Certified Ethical Hacker CEH (CEH) — Questions 526–600

The `nmap -sn 192.168.1.0/24` command is the correct choice for performing a ping sweep, also known as host discovery. The `-sn` (or `--ping-scan`) flag instructs Nmap to skip port scanning and only attempt to determine if hosts are online. It achieves this by sending a combination of ICMP echo requests, TCP SYN packets to port 443, and TCP ACK packets to port 80, along with an ICMP timestamp request, to identify live hosts efficiently across the specified /24 subnet. This method quickly identifies active devices without generating extensive network traffic from full port scans.

Performing a WHOIS lookup for a target domain is a classic example of passive reconnaissance. This process involves querying public databases maintained by domain registrars and registries to retrieve registration information, such as registrant contact details, domain creation/expiration dates, and nameservers. Crucially, these queries are directed at third-party WHOIS servers, not the target domain's actual servers, meaning no direct network traffic is sent to or received from the target, leaving no trace.

Directory traversal, also known as path traversal, is a vulnerability that permits an attacker to read arbitrary files on the server's file system by manipulating file paths in user-supplied input. This exploit uses sequences like "../" (dot-dot-slash) to navigate outside the intended directory, bypassing security controls that fail to properly validate or sanitize file names or paths. The ability to "view documents by specifying" a path directly aligns with this vulnerability, as it focuses on accessing files located anywhere on the server.

hping3 is a command-line oriented TCP/IP packet assembler/analyzer, specifically engineered for crafting and sending custom packets, including a high volume of SYN packets. Its robust capabilities allow for precise control over packet headers, source IP spoofing, and the ability to flood a target with a continuous stream of SYN requests, making it an ideal and highly effective tool for simulating SYN flood attacks and testing network resilience.

This vulnerability occurs entirely on the client-side when a web application's JavaScript code processes user-controllable data, often from the URL fragment (#) or query string (?), and writes it unsafely into the Document Object Model (DOM). If the client-side script dynamically generates HTML or JavaScript using this unvalidated input, an attacker can inject malicious code that executes within the victim's browser. The "reflection" happens within the browser's DOM, not necessarily on the server's response.

WEP (Wired Equivalent Privacy) encryption is notoriously vulnerable due to its use of a 24-bit Initialization Vector (IV) concatenated with the static WEP key to form the RC4 cipher key. The small IV space leads to frequent IV reuse, especially with weak IVs that reveal information about the key stream. By capturing a sufficient number of these weak IVs and their corresponding encrypted packets, tools like aircrack-ng can statistically analyze the patterns to deduce the WEP key, often within minutes.

This option is correct because CVE-2021-4034, known as "PwnKit," is a critical local privilege escalation vulnerability in the `pkexec` utility. It allows an unprivileged local attacker to gain full root privileges on a vulnerable Linux system by exploiting a memory corruption bug (out-of-bounds write) in how `pkexec` handles command-line arguments. This specific exploit path directly provides the means to achieve root access, fulfilling the objective of privilege escalation.

A defining characteristic of a polymorphic virus is its ability to alter its internal code structure and signature with each new infection or replication. This mutation is achieved through a polymorphic engine, which modifies the virus's instruction set and encryption key while preserving its malicious payload and functionality. This constant change makes it exceptionally challenging for traditional signature-based antivirus solutions to identify and block the malware consistently.

A successful AXFR to an unauthenticated client indicates a misconfiguration that exposes internal network details.

Steganography's core purpose is to embed secret information within seemingly innocuous digital media, such as images, audio, or video files. This technique aims to conceal the very existence of the hidden data, making it difficult for an observer to even suspect that secret communication is taking place. Unlike encryption, which scrambles data, steganography focuses on covert communication by making the data appear as part of a benign carrier file, thereby avoiding detection.

Stealing session cookies allows an attacker to impersonate a user.

This option accurately describes the command's functionality. The `-i eth0` flag specifies the network interface for capture. The `src host 192.168.1.10` filter ensures only packets originating from that specific IP address are captured, while `dst port 80` further narrows the scope to only include HTTP traffic (standard port 80). Finally, the `-w capture.pcap` flag instructs tcpdump to save all filtered packets to a file named `capture.pcap` for subsequent offline analysis.

Split DNS, or Split-Horizon DNS, is designed to provide different DNS responses based on the client's network location, typically serving internal IP addresses to internal users and external IP addresses to external users for the same hostname. A misconfiguration occurs when the DNS server fails to properly differentiate client origins, or is configured to return both internal and external records simultaneously in a single response, thereby exposing internal network topology or causing connectivity issues.

The 'filtered' state in Nmap signifies that the port is inaccessible because probe packets are being dropped, or responses are not reaching the scanner. This typically occurs when a firewall, intrusion prevention system (IPS), or other network security device is actively inspecting and blocking traffic destined for that specific port, preventing Nmap from determining if a service is listening. The lack of any definitive response (SYN/ACK for open, RST for closed) points directly to an intermediate device interfering, making this the correct explanation.

Reflected Cross-Site Scripting (XSS) occurs when a malicious script, often embedded within a URL parameter or form input, is immediately and unsafely echoed back in the web server's HTTP response. The victim's browser then interprets and executes this injected script as part of the legitimate webpage content. The exhibit clearly shows user input containing script tags being directly reflected into the HTML response without proper sanitization, leading to client-side script execution, which is the hallmark of a reflected XSS vulnerability.

The Social Engineering Toolkit (SET) is purpose-built for simulating various social engineering attacks, making it the ideal choice for testing employee susceptibility. It provides modules for spear phishing, credential harvesting, web jacking, and infectious media generator attacks, directly targeting the human element. By deploying these simulated threats, organizations can assess how employees react to realistic social engineering tactics and identify areas for security awareness training improvement.

Using the 'strings' command is a quintessential static analysis method as it involves examining the binary file directly on disk without executing it. This command extracts sequences of printable ASCII or Unicode characters embedded within the executable, which can reveal valuable clues such as file paths, URLs, API function names, or error messages hardcoded by the malware author.

Buffer overflows enable arbitrary code execution by allowing an attacker to overwrite critical memory locations, such as return addresses on the stack or function pointers in data segments. By carefully crafting input that exceeds the buffer's capacity, malicious shellcode can be injected into memory. The overwritten control flow mechanism then redirects program execution to this injected code, granting the attacker full control over the compromised process.

Creating a Volume Shadow Copy (VSS) is the most effective and commonly used method to access the SAM file while the operating system is running. VSS creates a point-in-time, read-only snapshot of the entire volume, including files that are currently locked by the OS. This snapshot allows the penetration tester to access a consistent version of the SAM file from the shadow copy, effectively bypassing the exclusive lock maintained by the live operating system without interrupting its operations.

Username enumeration occurs when a web application's login mechanism provides distinct error messages or response times for valid usernames compared to invalid ones, even if the password is incorrect. For instance, "Invalid password for user 'admin'" versus "User 'admin' does not exist." This differential feedback allows an attacker to systematically test common usernames and compile a list of valid accounts, significantly aiding in subsequent brute-force or credential stuffing attacks.

Server-side request forgery (SSRF) exploits a vulnerability where a web application is tricked into making requests to an arbitrary domain specified by the attacker. This allows an attacker to force the server to connect to internal services, such as metadata APIs, internal databases, or other hosts within the organization's private network, which are typically not directly accessible from the internet. The "client sends a reque" could be the initial malicious input that triggers the server to make an unintended internal request.

Slowing down the scan rate directly reduces the number of packets sent per second (PPS) or connections attempted per minute. This strategic reduction keeps the scanning activity below the predefined thresholds set by rate-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), which are designed to detect anomalous traffic volumes. By maintaining a low packet rate, the ethical hacker can conduct reconnaissance without triggering alerts that would otherwise flag the activity as a potential port scan or denial-of-service attempt, thus evading detection.

Reaver is a specialized tool explicitly designed to exploit a critical vulnerability in the Wi-Fi Protected Setup (WPS) protocol by performing a brute-force attack against the WPS registrar PIN. It leverages the fact that the 8-digit WPS PIN is validated in two halves, allowing an attacker to determine the first four digits and then the next three, with the last digit being a checksum. This significantly reduces the number of attempts required, making the brute-force attack feasible and highly effective against vulnerable WPS-enabled access points.

The HTTP OPTIONS method is specifically designed to query a web server or resource about the communication options supported by the server for that particular URL. It provides a list of allowed HTTP methods (e.g., GET, HEAD, POST, PUT, DELETE, TRACE, CONNECT) in the 'Allow' header of its response. This is crucial for a penetration tester to discover if potentially vulnerable methods like PUT (for file upload) or WebDAV methods are enabled before attempting to exploit them.

The bucket policy explicitly grants the "s3:GetObject" action to "Principal: *". This configuration means that any user, including unauthenticated internet users, can retrieve and read the content of any object within the bucket, provided they know the object's key. This effectively makes all objects publicly readable, posing a significant data exposure risk.

An open port has a service listening.

The `rpcclient` utility is a powerful tool for interacting with Microsoft Remote Procedure Call (MS-RPC) services, which are commonly transported over Server Message Block (SMB) on TCP port 445. The command `rpcclient -U n 192.168.1.10` attempts to establish a null session (unauthenticated connection) to the target, allowing an attacker to enumerate various system details like user lists, share information, and group memberships by making RPC calls. This makes it a primary method for SMB/RPC enumeration.

Slowloris sends partial HTTP headers slowly, holding connections open until the server's limit is reached.

The presence of multiple Mail Exchanger (MX) records for a domain is a strong indicator of a resilient email infrastructure designed for both load balancing and failover. When multiple MX records exist, mail sending agents attempt delivery to the server with the lowest preference value first. If that server is unavailable or overloaded, they proceed to the next highest preference, ensuring email delivery continuity and distributing the incoming mail traffic across several servers. This configuration significantly enhances reliability and availability.

The -f (fragment packets) Nmap option instructs Nmap to split the IP header of the probe packets into several smaller IP packets. This technique, known as IP fragmentation, can bypass simple stateless firewalls or intrusion detection systems (IDS) that only inspect the first fragment of a packet or are configured to drop packets exceeding a certain size. By breaking the packet into 8-byte chunks, it makes reassembly more complex for network security devices, potentially allowing the scan to proceed undetected.

Ophcrack is a specialized tool explicitly engineered for cracking Windows LM and NTLM hashes by utilizing precomputed rainbow tables. It comes bundled with these tables, which significantly accelerate the process of recovering passwords, especially shorter or less complex ones, from these specific Windows authentication protocols. Its design is entirely centered around the time-memory tradeoff inherent in rainbow table attacks, making it highly effective for its intended purpose.

This bucket policy explicitly grants access to 'Principal': '*', which signifies *any* AWS identity or anonymous user. The accompanying 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}} further specifies that this broad access is permitted from *any* IPv4 address. The combination of allowing any principal from any IP address effectively overrides any other restrictions and renders the S3 bucket completely public and accessible to the entire internet, which is a critical security misconfiguration.

Correct. The attacker uses a false pretext (IT support) to obtain sensitive information.

This Nmap command employs two significant evasion techniques: -f for packet fragmentation and -D for decoy IP addresses. Packet fragmentation breaks the scan probes into smaller, non-standard-sized IP fragments, which can bypass simple stateful firewalls or IDS rules that only inspect the initial fragment. The -D option generates multiple decoy source IP addresses, making it difficult for an IDS to determine the actual scanner's IP from the network logs, effectively obscuring the attacker's origin and distributing the perceived attack source.

The `nbtstat -a <IP_address>` command is specifically used to query and display the NetBIOS name table of a remote machine. This table contains a list of NetBIOS names registered by the target host, including unique names (e.g., workstation name, messenger service) and group names (e.g., domain/workgroup name), along with their associated types and registration status. This information is crucial for understanding the remote machine's NetBIOS identity and services.

Cross-site request forgery (CSRF) exploits the trust a web application has in an authenticated user's browser. An attacker crafts a malicious web page or email that, when visited or opened by an authenticated user, forces their browser to send an unintended request to the vulnerable application. The application, failing to verify the request's true origin or intent, processes the forged request, often relying on session cookies. Manipulating or bypassing checks on the Referer header can be a technique used in CSRF attacks, as applications sometimes use it as a weak defense to ensure requests originate from the expected domain.

An Intrusion Detection System (IDS) can be specifically configured to identify and drop packets that only contain the SYN flag, a common characteristic of a SYN scan (half-open scan). This allows the IDS to detect and mitigate reconnaissance attempts without disrupting legitimate full TCP three-way handshakes, which are typical of a TCP connect scan. Therefore, SYN packets from a SYN scan would be dropped, while the full handshake of a connect scan might be permitted to proceed.

Intruder is the dedicated Burp Suite tool for automating customized attacks against web applications by systematically sending multiple requests with variable payloads. It allows testers to define specific insertion points within a request and iterate through a list of payloads, making it ideal for brute-forcing credentials, fuzzing input fields, and identifying injection vulnerabilities like SQLi or XSS with high precision and control over attack types.

Hashcat is the industry-standard tool for high-performance password recovery, leveraging highly optimized GPU acceleration to crack a vast array of hash types, including NTLM (mode 1000). Its architecture is specifically designed to maximize parallel processing on graphics cards, enabling exceptionally fast dictionary attacks, brute-force, and hybrid attacks. This unparalleled efficiency makes Hashcat the optimal choice for rapidly cracking NTLM hashes obtained from a SAM database dump, significantly reducing the time required compared to CPU-based or rainbow table methods.

This statement is correct. When the cryptographic hash (e.g., SHA256) calculated from a downloaded file precisely matches the official, published hash value, it provides strong cryptographic assurance. This match confirms that the file's contents are identical to the original source and have not been altered, corrupted, or tampered with during transit or storage, thereby establishing its authenticity and integrity.

For SNMPv1 and SNMPv2c, the community string serves as a clear-text password or authentication credential required to access the SNMP agent's Management Information Base (MIB). Without knowing the correct read-only or read-write community string, an `snmpwalk` utility cannot successfully query the device for its managed objects. This string effectively controls access permissions, allowing or denying the retrieval of system information and acting as the primary security mechanism for these older SNMP versions.

When an S3 bucket is configured for public read access, it means that the bucket policy explicitly permits the s3:GetObject action for the * principal (anonymous users). This configuration allows anyone on the internet to enumerate and download all objects stored within that bucket without requiring any authentication. This direct and unrestricted access inevitably leads to unauthorized data access and subsequent exfiltration, constituting a severe data breach where sensitive information can be freely downloaded.

DNS amplification is a highly effective distributed denial-of-service (DDoS) attack where attackers send small UDP DNS queries with a spoofed source IP address (the victim's IP) to numerous open DNS resolvers. These resolvers then respond with much larger UDP packets containing DNS records, directed back to the spoofed victim. This technique leverages the amplification factor of DNS responses to overwhelm the target with a massive surge of incoming UDP traffic, typically on port 53.

Updating Log4j to version 2.17.1 or later directly addresses the Log4Shell vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) by completely disabling JNDI lookups by default. This version ensures that untrusted input can no longer trigger remote code execution (RCE) via LDAP, RMI, or other JNDI-enabled services. Applying this patch is the most comprehensive and recommended solution, as it eliminates the underlying flaw rather than merely mitigating symptoms. It ensures the application's logging functionality remains secure and fully operational.

A SUID (Set User ID) bit on an executable allows it to run with the permissions of its owner, regardless of the user executing it. If a binary is owned by the root user and has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that execution. This mechanism is specifically designed for privilege escalation, enabling a low-privileged user to perform actions typically reserved for root, such as gaining a root shell or modifying system configurations.

This option correctly identifies the purpose of using Nmap's UDP scan (`-sU`) targeting the standard SNMP port (161) in conjunction with the `snmp-brute` NSE script. This script systematically attempts a list of common or custom community strings (like "public," "private," "manager") against the discovered SNMP agent. Successful brute-force reveals valid community strings, granting read or write access to the device's MIB, which is a critical step in reconnaissance and potential exploitation.

The online issuing CA is directly responsible for generating, signing, and managing the lifecycle of end-entity certificates within this PKI. When an end-entity certificate needs to be revoked, it is the issuing CA that records this revocation event and publishes it in its own Certificate Revocation List (CRL). Consequently, clients validating an end-entity certificate must consult the CRL published by the online issuing CA to ascertain its current revocation status.

ARP poisoning, also known as ARP spoofing, is a man-in-the-middle attack where an attacker sends forged ARP reply messages onto a local area network. These malicious replies associate the attacker's MAC address with the IP address of another host, such as the default gateway or another workstation. By continuously sending these fake ARP replies, the attacker can trick multiple devices into updating their ARP caches with incorrect information, thereby redirecting traffic intended for the legitimate IP to the attacker's machine. This directly explains the observation of multiple ARP replies for one IP.

Reflected XSS occurs when a malicious script, supplied in an HTTP request, is immediately and unsafely echoed back in the server's HTTP response. The server takes user-supplied input, often from a URL parameter, and directly embeds it into the HTML page without adequate sanitization or encoding. This causes the victim's browser to execute the script upon receiving the crafted response, making it a non-persistent, single-request attack.

Enumerating SMB shares and session information using `net view \\fileserver` (on Windows) or `smbclient -L //fileserver` (on Linux/Kali) is a highly effective and low-impact reconnaissance method. These commands leverage the Server Message Block (SMB) protocol, the file server's core service, to list accessible shares and potential misconfigurations like null sessions. This approach directly targets the server's primary function and is designed to work even with standard user permissions, providing valuable insights into accessible resources.

Fragmenting IP packets into small segments, such as 8-byte fragments using the -f flag, is a classic IDS evasion technique. Many Intrusion Detection Systems struggle with the efficient and accurate reassembly of highly fragmented packets, especially if they arrive out of order or are unusually small. This difficulty can cause the IDS to miss the complete signature of a malicious payload or scan, allowing the fragmented traffic to bypass detection and reach the target.

theHarvester is a dedicated OSINT tool specifically designed for gathering publicly available information, including email addresses, subdomains, hostnames, and employee names. It queries various public data sources like search engines (e.g., Google, Bing), PGP key servers, and social media platforms to aggregate this intelligence. This makes it exceptionally effective for passive reconnaissance aimed at collecting target organization email addresses without direct interaction.

This is correct because DNS amplification attacks exploit misconfigured or intentionally open DNS resolvers that are accessible on the internet. Attackers send small DNS queries to these resolvers, spoofing the victim's IP address as the source. The open resolvers then respond with significantly larger DNS records to the unsuspecting victim, effectively multiplying the attacker's initial traffic volume.

Advanced Encryption Standard is symmetric.

If the NFS server's export configuration includes `no_root_squash`, a client logged in as root can create files on the mounted share that retain root ownership on the server. By compiling a simple C program with the SUID bit set on this share, and then executing it on the client, the program will run with root privileges. This effectively escalates privileges on the client system by leveraging the server's trust in the client's root user, allowing arbitrary commands to execute as root.

A SYN scan, often referred to as a half-open scan, initiates a TCP handshake by sending a SYN packet to the target port. If the port is open, the target responds with a SYN/ACK packet. To avoid logging a full connection on the target system and thus maintain stealth, the penetration tester immediately sends an RST (reset) packet, tearing down the nascent connection before the three-way handshake completes. This allows port status determination without fully establishing a session.

smbclient -L lists available shares.

SQLMap is an open-source penetration testing tool specifically engineered to automate the process of detecting and exploiting SQL injection flaws in web applications. It supports a wide array of SQL injection techniques, including boolean-based blind, error-based, union query, stacked queries, and time-based blind, across various database management systems. Its specialized algorithms and extensive payload database make it highly efficient and effective for fully automating the identification and exploitation of SQL injection vulnerabilities.

The SMTP commands VRFY (Verify) and EXPN (Expand) are powerful reconnaissance tools for penetration testers. VRFY is used to confirm the existence of a specific user or mailbox on the target mail server, returning either a valid user name or an error. EXPN, conversely, is designed to reveal the full membership of a mailing list or alias, providing a list of all individual recipients. Both commands, if not properly restricted, allow an attacker to enumerate valid email addresses and distribution lists, which is invaluable for targeted phishing, spam campaigns, or further social engineering efforts.

Juicy Potato is a well-known Windows privilege escalation tool that exploits the SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege often held by services running as SYSTEM. It leverages specific COM server CLSIDs and a local NTLM relay attack to force a high-privileged process (e.g., BITS, Print Spooler) to authenticate back to a listener controlled by the low-privileged attacker. This process allows the attacker to capture and impersonate the SYSTEM user's security token, thereby escalating privileges to SYSTEM.

Time-based blind SQL injection is a technique where the attacker infers information by observing the time it takes for the database server to respond to specific queries. By introducing conditional delays (e.g., IF(condition, SLEEP(5), 0)), the presence or absence of a delay indicates whether the condition is true or false. The 'T' option in sqlmap explicitly instructs the tool to employ this method, making it the correct answer.

The `EXPN` (Expand) command in SMTP is specifically designed to request the server to return the actual delivery addresses for a given mailing list, alias, or even a single user. By issuing `EXPN <address>`, a security analyst or attacker can determine if an address is valid and, if it represents a list or alias, retrieve all the individual email addresses associated with it, aiding in reconnaissance and target identification.

A WHOIS lookup queries publicly accessible databases maintained by domain registrars and regional internet registries (RIRs) to retrieve information like domain ownership, registration dates, and associated contact details. This process does not send any packets or requests directly to the target's network infrastructure or systems. Consequently, it leaves no trace on the target's logs, classifying it as a purely passive reconnaissance technique.

Syscall hooking is a sophisticated technique employed by kernel-mode rootkits to achieve stealth by intercepting and modifying the behavior of system calls. When userland commands like `ls`, `ps`, or `netstat` attempt to query system information (e.g., `open()`, `read()`, `stat()`, `getdents()`), the rootkit's hook diverts these calls to its own code. It then filters out any references to its own files, processes, or network connections before returning manipulated, "clean" data to the calling application, effectively making its presence invisible to standard system utilities.

Slowloris keeps HTTP connections open.

Insecure Direct Object Reference (IDOR) occurs when an application exposes a direct reference to an internal implementation object, such as a file, directory, or database record, and fails to implement sufficient authorization checks. By manipulating parameters like 'id' in a URL or API request, an attacker can bypass authorization and access resources belonging to other users or system components. This direct manipulation of object identifiers to gain unauthorized access perfectly describes the scenario where changing an 'id' parameter reveals another user's data.

The SameSite cookie attribute directly addresses Cross-Site Request Forgery (CSRF) attacks by restricting when a browser sends cookies with cross-site requests. By setting SameSite to Lax or Strict, the browser will not attach the session cookie to requests originating from a different site, effectively preventing an attacker's forged request from being authenticated by the victim's browser. This significantly reduces the risk of unauthorized actions being performed on behalf of the user without their explicit intent.

A null session is an unauthenticated connection to a Windows IPC$ share, primarily intended for anonymous enumeration of system information. In older Windows versions (e.g., NT, 2000, XP) or systems with specific misconfigurations, these null sessions could be exploited to gain unauthorized access to administrative shares like C$ without requiring any user credentials. This vulnerability directly explains how a penetration tester could access C$ in the absence of explicit authentication, aligning with the scenario.

Burp Intruder is specifically engineered for automating customized attacks against web applications, making it ideal for brute-forcing, fuzzing, and credential stuffing. It allows users to define specific insertion points within a request and then systematically iterate through custom payload lists, applying various attack types like Sniper, Battering Ram, Pitchfork, and Cluster Bomb. This precise control over payload generation and delivery makes it the tool of choice for automating targeted attack scenarios.

The SMTP EXPN (Expand) command is a valid method for enumerating users by requesting the expansion of a mailing list or alias. When a server processes an EXPN command for a known list, it typically returns the individual email addresses of all members, thereby revealing valid user accounts on the system. This direct disclosure of recipient lists makes it a powerful tool for reconnaissance during the enumeration phase.

The VRFY command verifies whether a mailbox exists, and the response codes confirm this technique.

The attacker uses a fabricated pretext to gain trust.

Stored XSS, also known as Persistent XSS, is a severe web vulnerability where a malicious script is permanently saved on the target server, typically within a database, comment section, or feedback system. When a legitimate user, such as an administrator, later retrieves and views the compromised data, their browser executes the embedded script without their knowledge. This allows the attacker to compromise user sessions, deface websites, or redirect victims, making it a highly impactful vulnerability due to its persistence and widespread potential.