN flood uses incomplete TCP handshakes to exhaust resources.

Masscan is specifically engineered for high-speed network scanning, capable of transmitting millions of packets per second. Utilizing the `--ping` option directs Masscan to send ICMP echo request packets across the entire /16 range, efficiently identifying live hosts. Its asynchronous design allows it to discover active devices across 65,536 IP addresses in a fraction of the time compared to traditional scanners, making it the optimal tool for rapid, large-scale host discovery.

Remote File Inclusion (RFI) vulnerabilities allow an attacker to force the web application to include and execute or display a file hosted on a remote server, typically controlled by the attacker. This is achieved by injecting a full URL into a vulnerable parameter that the application uses to dynamically include files. The payload's explicit use of a remote URL is the defining characteristic of an RFI attack, enabling the server to fetch and process content from an external source.

RainbowCrack is the definitive and specialized tool explicitly designed for the generation and utilization of rainbow tables. It implements the time-memory tradeoff technique to precompute cryptographic hash chains, allowing for rapid lookup of plaintext passwords from their corresponding hashes. This makes RainbowCrack the standard choice when an attacker intends to leverage or create rainbow tables for efficient password cracking.

Out-of-band uses a different channel (e.g., DNS) to receive data.

A worm is a standalone malicious program designed to self-replicate and propagate autonomously across computer networks without requiring a host program or user intervention. It exploits network vulnerabilities or configuration weaknesses to spread from one system to another, consuming bandwidth and system resources. This self-replicating capability is its defining characteristic, allowing it to infect numerous machines rapidly.

Directory traversal, also known as path traversal, is an attack that exploits vulnerabilities in web server software or applications to access files and directories stored outside the intended web root directory. The '../' sequence observed in the log entry is a classic technique used to navigate up the directory hierarchy, allowing an attacker to read sensitive files like configuration files, password files, or source code that should not be publicly accessible. This specific request clearly demonstrates an attempt to traverse directories to access '/etc/passwd'.

A defining characteristic of Stored XSS, also known as Persistent XSS, is that the attacker's malicious script is successfully injected into and saved within the web application's backend infrastructure, such as a database, comment section, or user profile. This persistence means the payload remains on the server, ready to be delivered to any user who later requests the affected content, making it a highly potent and widespread threat.

Attackers utilize tools like `touch` on Linux or specialized utilities on Windows to meticulously alter the MAC (Modification, Access, Change) times of files and directories. This technique, known as timestomping, aims to blend malicious files with legitimate system files by making them appear older or newer than their actual creation or modification, thereby evading detection during forensic analysis and obscuring the true timeline of compromise or data exfiltration.

The SMTP VRFY command is specifically designed to verify the existence of a user on the mail server without actually sending an email. When an attacker sends a VRFY request with a potential username, the server responds by indicating whether the user exists, often revealing the full name or email address if present. This direct query capability makes VRFY an extremely effective and straightforward technique for enumerating valid user accounts on an SMTP server, provided the server has not been configured to disable or restrict this command.

Performing a WHOIS lookup is a classic passive reconnaissance technique because it queries publicly available domain registration databases. This process retrieves information such as domain registrant details, administrative and technical contacts, and nameserver information without sending any packets directly to the target's network infrastructure. The interaction occurs solely with the WHOIS server, which acts as a third-party information source, making it undetectable by the target.

Google dorking uses search engines to find information passively.

This is a well-known and highly effective privilege escalation vector. If the `find` binary has the SUID (Set User ID) bit set, or if a low-privilege user can execute `find` with `sudo` privileges without a password, the `-exec` flag can be leveraged to execute arbitrary commands as the owner of the `find` binary (typically root). For example, `find . -exec /bin/sh -p \;` would spawn a privileged shell, effectively escalating privileges from the low-privilege shell.

A bucket policy explicitly allowing the "s3:GetObject" action for "Principal": "*" (all principals) directly grants public read access to all objects within that S3 bucket. This configuration overrides default private settings, making the bucket's contents accessible to anyone on the internet without authentication. Such a policy is the primary mechanism for intentionally exposing S3 objects publicly for read operations.

Implementing a whitelist of allowed domains and IP addresses for outbound requests is the most effective defense against Server-Side Request Forgery (SSRF). This robust control ensures the server can only initiate connections to explicitly permitted external resources or internal services. By strictly restricting outbound connections to a predefined, trusted list, any attempt by an attacker to force the server to connect to unauthorized internal systems or arbitrary external hosts will be blocked, directly mitigating the SSRF vulnerability.

Pretexting involves creating a fabricated scenario to obtain information.

Ettercap performs ARP poisoning and MITM attacks.

Triple DES (3DES) is a symmetric block cipher that applies the original Data Encryption Standard (DES) algorithm three times to each data block. It uses either two or three distinct keys to significantly enhance security beyond single DES, making it a more robust, albeit slower, symmetric encryption method. As a symmetric algorithm, 3DES employs the same key for both encryption and decryption operations.

enum4linux is a powerful wrapper script built upon Samba tools, specifically designed for enumerating information from Windows and Samba hosts. It automates the process of extracting user lists, group memberships, share names, password policies, and other critical data via the SMB/NetBIOS protocols. This comprehensive tool leverages various SMB enumeration techniques, making it highly effective for reconnaissance against Windows systems.

Port 4444 is commonly used for reverse shells. Outbound traffic to a malicious IP on this port indicates successful exploitation and a backdoor connection.

Cracking passwords refers to the process of discovering or bypassing authentication credentials, often through brute-force, dictionary attacks, or exploiting weak password policies. The `enum4linux` tool can enumerate user accounts and sometimes directly reveal blank or easily guessable passwords for services like SMB, or provide usernames that are crucial for subsequent offline or online password cracking attempts. Identifying a blank password is a direct form of credential compromise, making it a discovery within the realm of password cracking.

dnsrecon is a specialized command-line utility designed for comprehensive DNS enumeration. It automates the process of gathering extensive DNS information about a target domain, including host records, MX records, NS records, and performing zone transfer attempts. Furthermore, it can conduct brute-force subdomain discovery using wordlists and leverage Google dorks for additional subdomain identification, making it highly effective for reconnaissance.

Polymorphic viruses use encryption or other techniques to change their signature while preserving functionality.

Deploying a steganography detection tool, also known as a steganalysis tool, is the most effective approach as these specialized utilities are designed to identify the subtle statistical anomalies introduced into image pixel patterns by embedded data. These tools analyze various image properties, such as Least Significant Bit (LSB) distributions or Discrete Cosine Transform (DCT) coefficients, to detect deviations from expected statistical models of 'clean' images. By identifying these irregularities, they can reliably flag images likely containing hidden information.

Aircrack-ng is a comprehensive suite of tools specifically designed for auditing wireless networks, including cracking WPA/WPA2-PSK. It leverages captured 4-way handshakes to perform dictionary or brute-force attacks against the pre-shared key. By comparing the captured handshake with hashes generated from a wordlist, Aircrack-ng can efficiently recover weak or common passphrases.

Isolating the compromised server is the critical first step in containing an active security incident. Disconnecting the network cable physically severs all external and internal network communication, immediately halting data exfiltration, command-and-control (C2) communications, and preventing lateral movement to other systems. Blocking the IP at the firewall provides an additional layer of network-level containment. This action preserves the system's state for forensic analysis while stopping the immediate threat, allowing for a structured incident response process to follow.

A process running inside a container with the CAP_SYS_ADMIN capability is a critical security vulnerability. This capability grants extensive privileges, often likened to root access on the host system, allowing operations such as mounting filesystems, creating device nodes, and loading kernel modules. An attacker can leverage CAP_SYS_ADMIN to break out of the container's isolation by manipulating the host's kernel or filesystem, effectively gaining control over the underlying host machine.

theHarvester is a specialized open-source intelligence (OSINT) tool explicitly designed for passive reconnaissance. It systematically queries multiple public data sources, including search engines (Google, Bing), PGP key servers, LinkedIn, and other platforms, to gather publicly available information such as email addresses, subdomains, hostnames, and employee names. Its passive approach means it does not directly interact with the target organization's systems, making it ideal for initial information gathering without alerting the target.

Using a container escape to access the host OS is a critical cloud misconfiguration vulnerability. This occurs when a flaw in the container runtime, kernel, or container configuration allows an attacker to break out of the isolated container environment and gain unauthorized access to the underlying host operating system. Such an escape often leverages misconfigured capabilities, insecure mounts, or unpatched kernel vulnerabilities, directly exposing the host infrastructure to compromise.

A SYN flood is characterized by an attacker sending a large volume of TCP SYN packets to a target server without completing the three-way handshake. The tcpdump -i eth0 -n host command would reveal a high rate of incoming TCP packets with the SYN flag set, directed at the specified host, but without corresponding SYN-ACK or ACK packets originating from the target. This pattern indicates numerous half-open connections accumulating on the target, exhausting its connection table resources.

ScoutSuite is a comprehensive open-source tool specifically engineered for auditing the security posture of multi-cloud environments, including Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). It meticulously identifies security misconfigurations, adherence to best practices, and potential vulnerabilities across various services like IAM, storage, and compute. By generating an interactive HTML report, it provides a clear overview of an organization's cloud security risks, enabling targeted remediation efforts.

Erasing tracks is a critical post-exploitation phase where an attacker systematically removes or alters forensic evidence of their presence and activities on a compromised system. This encompasses various anti-forensic techniques, including clearing system logs (e.g., Windows Event Logs, `auth.log`), modifying timestamps, deleting temporary files, and removing command history. Modifying log files directly falls under this comprehensive objective, aimed at hindering incident response and forensic investigations.

A rainbow table attack leverages large, precomputed tables containing chains of hash values and their corresponding plaintext passwords. This method significantly speeds up the process of reversing cryptographic hashes to recover the original password, bypassing the need for real-time computation for each guess. Attackers use these tables to quickly find passwords from stolen hash databases by looking up the hash and tracing back the chain. This precomputation makes it highly effective against unsalted hashes.

AES (Advanced Encryption Standard) is the correct answer because it is a symmetric block cipher that processes data in fixed-size blocks of 128 bits. It supports robust key lengths of 128, 192, or 256 bits, providing strong cryptographic security. Its design, based on the Rijndael cipher, makes it highly efficient and widely adopted for various secure communication and storage applications.

Prepared statements, also known as parameterized queries, are a primary defense against SQL injection because they fundamentally separate the SQL code logic from user-supplied data. The database engine pre-compiles the query structure, treating all subsequent input as literal data values rather than executable SQL commands. This mechanism ensures that malicious characters within user input cannot alter the intended query structure, effectively preventing injection attacks by ensuring input is never interpreted as code.

The presence of unexpected rows or columns in an application's query results is a strong indicator of a successful UNION-based SQL injection. Attackers leverage the `UNION` operator to combine the results of their malicious query with the legitimate query, thereby extracting data from other tables or databases that were not intended for display. This manipulation directly alters the structure and content of the returned dataset, making it a clear sign of data exfiltration or unauthorized data retrieval.

Intruder is purpose-built for automating parameterized attacks by systematically injecting various payloads into specified insertion points within an HTTP request. It enables sophisticated brute-force, dictionary, and credential stuffing attacks by iterating through user-defined lists or generated sequences of values. This module offers multiple attack types, such as Sniper or Battering Ram, to efficiently test a wide range of input fields for vulnerabilities or weak credentials.

XXE injection occurs when an XML parser processes XML input containing references to external entities, which are then resolved by the server without proper validation. Attackers can define malicious external entities within the Document Type Definition (DTD) to exploit this, often using the "file://" protocol to read local files from the server's filesystem, such as configuration files or sensitive credentials. This direct file disclosure via XML entity processing perfectly matches the described observation.

Running an Nmap SYN scan against a target is a definitive example of active reconnaissance because it directly interacts with the target system by sending TCP SYN packets. The target's response, whether a SYN-ACK for open ports or an RST for closed ones, provides real-time information about its network services and host status. This direct packet exchange generates network traffic that originates from the attacker and terminates at the target, making it detectable by intrusion detection systems (IDS) or firewalls.

The `whois` command is specifically designed to query WHOIS databases, which contain publicly available registration information for domain names and IP address blocks. This data includes critical details such as the domain registrar, the domain's creation and expiration dates, the associated name servers, and administrative, technical, and registrant contact information. This information is invaluable for initial footprinting and reconnaissance phases of a penetration test.

AES is a symmetric block cipher.

The `snmpwalk` command is specifically designed to query a network device and retrieve all information available within its Management Information Base (MIB) tree, starting from a specified OID (or the root if none is given). The `v2c` flag explicitly dictates the use of SNMP version 2c, which offers improved security and data types over v1. The `c public` argument specifies "public" as the community string, acting as a password for read-only access to the device's SNMP agent at IP address 192.168.1.1. This effectively performs a comprehensive enumeration of the device's configuration and status.