7af-db378f43d56e","label":null,"text":"John the Ripper","isCorrect":false},{"id":"c3054565-7eff-4f77-b8a4-491ba4ac43be","label":null,"text":"RainbowCrack","isCorrect":true}],"domainName":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking"},{"id":"a183d697-bdc5-4971-98a0-cf5042a48a23","slug":"refer-to-the-exhibit-a-security-analyst-captured-the-http-r-hqacz","questionText":"Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?","explanation":"The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.","domainId":"69a1e04b-10ae-4ef6-8328-781216e49629","difficulty":"medium","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"Refer to the exhibit.\nGET /search?q= HTTP/1.1\nHost: www.example.com\nUser-Agent: Mozilla/5.0\n\nHTTP/1.1 200 OK\nContent-Type: text/html\n\nYou searched for: ","options":[{"id":"2bfb5cff-537b-40dd-857e-d371109308d4","label":null,"text":"Cross-Site Request Forgery (CSRF)","isCorrect":false},{"id":"47134fda-242a-4368-a176-f69e7c9f6635","label":null,"text":"SQL Injection","isCorrect":false},{"id":"e00274c4-5fb3-4296-8878-c75b828c4f4f","label":null,"text":"Reflected Cross-Site Scripting (XSS)","isCorrect":true},{"id":"36e35a11-b35c-45af-8021-fcf89a66a05c","label":null,"text":"Directory Traversal","isCorrect":false}],"domainName":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks"},{"id":"ee4a5bba-219c-46d3-acca-33583eaa96dd","slug":"during-a-forensic-investigation-you-find-a-file-named-svch-0hb82","questionText":"During a forensic investigation, you find a file named 'svch0st.exe' in the startup folder. The file has a suspicious icon and was downloaded from an untrusted source. Analysis shows it opens a backdoor on port 4444 and sends system information to a remote server. Which THREE best describe this malware and its characteristics?","explanation":"Option A is correct because a program that covertly opens a backdoor on port 4444 and accepts remote commands is functioning as a remote access Trojan (RAT), giving an attacker interactive control of the host. Option B is correct because the file masquerades as a legitimate executable (svch0st.exe mimicking svchost.exe), was downloaded from an untrusted source, and hides malicious functionality, which is the defining behavior of a Trojan horse. Option E is correct because the malware sends system information to a remote server, which is data exfiltration over the network to an attacker-controlled endpoint. Option C is not correct because nothing in the scenario indicates self-mutating code or signature changes on each execution, which would be required for a polymorphic virus. Option D is not correct because there is no evidence of self-replication or automatic propagation across the network, which is the defining trait of a worm.","domainId":"94578746-6587-4984-bb49-46dd43017140","difficulty":"hard","questionType":"multi_select","pbqConfig":null,"exhibitText":null,"options":[{"id":"b12de7d7-82e2-4e31-8e98-87ecce4b2b98","label":null,"text":"It functions as a remote access Trojan (RAT)","isCorrect":true},{"id":"30a1dbfa-7003-4225-afbf-4554d1c10b58","label":null,"text":"It is classified as a Trojan horse","isCorrect":true},{"id":"c9993e54-2b4e-4abd-ba7b-b45e0d4abdea","label":null,"text":"It is a polymorphic virus that changes its signature each time it runs","isCorrect":false},{"id":"3abab8c5-1a29-4e61-a728-c35cc346063f","label":null,"text":"It is a worm that replicates across the network automa