CCNA Network And Perimeter Exploitation Questions

Responder poisons LLMNR, NBT-NS and mDNS queries, answering the broadcast so the victim authenticates to the attacker and surrenders its NTLMv2 hash. This directly satisfies the stem's requirement to spoof the response and capture credentials.

Hping3 crafts custom IPv4 packets and supports the LSRR and SSRR source routing options, letting the attacker test whether routers honour them. This directly satisfies the stem's need to determine if traffic can be redirected via IPv4 source routing.

The -L flag creates local port forwarding, binding port 8080 on the attacking machine and tunnelling traffic through the jump box to 10.0.0.5 port 80. This satisfies the constraint that the internal server is reachable only from the jump box.

The ip route get command queries the kernel routing table for the path to a specific destination. It returns the outgoing interface and the source IP that would be used, and often the gateway. This directly answers which interface and next hop are used for 10.10.10.1, making it the most precise tool for the scenario.

Wireshark passively captures frames on the segment and decodes protocols such as HTTP Basic, FTP and Telnet, extracting plaintext credentials from the intercepted traffic. Its protocol dissectors parse authentication fields automatically, satisfying the requirement to capture and parse credentials obtained via the ARP-spoofed man-in-the-middle position.

Dnscat2 encapsulates arbitrary TCP traffic within DNS query and response records, so it traverses the egress filter that permits only port 53. It provides an encrypted command-and-control channel over the DNS protocol, satisfying the constraint of tunnelling TCP through DNS.

This payload is appropriate for a Linux target, which is typical for a web server running a CGI script. It establishes a reverse TCP connection back to the attacker and provides a Meterpreter session, allowing full control. The architecture (x86) is common, but you should verify the target architecture before use.

SMB and NetBIOS enumeration exposes share names, user accounts, group memberships and host details via null sessions, requiring no authentication when legacy settings permit. This directly satisfies the scenario's need for protocols leaking sensitive domain or system information unauthenticated during Windows domain enumeration.

Iodine encapsulates IPv4 traffic inside DNS queries and responses, tunnelling arbitrary TCP sessions through the permitted UDP port 53 path to an authoritative external server. This exploits the firewall's DNS exception, satisfying the constraint that only outbound DNS is allowed.

smtp-user-enum connects to the mail server and issues SMTP VRFY, EXPN and RCPT TO commands, parsing responses to identify valid accounts. This matches the requirement to test susceptibility to email harvesting via those standard SMTP commands.

Bettercap supports selective ARP spoofing with configurable intervals, letting the attacker poison only targeted hosts and refresh mappings at low frequency rather than flooding repetitive replies. This satisfies the stem's constraint of evading alerts triggered by high-volume ARP traffic, while maintaining the man-in-the-middle position on the switched network.

The `-L` flag binds port 3306 locally, then tunnels traffic through the SSH connection to the pivot host, which forwards it onward to 10.0.0.50:3306. This satisfies the stem's requirement to reach an internal database behind a firewall, since only the pivot host needs routable access to the database server.

Netdiscover sends ARP requests directly, so it maps live hosts on the local Ethernet segment without TCP or UDP port traffic. ARP operates at layer 2, meaning no routable scan packets reach the subnet, satisfying the requirement to avoid noisy port scanning while quickly enumerating active Windows systems.

The -sI flag specifies a zombie host for an idle scan, spoofing the source address so packets appear to originate from the zombie rather than the attacker. This satisfies the requirement to avoid noisy connections that host-based IDS would flag, since the attacker never sends packets directly to the target.

Hostapd-mana impersonates a WPA2-Enterprise access point and runs a rogue RADIUS server that relays the PEAP-MSCHAPv2 exchange, capturing the client's MSCHAPv2 challenge-response for offline cracking. This directly satisfies the requirement to harvest enterprise credentials from misassociating clients.

Netcat opens a raw TCP connection to port 21 and prints the server's greeting banner immediately, revealing the FTP software and version without sending USER or PASS credentials. This satisfies the requirement to enumerate without an interactive login session.

The --data-length option appends random junk bytes to Nmap's generated packets, altering payload signatures so the IPS's signature-based detection no longer matches standard probe patterns. This satisfies the requirement to evade detection while still performing the scan.

If the Cisco ASA firmware is outdated and vulnerable, exploiting a known vulnerability could allow you to bypass ACLs, gain shell access, or tunnel traffic. This directly addresses the scenario's hint about older firmware. Unlike evasion techniques, exploiting a vulnerability can provide a direct path to the internal web server by compromising the firewall itself.

The -D decoy option inserts forged source IP addresses into scan packets, so packet inspection filters cannot reliably attribute traffic to the real scanner. This header alteration directly satisfies the stem's requirement for evading inspection filters by modifying packet headers.

SPAN mirrors copies of frames from the target switch port to an analysis port, leaving the original traffic path untouched. This satisfies the stem's passive, non-disruptive constraint, unlike active interception via ARP spoofing or an inline tap that would alter the legacy application's communications.

Packet fragmentation splits TCP headers across multiple IP fragments, so signature-based IDS sensors inspecting individual packets cannot match the full probe pattern. This directly satisfies the scenario's requirement to obscure scan payloads during an Nmap port scan, since reassembly is needed before detection logic can identify the scan.

Dig issues an AXFR query directly against a nameserver and reports whether the zone transfer succeeds, making it the purpose-built tool for identifying servers permitting unauthorised transfers. This satisfies the requirement to test zone transfer vulnerabilities.

Running wafw00f sends crafted requests and analyses response headers, status codes and payload reflections to fingerprint the specific WAF vendor, satisfying the requirement to identify whether a WAF sits in front of the web server. Its signature database distinguishes products such as Cloudflare, Akamai and Imperva from unprotected responses.

enum4linux queries Windows and Samba hosts through MS-RPC interfaces transported over SMB, using calls such as SAMR and LSA to enumerate shares, users, and domain details. This RPC-over-SMB mechanism retrieves granular information without brute-forcing credentials, avoiding account lockout.

ProcDump captures a full process memory snapshot of lsass.exe without terminating it, satisfying the requirement to dump credentials safely while the service keeps running. Invoked as `procdump -ma lsass.exe`, it writes a minidump that Mimikatz or Pypykatz can later parse offline for cached hashes and plaintext passwords.

ICMP Port Unreachable is generated by the target's IP stack when no application is bound to that UDP port. Receiving it confirms the host is reachable but nothing is listening on 123, distinguishing a closed port from a filtered one, where a firewall would silently drop the probe.

Neo-reGeorg tunnels TCP traffic inside HTTP/HTTPS requests, so it traverses the permitted port 443 egress path that SSH forwarding cannot use. It encrypts the tunnel payload and supports full-duplex SOCKS-style proxying, satisfying the stem's constraint of restricted SSH forwarding with only outbound HTTPS allowed.

A rogue DHCP server answers client requests before the legitimate server, handing out attacker-controlled gateway and DNS settings. This satisfies the stem's interception objective, letting the tester position themselves as man-in-the-middle for all subsequent client traffic.

The Xmas scan sets FIN, PSH and URG simultaneously, a flag combination RFC 793 requires closed ports to answer with RST while open ports silently discard. This satisfies the stem's constraint of evading SPI firewalls that drop invalid flag combinations.

Kerberoasting begins by enumerating accounts with registered Service Principal Names, since each SPN-bearing account has a service ticket encrypted with its password hash that can be requested and cracked offline. This targets the SPN linkage that makes the attack possible.

ARP ping discovery operates at layer 2, broadcasting ARP requests to resolve IP addresses to MAC addresses on the local subnet. It never touches TCP or UDP, satisfying the requirement for fast, quiet host discovery without port traffic.

RIP advertises routes in cleartext with no authentication by default and caps valid hop counts at 16, so an attacker can inject spoofed updates to poison the routing table. That matches the insecure implementation described in the audit.

The smb-vuln-ms17-010 NSE script performs a non-destructive check by sending crafted SMBv1 requests and inspecting the response, confirming EternalBlue exposure without triggering the crash that exploitation would cause. This satisfies the requirement to test safely.

-sn performs host discovery only, sending ICMP Echo Requests (plus TCP SYN, ACK and ARP probes by default) and skipping port scanning entirely. This identifies live hosts with fewer connection attempts, reducing alerts from traditional port scanners while completing the sweep.

Nbtscan sends NetBIOS name service queries (UDP 137) across an IP range, returning registered names, workgroup/domain membership and logged-in usernames from legacy Windows hosts. This directly satisfies the stem's requirement for a NetBIOS name query scan, unlike SMB-focused enumeration tools that cannot retrieve NetBIOS name table entries.

Nmap's -O flag enables OS fingerprinting by comparing the target's TCP/IP stack responses, such as initial window size and TTL, against its signature database. This directly satisfies the requirement to identify the operating system from stack behaviour.

The smb-os-discovery script queries SMB to extract the operating system, computer name and domain, directly satisfying the requirement to gather OS details. Its queries are non-intrusive, making it safe for identifying live Windows hosts running SMB services.

Traceroute sends packets with successively larger TTL values; each router that decrements the TTL to zero returns an ICMP time-exceeded message containing its address. Collecting these replies reveals the path and the router interfaces that respond, directly showing whether the perimeter leaks internal topology. It is the standard technique for the requirement described.

The `-f` argument fragments packets into 8-byte blocks after the IP header, directly satisfying the requirement to split outgoing TCP packets into tiny fragments that evade signature-based IDS pattern matching. This is the standard Nmap fragmentation switch; alternatives like `--mtu` allow custom sizes but `-f` is the fixed 8-byte option.

A Null scan sends TCP segments with no flags set, a combination no legitimate stack produces. Stateful firewalls and hardened hosts drop such anomalous packets silently, so closed ports appear open|filtered and results become unreliable, directly violating the stem's constraint that anomalous flag combinations are dropped.

Outbound TCP 443 is almost universally permitted to support web browsing, so C2 traffic blends with legitimate TLS sessions. Encapsulating command channels inside HTTPS defeats egress filtering and inspection, directly satisfying the scenario's need for covert tunnelling through corporate firewalls.

-Pn disables Nmap's host discovery phase entirely, treating every supplied target as online and proceeding straight to port scanning. This satisfies the constraint of discovering live hosts while avoiding ping probes on a hardened target that suppresses ICMP replies.

Ptunnel encapsulates TCP connections inside ICMP echo request and reply payloads, so traffic passes egress filters that permit only ICMP. This satisfies the constraint of tunnelling TCP through ICMP to bypass the restricted network's filtering.

Aggressive mode transmits a hash derived from the pre-shared key in a form that can be captured and attacked offline. Ike-scan with --pskcrack extracts that material into a hash file compatible with cracking tools such as psk-crack or hashcat, allowing dictionary or brute-force recovery without further interaction with the device. This matches the requirement of offline PSK recovery from an exposed aggressive-mode service.

Snmpwalk issues SNMP GETNEXT requests using the default community string, walking the MIB tree to dump OIDs covering user accounts, routing tables and running processes. It directly satisfies the need to enumerate those objects over UDP port 161.

Metasploit's auxiliary/server/socks_proxy module runs inside an existing Meterpreter session, exposing a SOCKS4a listener that routes arbitrary TCP through the compromised host. This satisfies the requirement to pivot deeper without deploying separate tooling on the target.

Gobuster is purpose-built for directory and file brute-forcing, using a wordlist to fire rapid HTTP requests and flag valid responses by status code. Its dedicated dir mode satisfies the requirement to locate hidden administrative directories and backup files quickly, unlike general-purpose scanners or manual requests.

Telnet transmits all data, including login credentials, as unencrypted plaintext over TCP port 23, so any sniffer on the path captures usernames and passwords directly. This satisfies the stem's cleartext-credential constraint, unlike SSH or TLS-wrapped alternatives that encrypt the session.

TheHarvester queries search engines and public databases to enumerate emails, subdomains and hosts for a target domain, satisfying the requirement for passive open-source intelligence gathering. Unlike active scanning tools, it never touches the target's infrastructure directly, keeping the reconnaissance covert during the external engagement.

The -sX flag sets FIN, PSH and URG simultaneously, producing the Xmas tree scan. Because these flags are meaningless on a normal open port, compliant stacks drop the packet, letting Nmap infer state while evading payload-flag inspection.

CrackMapExec and its successor NetExec include a module that reports SMB signing status per host across a CIDR range. Running it with domain credentials enumerates many hosts quickly and outputs a clear required/not-required indicator, which directly identifies relay-feasible targets. This is a standard, efficient way to build the signing-disabled list during an internal engagement.

IPv6 RA Guard on the switch inspects and drops rogue Router Advertisement messages arriving on host-facing ports, blocking the spoofed advertisements NDP spoofing relies on. This satisfies the requirement to prevent malicious rogue advertisements on the local enterprise network segment.

The -sn option performs a ping scan, which sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request to determine if hosts are up. It does not scan ports, making it faster and less likely to trigger IDS than a full port scan. This is the recommended way to discover live hosts on a network without scanning ports.

The -L flag makes smbclient list the shares exported by the target host over SMB, returning share names and comments without mounting them. This directly satisfies the requirement to enumerate available shares on the remote Windows file server during the internal audit.

TCP ACK pings (-PA80) bypass the ICMP-blocking perimeter firewall because they are sent as bare TCP ACK segments, which many stateless firewalls pass and which elicit RST replies from live hosts. This satisfies the stem's constraint of discovering hosts when ICMP echo requests are filtered.

The -D flag on the SSH client starts a dynamic SOCKS proxy that forwards arbitrary TCP connections through the SSH server. Because the compromised host is dual-homed, connections to internal web servers on TCP/8080 originate from its internal interface, reaching hosts that are not routable from the attack machine. Pointing tools at the local SOCKS5 listener routes all their traffic through the pivot correctly.

The -sS flag performs a half-open TCP SYN scan, sending SYN packets and never completing the three-way handshake. This satisfies the stealth requirement because no full connection is established, so stateless packet filters see only unsolicited SYNs rather than completed sessions, reducing logging and detection compared with a full connect scan.

Autoroute reads the compromised host's routing table and injects routes into Metasploit's session, so TCP SYN scans traverse eth1 into 192.168.100.0/24. It satisfies the pivot constraint: reaching an isolated subnet through a dual-homed host without manual proxy configuration.

When a compromised host has multiple interfaces but no direct route to the target subnet, you can leverage it as a pivot by configuring a route through the host and a SOCKS proxy. Metasploit's autoroute adds a route in the Meterpreter session, and proxychains directs tools through the SOCKS proxy. This allows traffic to be forwarded from your attack machine through the compromised host to the target network, assuming the host can reach it via one of its interfaces.