Certified Ethical Hacker CEH (CEH) — Questions 526–600

Isolating the compromised server is the critical first step in containing an active security incident. Disconnecting the network cable physically severs all external and internal network communication, immediately halting data exfiltration, command-and-control (C2) communications, and preventing lateral movement to other systems. Blocking the IP at the firewall provides an additional layer of network-level containment. This action preserves the system's state for forensic analysis while stopping the immediate threat, allowing for a structured incident response process to follow.

A process running inside a container with the CAP_SYS_ADMIN capability is a critical security vulnerability. This capability grants extensive privileges, often likened to root access on the host system, allowing operations such as mounting filesystems, creating device nodes, and loading kernel modules. An attacker can leverage CAP_SYS_ADMIN to break out of the container's isolation by manipulating the host's kernel or filesystem, effectively gaining control over the underlying host machine.

Backdoor Trojans commonly use registry run keys for persistence.

theHarvester is a specialized open-source intelligence (OSINT) tool explicitly designed for passive reconnaissance. It systematically queries multiple public data sources, including search engines (Google, Bing), PGP key servers, LinkedIn, and other platforms, to gather publicly available information such as email addresses, subdomains, hostnames, and employee names. Its passive approach means it does not directly interact with the target organization's systems, making it ideal for initial information gathering without alerting the target.

Using a container escape to access the host OS is a critical cloud misconfiguration vulnerability. This occurs when a flaw in the container runtime, kernel, or container configuration allows an attacker to break out of the isolated container environment and gain unauthorized access to the underlying host operating system. Such an escape often leverages misconfigured capabilities, insecure mounts, or unpatched kernel vulnerabilities, directly exposing the host infrastructure to compromise.

LinkedIn profiles and company pages are published by the organization and its employees, so reviewing them is passive and directly yields names, titles, departments, and often the email naming convention. This aligns perfectly with the goal of building an employee profile from publicly available information without contacting target systems.

A SYN flood is characterized by an attacker sending a large volume of TCP SYN packets to a target server without completing the three-way handshake. The tcpdump -i eth0 -n host command would reveal a high rate of incoming TCP packets with the SYN flag set, directed at the specified host, but without corresponding SYN-ACK or ACK packets originating from the target. This pattern indicates numerous half-open connections accumulating on the target, exhausting its connection table resources.

ScoutSuite is a comprehensive open-source tool specifically engineered for auditing the security posture of multi-cloud environments, including Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). It meticulously identifies security misconfigurations, adherence to best practices, and potential vulnerabilities across various services like IAM, storage, and compute. By generating an interactive HTML report, it provides a clear overview of an organization's cloud security risks, enabling targeted remediation efforts.

Erasing tracks is a critical post-exploitation phase where an attacker systematically removes or alters forensic evidence of their presence and activities on a compromised system. This encompasses various anti-forensic techniques, including clearing system logs (e.g., Windows Event Logs, `auth.log`), modifying timestamps, deleting temporary files, and removing command history. Modifying log files directly falls under this comprehensive objective, aimed at hindering incident response and forensic investigations.

A rainbow table attack leverages large, precomputed tables containing chains of hash values and their corresponding plaintext passwords. This method significantly speeds up the process of reversing cryptographic hashes to recover the original password, bypassing the need for real-time computation for each guess. Attackers use these tables to quickly find passwords from stolen hash databases by looking up the hash and tracing back the chain. This precomputation makes it highly effective against unsalted hashes.

AES (Advanced Encryption Standard) is the correct answer because it is a symmetric block cipher that processes data in fixed-size blocks of 128 bits. It supports robust key lengths of 128, 192, or 256 bits, providing strong cryptographic security. Its design, based on the Rijndael cipher, makes it highly efficient and widely adopted for various secure communication and storage applications.

Prepared statements, also known as parameterized queries, are a primary defense against SQL injection because they fundamentally separate the SQL code logic from user-supplied data. The database engine pre-compiles the query structure, treating all subsequent input as literal data values rather than executable SQL commands. This mechanism ensures that malicious characters within user input cannot alter the intended query structure, effectively preventing injection attacks by ensuring input is never interpreted as code.

The presence of unexpected rows or columns in an application's query results is a strong indicator of a successful UNION-based SQL injection. Attackers leverage the `UNION` operator to combine the results of their malicious query with the legitimate query, thereby extracting data from other tables or databases that were not intended for display. This manipulation directly alters the structure and content of the returned dataset, making it a clear sign of data exfiltration or unauthorized data retrieval.

Intruder is purpose-built for automating parameterized attacks by systematically injecting various payloads into specified insertion points within an HTTP request. It enables sophisticated brute-force, dictionary, and credential stuffing attacks by iterating through user-defined lists or generated sequences of values. This module offers multiple attack types, such as Sniper or Battering Ram, to efficiently test a wide range of input fields for vulnerabilities or weak credentials.

XXE injection occurs when an XML parser processes XML input containing references to external entities, which are then resolved by the server without proper validation. Attackers can define malicious external entities within the Document Type Definition (DTD) to exploit this, often using the "file://" protocol to read local files from the server's filesystem, such as configuration files or sensitive credentials. This direct file disclosure via XML entity processing perfectly matches the described observation.

Running an Nmap SYN scan against a target is a definitive example of active reconnaissance because it directly interacts with the target system by sending TCP SYN packets. The target's response, whether a SYN-ACK for open ports or an RST for closed ones, provides real-time information about its network services and host status. This direct packet exchange generates network traffic that originates from the attacker and terminates at the target, making it detectable by intrusion detection systems (IDS) or firewalls.

The `whois` command is specifically designed to query WHOIS databases, which contain publicly available registration information for domain names and IP address blocks. This data includes critical details such as the domain registrar, the domain's creation and expiration dates, the associated name servers, and administrative, technical, and registrant contact information. This information is invaluable for initial footprinting and reconnaissance phases of a penetration test.

AES is a symmetric block cipher: sender and receiver share one secret key for both encryption and decryption. It satisfies the question's requirement for a symmetric algorithm, unlike asymmetric options such as RSA or Diffie-Hellman, which use separate public and private key pairs.

The `snmpwalk` command is specifically designed to query a network device and retrieve all information available within its Management Information Base (MIB) tree, starting from a specified OID (or the root if none is given). The `v2c` flag explicitly dictates the use of SNMP version 2c, which offers improved security and data types over v1. The `c public` argument specifies "public" as the community string, acting as a password for read-only access to the device's SNMP agent at IP address 192.168.1.1. This effectively performs a comprehensive enumeration of the device's configuration and status.

The `nmap -sn 192.168.1.0/24` command is the correct choice for performing a ping sweep, also known as host discovery. The `-sn` (or `--ping-scan`) flag instructs Nmap to skip port scanning and only attempt to determine if hosts are online. It achieves this by sending a combination of ICMP echo requests, TCP SYN packets to port 443, and TCP ACK packets to port 80, along with an ICMP timestamp request, to identify live hosts efficiently across the specified /24 subnet. This method quickly identifies active devices without generating extensive network traffic from full port scans.

Performing a WHOIS lookup for a target domain is a classic example of passive reconnaissance. This process involves querying public databases maintained by domain registrars and registries to retrieve registration information, such as registrant contact details, domain creation/expiration dates, and nameservers. Crucially, these queries are directed at third-party WHOIS servers, not the target domain's actual servers, meaning no direct network traffic is sent to or received from the target, leaving no trace.

Directory traversal, also known as path traversal, is a vulnerability that permits an attacker to read arbitrary files on the server's file system by manipulating file paths in user-supplied input. This exploit uses sequences like "../" (dot-dot-slash) to navigate outside the intended directory, bypassing security controls that fail to properly validate or sanitize file names or paths. The ability to "view documents by specifying" a path directly aligns with this vulnerability, as it focuses on accessing files located anywhere on the server.

hping3 is a command-line oriented TCP/IP packet assembler/analyzer, specifically engineered for crafting and sending custom packets, including a high volume of SYN packets. Its robust capabilities allow for precise control over packet headers, source IP spoofing, and the ability to flood a target with a continuous stream of SYN requests, making it an ideal and highly effective tool for simulating SYN flood attacks and testing network resilience.

This vulnerability occurs entirely on the client-side when a web application's JavaScript code processes user-controllable data, often from the URL fragment (#) or query string (?), and writes it unsafely into the Document Object Model (DOM). If the client-side script dynamically generates HTML or JavaScript using this unvalidated input, an attacker can inject malicious code that executes within the victim's browser. The "reflection" happens within the browser's DOM, not necessarily on the server's response.

theHarvester is a highly effective OSINT tool specifically designed for passive information gathering during the reconnaissance phase. It systematically collects publicly available data such as email addresses, subdomains, hostnames, employee names, and open ports from various public sources like search engines (Google, Bing), PGP key servers, LinkedIn, and Shodan. This makes it an excellent choice for building an initial profile of a target without direct interaction.

WEP (Wired Equivalent Privacy) encryption is notoriously vulnerable due to its use of a 24-bit Initialization Vector (IV) concatenated with the static WEP key to form the RC4 cipher key. The small IV space leads to frequent IV reuse, especially with weak IVs that reveal information about the key stream. By capturing a sufficient number of these weak IVs and their corresponding encrypted packets, tools like aircrack-ng can statistically analyze the patterns to deduce the WEP key, often within minutes.

The default Trust Center Link Key in Zigbee is a well-known value (e.g., 'ZigBeeAlliance09') that is used for initial communication with the Trust Center. If the network does not enforce unique link keys or install codes, an attacker can use this default key to join the network and communicate with devices. This is the most likely cause of the unauthorized device joining.

This option is correct because CVE-2021-4034, known as "PwnKit," is a critical local privilege escalation vulnerability in the `pkexec` utility. It allows an unprivileged local attacker to gain full root privileges on a vulnerable Linux system by exploiting a memory corruption bug (out-of-bounds write) in how `pkexec` handles command-line arguments. This specific exploit path directly provides the means to achieve root access, fulfilling the objective of privilege escalation.

A successful AXFR response means the DNS server permitted an unauthenticated zone transfer, exposing every record in the zone. This misconfiguration lets anyone enumerate hosts, subdomains and mail servers, confirming the server is vulnerable to zone transfer attacks.

Steganography's core purpose is to embed secret information within seemingly innocuous digital media, such as images, audio, or video files. This technique aims to conceal the very existence of the hidden data, making it difficult for an observer to even suspect that secret communication is taking place. Unlike encryption, which scrambles data, steganography focuses on covert communication by making the data appear as part of a benign carrier file, thereby avoiding detection.

Cookie theft directly enables session hijacking by capturing the session identifier stored in a browser cookie, allowing an attacker to impersonate the authenticated user without credentials. This satisfies the stem's requirement for a session hijacking technique, as possession of a valid session token grants immediate access to the victim's active session.

This option accurately describes the command's functionality. The `-i eth0` flag specifies the network interface for capture. The `src host 192.168.1.10` filter ensures only packets originating from that specific IP address are captured, while `dst port 80` further narrows the scope to only include HTTP traffic (standard port 80). Finally, the `-w capture.pcap` flag instructs tcpdump to save all filtered packets to a file named `capture.pcap` for subsequent offline analysis.

Split DNS, or Split-Horizon DNS, is designed to provide different DNS responses based on the client's network location, typically serving internal IP addresses to internal users and external IP addresses to external users for the same hostname. A misconfiguration occurs when the DNS server fails to properly differentiate client origins, or is configured to return both internal and external records simultaneously in a single response, thereby exposing internal network topology or causing connectivity issues.

The 'filtered' state in Nmap signifies that the port is inaccessible because probe packets are being dropped, or responses are not reaching the scanner. This typically occurs when a firewall, intrusion prevention system (IPS), or other network security device is actively inspecting and blocking traffic destined for that specific port, preventing Nmap from determining if a service is listening. The lack of any definitive response (SYN/ACK for open, RST for closed) points directly to an intermediate device interfering, making this the correct explanation.

Reflected Cross-Site Scripting (XSS) occurs when a malicious script, often embedded within a URL parameter or form input, is immediately and unsafely echoed back in the web server's HTTP response. The victim's browser then interprets and executes this injected script as part of the legitimate webpage content. The exhibit clearly shows user input containing script tags being directly reflected into the HTML response without proper sanitization, leading to client-side script execution, which is the hallmark of a reflected XSS vulnerability.

The Social Engineering Toolkit (SET) is purpose-built for simulating various social engineering attacks, making it the ideal choice for testing employee susceptibility. It provides modules for spear phishing, credential harvesting, web jacking, and infectious media generator attacks, directly targeting the human element. By deploying these simulated threats, organizations can assess how employees react to realistic social engineering tactics and identify areas for security awareness training improvement.

Using the 'strings' command is a quintessential static analysis method as it involves examining the binary file directly on disk without executing it. This command extracts sequences of printable ASCII or Unicode characters embedded within the executable, which can reveal valuable clues such as file paths, URLs, API function names, or error messages hardcoded by the malware author.

Buffer overflows enable arbitrary code execution by allowing an attacker to overwrite critical memory locations, such as return addresses on the stack or function pointers in data segments. By carefully crafting input that exceeds the buffer's capacity, malicious shellcode can be injected into memory. The overwritten control flow mechanism then redirects program execution to this injected code, granting the attacker full control over the compromised process.

Creating a Volume Shadow Copy (VSS) is the most effective and commonly used method to access the SAM file while the operating system is running. VSS creates a point-in-time, read-only snapshot of the entire volume, including files that are currently locked by the OS. This snapshot allows the penetration tester to access a consistent version of the SAM file from the shadow copy, effectively bypassing the exclusive lock maintained by the live operating system without interrupting its operations.

Username enumeration occurs when a web application's login mechanism provides distinct error messages or response times for valid usernames compared to invalid ones, even if the password is incorrect. For instance, "Invalid password for user 'admin'" versus "User 'admin' does not exist." This differential feedback allows an attacker to systematically test common usernames and compile a list of valid accounts, significantly aiding in subsequent brute-force or credential stuffing attacks.

Server-side request forgery (SSRF) exploits a vulnerability where a web application is tricked into making requests to an arbitrary domain specified by the attacker. This allows an attacker to force the server to connect to internal services, such as metadata APIs, internal databases, or other hosts within the organization's private network, which are typically not directly accessible from the internet. The "client sends a reque" could be the initial malicious input that triggers the server to make an unintended internal request.

Slowing down the scan rate directly reduces the number of packets sent per second (PPS) or connections attempted per minute. This strategic reduction keeps the scanning activity below the predefined thresholds set by rate-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), which are designed to detect anomalous traffic volumes. By maintaining a low packet rate, the ethical hacker can conduct reconnaissance without triggering alerts that would otherwise flag the activity as a potential port scan or denial-of-service attempt, thus evading detection.

Reaver is a specialized tool explicitly designed to exploit a critical vulnerability in the Wi-Fi Protected Setup (WPS) protocol by performing a brute-force attack against the WPS registrar PIN. It leverages the fact that the 8-digit WPS PIN is validated in two halves, allowing an attacker to determine the first four digits and then the next three, with the last digit being a checksum. This significantly reduces the number of attempts required, making the brute-force attack feasible and highly effective against vulnerable WPS-enabled access points.

The HTTP OPTIONS method is specifically designed to query a web server or resource about the communication options supported by the server for that particular URL. It provides a list of allowed HTTP methods (e.g., GET, HEAD, POST, PUT, DELETE, TRACE, CONNECT) in the 'Allow' header of its response. This is crucial for a penetration tester to discover if potentially vulnerable methods like PUT (for file upload) or WebDAV methods are enabled before attempting to exploit them.

The bucket policy explicitly grants the "s3:GetObject" action to "Principal: *". This configuration means that any user, including unauthenticated internet users, can retrieve and read the content of any object within the bucket, provided they know the object's key. This effectively makes all objects publicly readable, posing a significant data exposure risk.

An open port has a service listening.

The `rpcclient` utility is a powerful tool for interacting with Microsoft Remote Procedure Call (MS-RPC) services, which are commonly transported over Server Message Block (SMB) on TCP port 445. The command `rpcclient -U n 192.168.1.10` attempts to establish a null session (unauthenticated connection) to the target, allowing an attacker to enumerate various system details like user lists, share information, and group memberships by making RPC calls. This makes it a primary method for SMB/RPC enumeration.

Slowloris opens many partial HTTP requests, sending incomplete headers and never finishing them. The server holds each connection open awaiting the remainder, exhausting its connection pool while consuming minimal attacker bandwidth, matching the incomplete-request symptom described.

The presence of multiple Mail Exchanger (MX) records for a domain is a strong indicator of a resilient email infrastructure designed for both load balancing and failover. When multiple MX records exist, mail sending agents attempt delivery to the server with the lowest preference value first. If that server is unavailable or overloaded, they proceed to the next highest preference, ensuring email delivery continuity and distributing the incoming mail traffic across several servers. This configuration significantly enhances reliability and availability.

A SYN flood abuses the TCP three-way handshake: the attacker sends many SYN packets, often with spoofed source addresses, so the server allocates half-open connections and replies with SYN-ACKs that are never completed, exhausting the backlog queue and denying service to legitimate clients.

The -f (fragment packets) Nmap option instructs Nmap to split the IP header of the probe packets into several smaller IP packets. This technique, known as IP fragmentation, can bypass simple stateless firewalls or intrusion detection systems (IDS) that only inspect the first fragment of a packet or are configured to drop packets exceeding a certain size. By breaking the packet into 8-byte chunks, it makes reassembly more complex for network security devices, potentially allowing the scan to proceed undetected.

Ophcrack is a specialized tool explicitly engineered for cracking Windows LM and NTLM hashes by utilizing precomputed rainbow tables. It comes bundled with these tables, which significantly accelerate the process of recovering passwords, especially shorter or less complex ones, from these specific Windows authentication protocols. Its design is entirely centered around the time-memory tradeoff inherent in rainbow table attacks, making it highly effective for its intended purpose.

This bucket policy explicitly grants access to 'Principal': '*', which signifies *any* AWS identity or anonymous user. The accompanying 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}} further specifies that this broad access is permitted from *any* IPv4 address. The combination of allowing any principal from any IP address effectively overrides any other restrictions and renders the S3 bucket completely public and accessible to the entire internet, which is a critical security misconfiguration.

This Nmap command employs two significant evasion techniques: -f for packet fragmentation and -D for decoy IP addresses. Packet fragmentation breaks the scan probes into smaller, non-standard-sized IP fragments, which can bypass simple stateful firewalls or IDS rules that only inspect the initial fragment. The -D option generates multiple decoy source IP addresses, making it difficult for an IDS to determine the actual scanner's IP from the network logs, effectively obscuring the attacker's origin and distributing the perceived attack source.

The `nbtstat -a <IP_address>` command is specifically used to query and display the NetBIOS name table of a remote machine. This table contains a list of NetBIOS names registered by the target host, including unique names (e.g., workstation name, messenger service) and group names (e.g., domain/workgroup name), along with their associated types and registration status. This information is crucial for understanding the remote machine's NetBIOS identity and services.

Cross-site request forgery (CSRF) exploits the trust a web application has in an authenticated user's browser. An attacker crafts a malicious web page or email that, when visited or opened by an authenticated user, forces their browser to send an unintended request to the vulnerable application. The application, failing to verify the request's true origin or intent, processes the forged request, often relying on session cookies. Manipulating or bypassing checks on the Referer header can be a technique used in CSRF attacks, as applications sometimes use it as a weak defense to ensure requests originate from the expected domain.

An Intrusion Detection System (IDS) can be specifically configured to identify and drop packets that only contain the SYN flag, a common characteristic of a SYN scan (half-open scan). This allows the IDS to detect and mitigate reconnaissance attempts without disrupting legitimate full TCP three-way handshakes, which are typical of a TCP connect scan. Therefore, SYN packets from a SYN scan would be dropped, while the full handshake of a connect scan might be permitted to proceed.

Intruder is the dedicated Burp Suite tool for automating customized attacks against web applications by systematically sending multiple requests with variable payloads. It allows testers to define specific insertion points within a request and iterate through a list of payloads, making it ideal for brute-forcing credentials, fuzzing input fields, and identifying injection vulnerabilities like SQLi or XSS with high precision and control over attack types.

Hashcat is the industry-standard tool for high-performance password recovery, leveraging highly optimized GPU acceleration to crack a vast array of hash types, including NTLM (mode 1000). Its architecture is specifically designed to maximize parallel processing on graphics cards, enabling exceptionally fast dictionary attacks, brute-force, and hybrid attacks. This unparalleled efficiency makes Hashcat the optimal choice for rapidly cracking NTLM hashes obtained from a SAM database dump, significantly reducing the time required compared to CPU-based or rainbow table methods.

This statement is correct. When the cryptographic hash (e.g., SHA256) calculated from a downloaded file precisely matches the official, published hash value, it provides strong cryptographic assurance. This match confirms that the file's contents are identical to the original source and have not been altered, corrupted, or tampered with during transit or storage, thereby establishing its authenticity and integrity.

For SNMPv1 and SNMPv2c, the community string serves as a clear-text password or authentication credential required to access the SNMP agent's Management Information Base (MIB). Without knowing the correct read-only or read-write community string, an `snmpwalk` utility cannot successfully query the device for its managed objects. This string effectively controls access permissions, allowing or denying the retrieval of system information and acting as the primary security mechanism for these older SNMP versions.

When an S3 bucket is configured for public read access, it means that the bucket policy explicitly permits the s3:GetObject action for the * principal (anonymous users). This configuration allows anyone on the internet to enumerate and download all objects stored within that bucket without requiring any authentication. This direct and unrestricted access inevitably leads to unauthorized data access and subsequent exfiltration, constituting a severe data breach where sensitive information can be freely downloaded.

Token impersonation, particularly when a process holds the SeImpersonatePrivilege, allows a service or application to temporarily adopt the security context of another user or process. An attacker can exploit this by compromising a service running with this privilege, then using it to impersonate a higher-privileged user's token, such as an administrator or SYSTEM account. This enables the attacker to execute commands or access resources with elevated permissions, effectively achieving privilege escalation within the Windows system.

DNS amplification is a highly effective distributed denial-of-service (DDoS) attack where attackers send small UDP DNS queries with a spoofed source IP address (the victim's IP) to numerous open DNS resolvers. These resolvers then respond with much larger UDP packets containing DNS records, directed back to the spoofed victim. This technique leverages the amplification factor of DNS responses to overwhelm the target with a massive surge of incoming UDP traffic, typically on port 53.

Updating Log4j to version 2.17.1 or later directly addresses the Log4Shell vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) by completely disabling JNDI lookups by default. This version ensures that untrusted input can no longer trigger remote code execution (RCE) via LDAP, RMI, or other JNDI-enabled services. Applying this patch is the most comprehensive and recommended solution, as it eliminates the underlying flaw rather than merely mitigating symptoms. It ensures the application's logging functionality remains secure and fully operational.

A SUID (Set User ID) bit on an executable allows it to run with the permissions of its owner, regardless of the user executing it. If a binary is owned by the root user and has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that execution. This mechanism is specifically designed for privilege escalation, enabling a low-privileged user to perform actions typically reserved for root, such as gaining a root shell or modifying system configurations.

This option correctly identifies the purpose of using Nmap's UDP scan (`-sU`) targeting the standard SNMP port (161) in conjunction with the `snmp-brute` NSE script. This script systematically attempts a list of common or custom community strings (like "public," "private," "manager") against the discovered SNMP agent. Successful brute-force reveals valid community strings, granting read or write access to the device's MIB, which is a critical step in reconnaissance and potential exploitation.

The online issuing CA is directly responsible for generating, signing, and managing the lifecycle of end-entity certificates within this PKI. When an end-entity certificate needs to be revoked, it is the issuing CA that records this revocation event and publishes it in its own Certificate Revocation List (CRL). Consequently, clients validating an end-entity certificate must consult the CRL published by the online issuing CA to ascertain its current revocation status.

ARP poisoning, also known as ARP spoofing, is a man-in-the-middle attack where an attacker sends forged ARP reply messages onto a local area network. These malicious replies associate the attacker's MAC address with the IP address of another host, such as the default gateway or another workstation. By continuously sending these fake ARP replies, the attacker can trick multiple devices into updating their ARP caches with incorrect information, thereby redirecting traffic intended for the legitimate IP to the attacker's machine. This directly explains the observation of multiple ARP replies for one IP.

Reflected XSS occurs when a malicious script, supplied in an HTTP request, is immediately and unsafely echoed back in the server's HTTP response. The server takes user-supplied input, often from a URL parameter, and directly embeds it into the HTML page without adequate sanitization or encoding. This causes the victim's browser to execute the script upon receiving the crafted response, making it a non-persistent, single-request attack.

Enumerating SMB shares and session information using `net view \\fileserver` (on Windows) or `smbclient -L //fileserver` (on Linux/Kali) is a highly effective and low-impact reconnaissance method. These commands leverage the Server Message Block (SMB) protocol, the file server's core service, to list accessible shares and potential misconfigurations like null sessions. This approach directly targets the server's primary function and is designed to work even with standard user permissions, providing valuable insights into accessible resources.

Fragmenting IP packets into small segments, such as 8-byte fragments using the -f flag, is a classic IDS evasion technique. Many Intrusion Detection Systems struggle with the efficient and accurate reassembly of highly fragmented packets, especially if they arrive out of order or are unusually small. This difficulty can cause the IDS to miss the complete signature of a malicious payload or scan, allowing the fragmented traffic to bypass detection and reach the target.

theHarvester is a dedicated OSINT tool specifically designed for gathering publicly available information, including email addresses, subdomains, hostnames, and employee names. It queries various public data sources like search engines (e.g., Google, Bing), PGP key servers, and social media platforms to aggregate this intelligence. This makes it exceptionally effective for passive reconnaissance aimed at collecting target organization email addresses without direct interaction.

This is correct because DNS amplification attacks exploit misconfigured or intentionally open DNS resolvers that are accessible on the internet. Attackers send small DNS queries to these resolvers, spoofing the victim's IP address as the source. The open resolvers then respond with significantly larger DNS records to the unsuspecting victim, effectively multiplying the attacker's initial traffic volume.