Certified Ethical Hacker CEH (CEH) — Questions 601–675

Local File Inclusion (LFI) is the correct classification for this vulnerability, as it involves an attempt to include files present on the web server's local file system. However, the crucial detail preventing immediate success is the automatic appending of the ".php" extension to the user-supplied input. This means an attempt to include a file like "/etc/passwd" would result in the application trying to include "/etc/passwd.php", which typically does not exist, thereby blocking direct access to the target file without further bypass techniques.

Scanning and enumeration is the phase where an attacker actively probes target systems to identify live hosts, open ports, running services, operating system types, and potential vulnerabilities. The nmap command is a quintessential tool for this phase, as it systematically sends various types of packets to map out the network landscape and gather detailed information about network services. This active interaction provides the crucial intelligence needed to identify potential entry points for subsequent exploitation attempts.

Erasing tracks is a critical post-exploitation phase where an attacker attempts to remove or obscure any evidence of their presence and activities on a compromised system. This directly involves manipulating system logs, such as /var/log/auth.log or ~/.bash_history, by truncating, deleting, or modifying entries. Reducing logging levels or disabling logging services are also common techniques to prevent future actions from being recorded, thereby making forensic analysis significantly more challenging and hindering incident response efforts.

Session hijacking via cookie prediction occurs when an attacker successfully guesses or calculates a valid session identifier (Session ID) that an application uses to maintain a user's authenticated state. By setting their own browser's cookie to this predicted, valid Session ID, the attacker can bypass the login process and assume the identity of the legitimate user, gaining unauthorized access to their active session. This method specifically exploits weak or predictable session ID generation algorithms.

SYN cookies are a robust defense mechanism against TCP SYN floods, operating by enabling a server to respond to SYN requests without allocating resources for a half-open connection immediately. Instead, the server crafts an initial sequence number (ISN) for the SYN-ACK packet that encodes information about the connection, including the client's IP, port, and the server's ISN. Only when the client responds with a valid ACK packet, using the derived sequence number, does the server then reconstruct the connection state, effectively deferring resource allocation until the three-way handshake is complete and verified. This stateless approach prevents the server's connection table from being overwhelmed.

Generic error messages, such as "Invalid username or password," are a crucial defense against username enumeration vulnerabilities. By providing the exact same response regardless of whether the submitted username is valid but the password is wrong, or if the username itself does not exist in the system, the application denies attackers the ability to differentiate between these two states. This ambiguity prevents an attacker from systematically testing a list of potential usernames to identify which ones are registered within the system.

Using Shodan to search for IP ranges and performing DNS enumeration are both passive reconnaissance techniques. Shodan queries publicly indexed internet-connected devices, providing information without direct interaction with the target. Similarly, DNS enumeration, when querying public DNS records (e.g., A, MX, NS records), retrieves publicly available information without sending traffic directly to the target's internal network, making it a stealthy and permissible initial step.

Unpacking reveals the original code for static analysis.

This technique involves taking words from a dictionary or wordlist and systematically modifying them using predefined rulesets. Common mutations include appending numbers (e.g., "password123"), prepending or appending special characters (e.g., "!password", "password!"), or changing case (e.g., "Password"). This method significantly expands the attack surface beyond simple dictionary words, effectively targeting users who create passwords by slightly altering common terms.

Username enumeration is an attack where an attacker attempts to discover valid usernames by observing differences in application responses (e.g., distinct error messages, varying HTTP status codes, or even subtle timing discrepancies) when submitting valid versus invalid usernames. For instance, a "User not found" message for an invalid username compared to an "Incorrect password" message for a valid one clearly indicates a username's existence, allowing an attacker to compile a list of active accounts. This technique is a critical precursor to many other credential-based attacks.

The exhibit clearly shows the successful execution of a UNION SELECT SQL injection query, resulting in the direct retrieval of sensitive user data, specifically username and corresponding password hash pairs. These extracted hashes, likely MD5 given their typical format in such vulnerabilities, are highly susceptible to offline cracking techniques like dictionary attacks or rainbow tables. Once cracked, these plaintext passwords can then be used for further unauthorized access or credential stuffing attacks against other services.

"Erasing tracks" accurately describes the act of cleaning logs and command history, which are critical steps for an attacker to remove evidence of their presence and activities on a compromised system. Simultaneously, "Spying" precisely characterizes the installation of a kernel module designed to hide processes. This module enables the attacker to maintain a stealthy, persistent foothold, allowing for undetected monitoring and control, effectively 'spying' on the system's operations without revealing their malicious presence.

Burp Suite Proxy is a core component of the Burp Suite platform, specifically engineered to sit between a web browser and a target web server. It functions as an intercepting HTTP/S proxy, allowing a penetration tester to view, modify, and replay individual requests and responses in real-time before they reach their destination. This capability is fundamental for identifying vulnerabilities by manipulating parameters, headers, and other traffic components.

Blind infers results without direct output.

Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on a LAN, specifically designed to intercept traffic, perform live content filtering, and establish various forms of active and passive eavesdropping. Its core functionality includes robust ARP poisoning capabilities, allowing it to redirect traffic between two hosts through the attacker's machine by sending forged ARP replies. This enables the penetration tester to intercept, modify, and inject data into network communications, making it the ideal tool for demonstrating MITM vulnerabilities.

MAC flooding overwhelms a network switch's Content Addressable Memory (CAM) table by rapidly sending frames with unique, spoofed source MAC addresses. When the CAM table, which stores MAC-to-port mappings, becomes full, the switch can no longer learn new addresses and reverts to broadcasting all incoming frames out of every port within the VLAN. This effectively transforms the switch into a hub-like device, allowing an attacker to intercept traffic intended for other hosts.

IEEE 802.11w introduces Management Frame Protection (MFP), which cryptographically protects certain 802.11 management frames, including deauthentication and disassociation frames. This protection ensures that only legitimate, authenticated devices can send these frames, preventing an attacker from spoofing a deauthentication request. By validating the source and integrity of these critical frames, 802.11w effectively mitigates deauthentication attacks.

The presence of HTTP URLs, particularly those ending with executable file extensions like .exe, is a strong indicator that the malware is designed to retrieve additional components. This behavior is characteristic of a downloader or dropper, which fetches secondary payloads from remote Command and Control (C2) servers to execute further malicious activities. Such multi-stage attacks are common, allowing the initial infection to be small and stealthy while dynamically loading more complex functionality.

In-band SQL injection involves using the same communication channel for both injecting the payload and receiving the results, making it a direct interaction. Specifically, the `INTO OUTFILE` clause in SQL allows the result of a query to be written directly to a file on the database server's filesystem. SQLMap utilizes this functionality to upload a webshell or other malicious files, provided the database user has sufficient `FILE` privileges and the target directory is writable, thereby achieving direct file write capability.

A hardcoded encryption key embedded directly into device firmware functions as a universal master key, effectively creating an intentional or unintentional backdoor. Its discovery allows any attacker to decrypt communications, authenticate as a legitimate device, or gain unauthorized control, bypassing standard security protocols. This vulnerability provides persistent, privileged access, much like a set of secret credentials known only to the firmware developer, but now exposed.

Ettercap is a comprehensive suite specifically designed for man-in-the-middle (MITM) attacks, making it the correct tool for ARP poisoning. It actively injects forged ARP replies into a local area network, associating the attacker's MAC address with the IP address of a legitimate host, such as the default gateway. This redirection allows Ettercap to intercept, modify, and forward traffic between the target and the intended destination, enabling sniffing and various active attacks.

This option is correct because rainbow tables are a prime example of a time-memory trade-off technique in cryptography. They involve a significant upfront investment in computational time to precompute vast tables (requiring substantial memory storage) containing chains of hashes and their corresponding plaintext values. This extensive precomputation allows for extremely rapid lookup and cracking of captured password hashes later, as the system avoids the need to recompute every possible password combination for each target hash.

When a firewall is configured to silently drop probe packets, the scanning host receives no response whatsoever within the timeout period. This lack of any acknowledgment, reset, or error message prevents Nmap from determining the true state of the port behind the firewall. Consequently, Nmap marks the port as "filtered," indicating that the probes are being intercepted or discarded by an intermediary device, making the port's actual open or closed status ambiguous.

The `smbclient -L <hostname>` command is precisely used to query a remote SMB server and list all available shares, printers, and other network resources it is exporting. When executed without specifying a username or password, it defaults to attempting an anonymous or guest login, effectively listing shares without requiring authentication. This is a common reconnaissance technique to discover potential targets and map out the network's shared infrastructure.

The `Content-Security-Policy` (CSP) header with the `frame-ancestors` directive explicitly defines which origins are permitted to embed the current resource in a frame, iframe, object, or embed tag. By restricting framing to 'self' or specific trusted domains (e.g., `frame-ancestors 'self'`), this policy directly prevents malicious external websites from embedding the target page. This robust defense effectively mitigates clickjacking attacks by controlling the contexts in which a page can be framed, thereby preventing UI redressing.

Insecure Direct Object Reference (IDOR) vulnerabilities arise when an application exposes a direct reference to an internal implementation object, such as a file, directory, or database record, without sufficient authorization checks. By simply changing a numeric ID in the URL, the security analyst is directly accessing another object that they should not be authorized to view or modify, demonstrating a clear failure in access control for that specific resource.

When a DNS lookup tool, such as `nslookup`, is used to query for Mail Exchange (MX) records, the response lists the servers designated to receive email for that domain. The presence of two distinct MX records in the output explicitly indicates that the domain has two separate mail exchange servers configured. Each record points to a specific host responsible for handling incoming mail, often with a preference value to guide delivery order.

Google dorking involves using advanced search operators to find specific information that is publicly indexed but not easily discoverable through regular searches. By crafting precise queries, such as `site:target.com filetype:xls "email"` or `inurl:contact intitle:"staff directory" @target.com`, an attacker can uncover publicly exposed documents, spreadsheets, or web pages containing lists of employee email addresses that the organization inadvertently left accessible. This is a highly effective OSINT technique for email harvesting.

Stored XSS persists on the server and affects all users viewing the content.

The `nbtstat -a <IP_address>` command is precisely used to display the NetBIOS name table of a remote host identified by its IP address. This utility queries the specified remote machine directly to retrieve the NetBIOS names it has registered, including its computer name, workgroup or domain name, and any services actively listening for NetBIOS connections. This functionality directly matches the described action of querying a remote host's NetBIOS name table.

A Smurf attack is a classic distributed denial-of-service (DDoS) attack that leverages ICMP reflection and amplification. An attacker sends ICMP Echo Request packets with a spoofed source IP address (the victim's IP) to the IP broadcast address of a large network. All active hosts on that network then respond with ICMP Echo Reply packets to the spoofed source IP, overwhelming the victim with a massive flood of replies from numerous legitimate sources. This perfectly matches the observation of a high volume of ICMP echo replies from multiple sources.

ScoutSuite is an open-source multi-cloud auditing tool designed to assess the security posture of cloud environments like AWS, Azure, GCP, and Alibaba Cloud. It systematically gathers configuration data and identifies potential vulnerabilities, misconfigurations, and compliance deviations, presenting them in a comprehensive report. This tool specifically focuses on detecting issues such as overly permissive IAM policies, unencrypted storage buckets, and publicly exposed resources, making it ideal for proactive cloud security assessments.

Nessus is a proprietary vulnerability scanner with a large plugin database.

Correct: Restricting SNMP access via ACLs limits the attack surface by allowing only trusted IP addresses to query SNMP agents, thwarting enumeration from unauthorized hosts.

When the SUID (Set User ID) bit is set on an executable file, and that file is owned by the root user, any user who executes this binary will temporarily assume the effective user ID of the file owner. This means the program will run with root privileges for the duration of its execution, allowing it to perform actions that would normally require root access. This mechanism is crucial for system utilities that need elevated permissions to function correctly for all users.

CSRF tokens are unique, unpredictable, and secret values generated by the server and embedded into forms or URLs for state-changing operations. When a user submits a request, the server verifies that the token included in the request matches the one stored in the user's session. This mechanism effectively prevents CSRF attacks because an attacker cannot forge a valid request without knowing the user's unique, session-specific token, which is not accessible to them.

MAC flooding is an attack technique that overwhelms a network switch's Content Addressable Memory (CAM) table with a massive number of unique, fake MAC address-to-port mappings. By sending numerous Ethernet frames, each with a different spoofed source MAC address, the attacker forces the CAM table to fill up completely. Once the CAM table is full, the switch can no longer store new MAC-to-port associations and reverts to acting like a hub, broadcasting all incoming traffic out of every port. This allows an attacker to capture and analyze traffic intended for other devices on the network segment.

SSH key-based authentication significantly enhances security against brute-force attacks by relying on cryptographic key pairs instead of guessable passwords. The private key, stored securely on the client, is mathematically linked to a public key on the server, making it virtually impossible to guess or brute-force due to its immense length and complexity. This method eliminates the vulnerability to dictionary attacks and common password cracking techniques, providing a robust defense.

Tailgating is physically following someone into a restricted area.

macof floods with random MACs to exhaust CAM table, enabling sniffing.

Stealing session cookies allows an attacker to impersonate a user.

Ettercap is a versatile and robust suite of tools specifically engineered for Man-in-the-Middle (MITM) attacks on local area networks. It excels at ARP poisoning by sending forged ARP replies to both the target host and the default gateway, effectively tricking them into routing traffic through the attacker's machine. This redirection allows for sniffing, content filtering, and other active manipulations of network communications.

Remote File Inclusion (RFI) occurs when a web application dynamically includes a file from a remote server, typically specified by a URL in user-controlled input. This vulnerability allows an attacker to inject and execute malicious code hosted on their own server within the context of the vulnerable web application. The application fetches the remote file (e.g., via HTTP) and processes its content as if it were a local script, leading to potential arbitrary code execution.

The `ec2:RunInstances` action, when not constrained by specific `ec2:SourceIp` conditions or other limiting factors, allows an authenticated principal to launch new EC2 instances from any IP address. This capability includes selecting various instance types, potentially very expensive ones, leading to unauthorized resource consumption, significant cost overruns, and resource abuse for the AWS account owner.

Restricting access to the Engineering web server solely to the Engineering VLAN directly implements the principle of least privilege at the network layer. This action significantly reduces the attack surface by ensuring the server is only reachable by authorized clients within its designated operational segment. By preventing unnecessary network connectivity from other VLANs, it drastically limits the opportunities for unauthorized reconnaissance and exploitation attempts, regardless of the server's internal security controls.

The USB Rubber Ducky is a specialized keystroke injection tool that emulates a standard human interface device (HID), specifically a keyboard, when plugged into a target system. This allows it to automatically and rapidly inject pre-programmed keystrokes and commands, bypassing many traditional security controls like antivirus software and firewalls. Its ability to deliver complex payloads at 'typing speed' makes it highly effective for automated USB-based attacks.

A worm is a standalone malware computer program that replicates itself to spread to other computers. Unlike a virus, it does not need to attach to an existing program or host file to propagate. Worms often exploit network vulnerabilities to spread autonomously across networks, consuming bandwidth and system resources, and can carry payloads like backdoors or ransomware. This self-contained, network-aware replication is its defining characteristic.

Pitchfork is a correct attack type, particularly useful when multiple payload positions need to be tested with corresponding values from different payload sets. This mode uses multiple payload sets, but unlike Cluster Bomb, it pairs payloads from each set in a one-to-one fashion. For instance, the first payload from set 1 is used with the first payload from set 2, and so on, making it ideal for scenarios like testing correlated username/password lists or sequential data.

When hping3 sends a TCP SYN packet to a target port, the receipt of a SYN-ACK packet in response is the definitive indication that the port is open and an application is actively listening. This response signifies the second step of the TCP three-way handshake, where the target acknowledges the SYN and sends its own synchronization request. Therefore, a SYN-ACK from 10.0.0.1 on port 80 confirms that the port is open and ready to establish a connection.

A Smurf attack is a classic distributed denial-of-service (DDoS) technique that leverages an intermediary network to amplify traffic against a victim. The attacker sends an ICMP echo request packet to a network's IP broadcast address, but with the source IP address spoofed to that of the intended victim. All hosts on the intermediary network that receive the broadcast then reply to the spoofed source IP, flooding the victim with numerous ICMP echo replies. This amplification effect can quickly overwhelm the victim's network resources.

Local File Inclusion (LFI) vulnerabilities allow an attacker to read arbitrary files from the server's file system. By manipulating the vulnerable parameter with paths like /etc/passwd or /etc/shadow, an attacker can directly access and disclose critical system configuration files, user credentials, or application source code. This exposure of sensitive data is a primary and direct impact of LFI, providing valuable information for further exploitation.

The SameSite=Strict attribute is a powerful defense against CSRF attacks by instructing the browser to only send the cookie with requests originating from the same site as the cookie's domain. This means if a user is logged into `example.com` and then visits `malicious.com`, any requests `malicious.com` attempts to make back to `example.com` will not include the session cookie. Consequently, the malicious request will not be authenticated, effectively preventing the forgery.

Regardless of the cloud service model (IaaS, PaaS, SaaS), the customer always retains primary responsibility for the security of their data itself. This encompasses implementing appropriate encryption for data at rest and in transit, configuring robust access controls and identity management, and ensuring data integrity and compliance. The cloud provider secures the underlying infrastructure that stores the data, but the data's content security is the customer's domain.

CSRF tokens are the most effective defense against Cross-Site Request Forgery (CSRF) attacks. These unique, unpredictable, and secret values are generated server-side for each user session and embedded within critical state-changing requests, such as form submissions. The server then validates the presence and correctness of this token upon receiving the request, ensuring that the request originated from the legitimate application and not from an attacker's malicious site.

Whaling is a specialized form of spear phishing that specifically targets high-profile individuals, such as senior executives, CEOs, or government officials, or impersonates them to deceive employees. In this scenario, an email appearing to be from the CEO directly aligns with the definition of whaling, as it leverages the authority of a top executive to induce a specific action. The objective is often to trick recipients into making large financial transfers or divulging sensitive corporate data, exploiting the perceived urgency and command from a C-level executive.

The differing server responses to the VRFY command—typically a '250 OK' for valid users and a '550 No such user' or similar for invalid ones—unambiguously confirm the server is revealing valid usernames. This behavior allows an attacker to systematically enumerate existing user accounts on the system. Such information is a critical vulnerability, enabling subsequent attacks like brute-force password attempts or targeted phishing campaigns.

Session hijacking via Cross-Site Scripting (XSS) occurs when an attacker injects malicious client-side scripts into a web page viewed by other users. If the session cookie lacks the HttpOnly flag, the injected script can access document.cookie to read and exfiltrate the victim's session identifier. With the stolen session cookie, the attacker can then impersonate the victim, gaining unauthorized access to their authenticated session without needing their credentials. This directly targets the client-side session token.

The command `hping3 -S --flood -p 80 <target_ip>` is specifically engineered to launch a SYN flood denial-of-service attack. By rapidly sending a massive volume of TCP SYN packets to port 80, the target's web server is forced to allocate resources for numerous half-open connections. This quickly exhausts the server's connection queue, preventing legitimate users from establishing new connections and effectively denying service.

Rate limiting is a crucial DDoS mitigation technique that restricts the number of requests a server or application will accept from a specific source within a defined time window. By setting thresholds for connections, requests per second, or bandwidth usage, it prevents a single attacker or a small group of bots from overwhelming server resources. This method helps to differentiate between legitimate traffic spikes and malicious floods, allowing the system to maintain availability for valid users while shedding excessive, potentially harmful traffic.

Ophcrack is a dedicated password cracker specifically designed to recover Windows LM and NTLM hashes by employing precomputed rainbow tables. This tool efficiently performs lookups within its extensive tables to reverse hashes back into their original plaintext passwords, making it exceptionally fast for common password sets. Its specialized focus on these hash types, combined with its user-friendly graphical interface, positions it as the optimal choice for this particular hash cracking method in a penetration testing scenario.

Adware is specifically designed to display unwanted advertisements, often in the form of pop-ups, banners, or injected ads within web pages. This constant display and the underlying processes required to generate these ads consume significant CPU and RAM, leading directly to noticeable system sluggishness. It frequently alters browser settings, making it a direct cause for both the reported performance degradation and persistent pop-ups.

enum4linux is a comprehensive tool specifically designed for enumerating information from Windows and Samba hosts. It automates the process of extracting user lists, group memberships, shared resources, password policies, and other critical details by querying NetBIOS and SMB services. This makes it highly effective for gathering intelligence on a Windows target, going beyond simple port identification to deep service enumeration.

Tailgating is following an authorized person through a secure entry.

Slowloris is a low-bandwidth attack that does not generate a high volume of data packets. Instead, it exploits the server's connection handling by opening numerous legitimate-looking HTTP connections and then keeping them alive for extended durations. This is achieved by sending partial HTTP requests and periodically sending additional, non-terminating HTTP headers, preventing the server from timing out the connection and freeing up resources. The prolonged open state of these connections, despite minimal data transfer, exhausts the server's available connection pool.

The Simple Mail Transfer Protocol (SMTP) is the correct answer because it includes specific commands like `VRFY` (verify) and `EXPN` (expand) that can be leveraged for user enumeration. The `VRFY` command attempts to validate a specific email address or username on the target mail server, often returning a 250 OK response if the account exists. Similarly, `EXPN` can reveal members of a mailing list or alias, indirectly confirming valid user accounts. When not disabled or restricted, these commands provide a direct method for attackers to identify valid user accounts on a system.

Ophcrack is a free, open-source password cracker specifically designed for Windows passwords, making it the correct answer. It leverages precomputed rainbow tables, often distributed as a live CD or USB, which are highly optimized for cracking LM (LAN Manager) and NTLM hashes. Its primary function and user-friendly interface are tailored to exploit the known weaknesses of these Windows authentication protocols, providing an efficient and straightforward solution for recovering Windows user passwords.

For HTTP Response Splitting to occur, user-supplied input containing CRLF sequences must be directly incorporated into an HTTP response header. This allows an attacker to terminate the current header line and inject new, arbitrary header fields or even an entirely new response body. Without this direct reflection in the headers, the injected CRLF sequences would not be interpreted as control characters for the HTTP protocol, making the attack impossible.

SMiShing, a portmanteau of 'SMS' and 'phishing,' is a specific type of social engineering attack that utilizes text messages to deceive recipients. Attackers send fraudulent SMS messages, often containing malicious links that lead to credential harvesting sites or malware downloads, or instructing victims to call a fraudulent number. This method exploits the trust users place in their mobile devices and the immediacy of text messages to prompt quick, unthinking responses, making it the direct answer for an SMS-based attack.

A brute force attack is an exhaustive password cracking method that systematically attempts every possible character combination (letters, numbers, symbols) of a specified length until the correct password or key is discovered. While computationally intensive, especially for long and complex passwords, it guarantees success given sufficient time and processing resources. This makes it a fundamental and powerful technique in a cracker's arsenal.

SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow an executable to run with the privileges of the file's owner or group, respectively, rather than the user executing it. If a program with SUID permissions is owned by root and can be manipulated (e.g., by executing arbitrary commands or writing to sensitive files), it can be abused for privilege escalation. This is a common and effective technique on Linux systems.

MAC flooding is an attack designed to overwhelm a network switch's MAC address table (CAM table) by sending a large number of frames with unique, spoofed source MAC addresses. When the CAM table becomes full, the switch often enters a "fail-open" mode, behaving like a hub by broadcasting all incoming traffic to all ports. The `macof` utility, part of the `dsniff` suite, automates this process by rapidly generating and sending thousands of frames with random source MAC and IP addresses, effectively causing the switch to flood traffic.

Pacu is specifically engineered as an open-source exploitation framework for AWS, providing a comprehensive suite of modules tailored for active penetration testing. It excels in the exploitation phase by leveraging identified misconfigurations or weak credentials to gain unauthorized access or elevate privileges within an AWS account. Furthermore, Pacu facilitates post-exploitation activities such as establishing persistence, enumerating sensitive data, performing lateral movement across AWS services, and backdooring resources, making it a powerful tool for simulating real-world attacks.

Banner grabbing involves connecting to a network service (e.g., HTTP, FTP, SSH) and observing the initial data or "banner" it sends back. This banner frequently contains crucial information such as the service name, its specific version number, and sometimes even the underlying operating system or patch level. Identifying these versions is critical for penetration testers to pinpoint known vulnerabilities associated with particular software releases, enabling targeted exploit attempts.