CCNA Ceh Advanced Topics Questions

SSRF allows the attacker to make requests from the server, potentially accessing internal services like metadata endpoints (e.g., http://169.254.169.254) that are not publicly accessible.

SHA-1 produces a 160-bit hash. MD5 produces 128 bits, SHA-256 produces 256 bits, and SHA-512 produces 512 bits.

AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

The correct tool for cracking a WPA2 PSK from a captured handshake is aircrack-ng, which performs dictionary attacks against the handshake file.

Reaver is used to brute force the WPS PIN, recovering the PIN and ultimately the WPA2 PSK.

Public read access to the bucket and objects is the direct cause. Blocking public access would prevent this.

AES and 3DES are symmetric algorithms; RSA and ECC are asymmetric; MD5 is a hash function.

The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Container escape often involves breaking out of the container's isolation by exploiting misconfigurations or vulnerabilities. These indicators are common.

S3 bucket public read access, overly permissive IAM roles, and container escape are all cloud misconfiguration exploitation vectors. SQL injection is a web app vulnerability, not cloud-specific. DDoS is an attack type, not a misconfiguration.

ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.

AES (Advanced Encryption Standard) is a symmetric encryption algorithm that operates as a block cipher with a fixed block size of 128 bits and supports key sizes of 128, 192, or 256 bits. It was established by NIST in 2001 (FIPS 197) and is widely used in modern cryptographic systems, including wireless security (WPA2/WPA3) and TLS.

AES and 3DES are both symmetric block ciphers. RSA and ECC are asymmetric algorithms, and SHA-256 is a hash function.

WEP (Wired Equivalent Privacy) uses the RC4 stream cipher with a 24-bit initialization vector (IV) that is transmitted in plaintext. Weak IVs, such as those identified by tools like airodump-ng, are predictable or repeatable, allowing an attacker to capture enough packets to recover the WEP key using statistical attacks like the FMS (Fluhrer, Mantin, Shamir) or KoreK attacks. This preparation directly indicates an attempt to crack the WEP key.

The IP 169.254.169.254 is the AWS metadata endpoint. SSRF attacks target internal services by manipulating the url parameter.

Reaver is specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate limiting and the fact that the PIN is split into two halves, making it feasible to guess the 8-digit PIN in under 10,000 attempts. This allows an attacker to recover the WPA/WPA2 pre-shared key without needing to crack the actual encryption.

A bucket policy allowing anonymous GetObject makes all objects publicly readable, leading to data exposure.

ScoutSuite identifies overly permissive bucket policies; allowing access from any IP (0.0.0.0/0) is a common misconfiguration.

When an S3 bucket allows GetObject access to any principal (public), anyone can list and download objects, leading to data exposure. This is a classic unauthorized data access scenario, not privileged escalation or DoS.

A permissive IAM policy directly leads to excessive privileges and potential privilege escalation, as well as data exposure via unauthorized access.

AES (Advanced Encryption Standard) is a symmetric encryption algorithm that uses the same key for both encryption and decryption. It is widely adopted for securing sensitive data and is a block cipher with key sizes of 128, 192, or 256 bits.

Using WPA3 (SAE) mitigates de-auth because management frame protection is mandatory. 802.11w (MFP) also protects de-auth frames. Changing default SSID and disabling SSID broadcast do not prevent de-auth.

Hardcoded keys in firmware are a classic example of a backdoor or hardcoded credential vulnerability, allowing attackers to decrypt traffic or authenticate without proper authorization.

ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations. It generates a comprehensive HTML report. Pacu is an exploitation framework, not an audit tool.

The condition allows all IP addresses (0.0.0.0/0) to launch EC2 instances, meaning any user who can assume this role can create instances from anywhere, potentially for cryptocurrency mining or other malicious purposes.

Option C is correct because many IoT devices ship with default usernames and passwords (e.g., 'admin/admin') or hard-coded credentials embedded in firmware. Attackers can easily discover these through simple web searches or Shodan scans, then gain unauthorized access to the device and potentially the entire network.

Pacu is an exploitation framework for AWS, used after initial access to escalate privileges, pivot, and maintain access. It is not typically used for initial reconnaissance (Nmap, ScoutSuite) or reporting.

Deauthentication attacks force clients to reconnect, allowing capture of the WPA/WPA2 4-way handshake during reconnection, which is needed for offline cracking.

SSRF can allow access to internal services (like metadata endpoints) and potentially lead to remote code execution if internal services are compromised.

WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

A downgrade attack occurs when an attacker forces the client and server to negotiate a lower, less secure version of a protocol (e.g., from TLS 1.2 to TLS 1.0) to exploit vulnerabilities in the older version.

A de-authentication attack targets the management frames in IEEE 802.11 wireless networks. An attacker sends forged de-authentication frames to disconnect a client from an access point, often as a precursor to capturing the WPA handshake or launching an evil twin attack. This is a wireless-specific attack because it exploits the unencrypted nature of 802.11 management frames.

SSRF occurs when an application fetches user-controlled URLs without proper validation. The attacker used it to access cloud metadata endpoints (like AWS IMDS) to retrieve temporary credentials.

The combination of hardcoded credentials and unexpected MQTT traffic suggests an attacker has used default credentials to compromise the device and is exfiltrating data via MQTT.

MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

The policy allows anyone (Principal: *) to read any object in the bucket, making it publicly accessible and a common misconfiguration.

The correct answer is that the bucket policy or ACL is set to 'Everyone' with write permissions, a common misconfiguration leading to data exposure.

With full admin privileges, the tester can attempt to enumerate and abuse the permissions, such as creating users, accessing data, or escalating privileges further.

Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.

A downgrade attack is correct because it forces a system to use a weaker, less secure cryptographic protocol or algorithm (e.g., forcing TLS 1.2 down to SSL 3.0 or using export-grade ciphers). This exploits the cryptographic weakness of the older protocol, making it easier for an attacker to decrypt or manipulate the communication. The attack directly targets the cryptographic strength of the negotiated security parameters.

ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations.

Aircrack-ng is the standard tool for cracking WPA/WPA2 handshakes using dictionary attacks.

SSRF occurs when an attacker tricks the server into making requests to internal resources, such as a cloud metadata service, to obtain credentials.

ScoutSuite is an auditing tool and Pacu is an exploitation framework for cloud environments.

Reaver is a tool specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate-limiting and the fact that the PIN is split into two halves (first half 4 digits, second half 3 digits with a checksum), allowing an attacker to recover the WPS PIN and subsequently the WPA2 pre-shared key in a matter of hours.

MQTT itself does not provide encryption; using TLS (MQTT over TLS) encrypts the entire communication channel, protecting data in transit.

Under the AWS shared responsibility model, the customer is responsible for configuring S3 bucket policies and access controls. The misconfiguration is a customer-side issue, not an infrastructure vulnerability.

A certificate from an untrusted root CA suggests a rogue or misissued certificate, possibly from a malicious CA or a man-in-the-middle attack using a proxy with its own CA certificate not trusted by the client.

Container escape compromises the host, affecting the underlying infrastructure in IaaS. In PaaS/SaaS, the provider may manage containers differently.

Container escape often occurs when the container is run with the --privileged flag, granting elevated capabilities that allow access to the host kernel.

ECC (Elliptic Curve Cryptography) offers strong security with smaller keys compared to RSA. Diffie-Hellman is a key exchange protocol, 3DES is symmetric, and SHA-256 is a hash function.