Certified Ethical Hacker CEH (CEH) — Questions 451–525

The Nmap flag -sS instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. It sends a TCP SYN packet to the target port and, if a SYN/ACK is received, the port is considered open; the scanner then sends a RST to tear down the connection before the full TCP three-way handshake completes. This technique avoids completing the connection, making it less likely to be logged by the target's application layer and is the default scan type when run with root privileges.

The hash prefix $1$ indicates MD5, which is significantly weaker than SHA-512 ($6$). The user 'user' uses MD5.

The first step is to isolate the infected machine from the network to prevent the ransomware from spreading to other systems.

The attacker is using '../' for directory traversal to access files outside the web root, and a null byte injection (%00) to truncate the '.php' extension. This targets LFI (local file inclusion) via directory traversal.

Parameterized queries (prepared statements) ensure user input is treated as data, not executable code, preventing SQL injection.

IAM misuse involves exploiting misconfigured IAM roles or policies to escalate privileges. Assuming a role with higher privileges is a form of privilege escalation via IAM abuse.

AES is a symmetric block cipher that supports key sizes of 128, 192, and 256 bits, and is widely used for encryption.

MD5 is known to be vulnerable to collision attacks, making it unsuitable for security applications like digital signatures.

Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

enum4linux is a tool specifically designed to enumerate SMB shares, user lists, OS information, and other details from Windows systems by leveraging the SMB protocol (typically over TCP/445 or TCP/139). It automates queries using SMB RPC calls, such as those from the `samr` and `lsarpc` pipes, making it the correct choice for targeted SMB enumeration.

SSRF can be tested by making the server fetch internal resources like localhost or cloud metadata endpoints (e.g., AWS).

Identify vulnerability, test, find columns, use UNION, extract data.

Option B is correct because misconfigured cloud storage, such as an Amazon S3 bucket with overly permissive ACLs or a publicly accessible Azure Blob container, is one of the most common cloud security risks. This misconfiguration can expose sensitive data to the internet without authentication, leading to data breaches. The Cloud Security Alliance (CSA) consistently lists misconfiguration as a top cloud threat.

theHarvester is a dedicated OSINT tool designed to gather email addresses, subdomains, IPs, and virtual hosts from public sources such as search engines (Google, Bing), PGP key servers, and the SHODAN database. It directly queries these sources to enumerate email addresses and subdomains associated with a target domain, making it a primary choice for passive reconnaissance.

The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.

Option B is correct because the `-sV` flag in Nmap explicitly enables version detection, which probes open ports to determine the service and version information displayed in the output (e.g., 'OpenSSH 7.4', 'Apache httpd 2.4.6'). Without `-sV`, Nmap would only report the service name based on its port mapping (e.g., 'ssh', 'http'), not the specific version numbers.

These tools are commonly used in penetration testing and ethical hacking.

Hardcoded credentials in firmware represent a vulnerability in the device itself. This is part of the exploitation phase, where attackers use discovered credentials to gain unauthorized access to backend systems.

The payload is stored in the database and executed when other users load the page, which is stored (persistent) XSS.

Whaling targets senior executives or high-profile individuals. The email impersonates the CEO, a typical whaling scenario. Spear phishing is targeted but not necessarily at executives.

Pretexting involves creating a fabricated scenario to obtain information. The caller pretends to be IT support.

Low detection rate suggests the file may be a zero-day or heavily obfuscated. The fact that previous submission had no detections and now some detect indicates it might be a new variant or the file is not widely known. The best action is to treat as potentially malicious and perform dynamic analysis.

SYN flood attacks exploit the TCP three-way handshake by sending many SYN requests with spoofed IPs, exhausting the server's connection queue.

The CEH methodology follows: Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks.

This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.

Option D is correct because creating a firewall rule to block traffic from the thermostat's MAC address to the specific external IP is a targeted, least-disruptive mitigation. It preserves the IoT VLAN's functionality for other devices while stopping the suspicious communication. This approach allows the analyst to investigate further without losing visibility into the threat, as the thermostat remains on the network for forensic analysis.

Certificate Authority, digital certificates, and private/public key pairs are core PKI components.

Account lockout, rate limiting, and CAPTCHA all hinder automated brute force attempts. Strong password policies help but are not a direct mitigation against brute force rate.

KRACK attacks exploit vulnerabilities in the WPA2 4-way handshake key reinstallation. The primary fix is to install security patches on clients and APs that implement the IEEE 802.11 standard update. Disabling WPS does not prevent KRACK, and switching to WEP is less secure.

The correct answer is D, Rainbow table attack. This technique involves precomputing hash chains for common passwords and storing them in a table, allowing the attacker to reverse password hashes quickly by looking up the hash in the table rather than computing hashes on the fly. The tool described matches the core concept of a rainbow table, which uses a time-memory trade-off to crack hashes efficiently.

TLS (Transport Layer Security) provides encryption for data in transit, and CoAP can use DTLS (a variant of TLS) for secure communication.

theHarvester is an open-source intelligence (OSINT) tool designed to perform passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API. Its primary function is to collect email addresses, subdomains, IP addresses, and virtual hosts associated with a target domain, aiding in the footprinting phase of a penetration test.

An evil twin attack involves a rogue AP mimicking a legitimate SSID to intercept traffic.

Option C is correct because BLE is specifically designed for ultra-low power consumption, enabling battery-powered sensors to operate for months or years on a coin cell battery. BLE achieves this by using short bursts of data transmission and then entering a deep sleep mode, drastically reducing energy usage compared to classic Bluetooth or Wi-Fi.

The `-f` flag in Nmap fragments the IP packet into smaller pieces, typically 8-byte fragments, which splits the TCP header across multiple packets. This fragmentation causes the IDS to see out-of-order or incomplete TCP headers, making it harder for signature-based detection to reassemble and match malicious patterns, thus bypassing simple packet filters that do not perform full TCP reassembly.

Application-layer attacks target the OSI layer 7. Slowloris keeps many connections open, HTTP flood sends many requests, and DNS amplification (though often considered volumetric) can be application-layer when using DNS queries.

A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks. This process does not send any packets directly to the target system; it relies on third-party servers, making it a passive reconnaissance technique.

The difference in responses (e.g., 'User not found' vs 'Invalid password') allows an attacker to enumerate valid usernames, which is a common first step in credential stuffing or brute-force attacks.

Vishing (voice phishing) uses phone calls or voicemail to deceive victims. SMiShing uses SMS, pharming redirects websites, and baiting offers something enticing.

Rainbow tables are precomputed hash chains that allow rapid password lookups. RainbowCrack is a tool that implements rainbow table attacks, ideal for quickly cracking NTLM hashes.

A WHOIS lookup against the target domain returns registration details that include the organization's network range (via the 'NetRange' or 'CIDR' fields) and the ISP (via the 'OrgName' or 'descr' fields). This directly maps to the footprinting goal of identifying the target's IP address block and upstream provider, as defined in RFC 3912 and common WHOIS database schemas.

A man-in-the-middle (MITM) attack involves the attacker positioning themselves between the client and server to intercept and modify traffic.

Option C is correct because a TCP SYN scan (-sS) sends only a SYN packet and does not complete the three-way handshake, making it stealthy. First scanning only the three allowed ports (80, 443, 8080) across the subnet minimizes packets and identifies live hosts. Once a promising target is found, a full SYN scan on all 65535 ports efficiently maps services while evading the firewall's restrictions.

Dynamic analysis is the correct approach because it involves executing the suspicious file in a controlled, isolated environment (such as a sandbox or virtual machine) to monitor its runtime behavior, including file system changes, registry modifications, network connections, and process injections. This allows analysts to observe actual malicious actions without risking the production environment, making it essential for understanding zero-day threats and obfuscated malware that static analysis might miss.

The `samdump2` tool extracts password hash data from the SAM (Security Account Manager) registry hive file. By providing the SYSTEM hive (which contains the boot key) and the SAM file, the tool decrypts and dumps the NTLM hashes of local user accounts. These hashes can then be used in offline cracking attacks (e.g., with John the Ripper or Hashcat) to recover plaintext passwords, making option C correct.

Rate limiting reduces traffic volume, scrubbing centers filter malicious traffic, and anycast distributes traffic across multiple nodes to absorb attacks. Black hole routing is also used but is a more drastic measure.

Option C is correct because a successful SQL injection often results in the database returning error messages or unexpected data directly in the HTTP response, confirming that the attacker's injected SQL statements were executed and returned results. This is a direct indicator of a successful attack, as the server processes the malicious input and includes database output in the response body.

The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

The request uses path traversal to access /etc/passwd (directory traversal/LFI). It can be used for file disclosure, and if the file is included in a script, it could be LFI. Command injection is not related.

Hashcat is the correct answer because it is specifically designed for high-speed password cracking using GPU acceleration, leveraging OpenCL or CUDA to offload computation to the GPU. This allows it to achieve millions of hashes per second, making it ideal for cracking complex passwords from SAM hashes (NTLM) when speed is the priority.

Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.

Birthday attack exploits hash collisions; replay attack reuses captured data. Downgrade attack forces weaker protocol (not cryptanalytic per se, but relevant). SQL injection and XSS are web application attacks, not cryptanalytic.

Spear phishing is a targeted phishing attack aimed at a specific individual or organization, often using personalized information to appear legitimate. This email targets the analyst specifically and uses a spoofed domain, making it spear phishing, not generic phishing or whaling (which targets high-level executives, though the CEO is impersonated, the recipient is the analyst).

CSRF protection often relies on checking the Referer header; if it can be removed or spoofed, the application is vulnerable to CSRF.

A successful DNS zone transfer (AXFR) returns the complete zone file, which contains all DNS records for the domain, including A, AAAA, MX, CNAME, NS, and TXT records. This is why it is a critical information-gathering step during reconnaissance.

The customer is responsible for data classification and account management, while the provider secures the physical infrastructure.

The analyst captured the 4-way handshake and used a dictionary attack (wordlist) to recover the PSK. This is a dictionary attack, not brute force (which tries all combinations), rainbow table, or hash length extension (which is for hash-based MACs).

Option B is correct because disabling recursive queries for external hosts prevents DNS servers from being used in amplification attacks and also limits the information that can be obtained via zone transfers. Recursive queries are not required for zone transfers (which use TCP port 53), but disabling recursion for external hosts reduces the attack surface by preventing unauthorized users from querying the server for all records in a domain.

The SMTP VRFY command is used to verify whether a specific user exists on the mail server. When the server responds with '252 Cannot VRFY user, but will accept message', it indicates that VRFY is disabled or restricted, but the server still supports the EXPN command. EXPN (Expand) reveals the actual members of a mailing list or alias, allowing the tester to enumerate valid email addresses indirectly by querying known or guessed list names.

RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. MD5 is a hash function.

A decoy scan (option C) is the correct answer because it allows the attacker to blend their real IP address with multiple spoofed IP addresses, making it appear as though the scan originates from several hosts. In this scenario, the IDS alerts on IP 10.0.0.5, which is a legitimate internal server, indicating that the attacker is using that server's IP as a decoy to evade detection and misdirect the analyst's investigation.

The correct answer is D because the question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.

A Wireless Intrusion Prevention System (WIPS) continuously monitors the radio frequency spectrum to detect, locate, and block rogue access points. It can automatically classify devices based on their behavior and signatures, and when a rogue AP is identified, the WIPS can launch a de-authentication attack against the rogue device or its clients, effectively neutralizing the threat. This makes WIPS the most direct and proactive countermeasure against rogue APs.

Aircrack-ng is the standard tool for cracking WEP keys by capturing IVs. Reaver is for WPS, Kismet is a sniffer, and John the Ripper is a general password cracker.

The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.

NetBIOS <20> identifies a file server service (SMB). The tester can now attempt SMB enumeration or brute-force attacks.

Option B is correct because restricting recursive queries to trusted sources prevents attackers from using your DNS server as an open resolver to cache forged responses. By limiting recursion to authorized clients only, the server will not accept and cache DNS data from external, potentially malicious queries, which is a primary vector for DNS cache poisoning.

macof is a tool used for MAC flooding, which floods a switch with fake MAC addresses to overflow the CAM table, causing the switch to fail open and operate like a hub, allowing packet sniffing.

Without TLS, MQTT traffic is sent in cleartext, allowing interception and reading of sensitive data.

HTTP flood is an application-layer DDoS attack because it targets the HTTP protocol (Layer 7) by overwhelming a web server with seemingly legitimate GET or POST requests. Unlike network-layer attacks, HTTP flood exploits the server's processing of application-layer requests, often mimicking normal user behavior to bypass basic rate limiting. This forces the server to allocate resources for each request, eventually exhausting connection pools or CPU cycles.

Using a self-signed or untrusted CA certificate can allow an attacker to perform a man-in-the-middle attack by presenting their own certificate that the browser may accept with user warning.

Burp Intruder is used for automating customized attacks, including brute force and fuzzing.