Exhibit: Jason's Web server was attacked by a trojan virus. He runs protocol analyzer and notices that the trojan communicates to a remote server on the Internet. Shown below is the standard "hexdump" representation of the network packet, before being decoded. Jason wants to identify the trojan by looking at the destination port number and mapping to a trojan-port number database on the Internet. Identify the remote server's port number by decoding the packet?
Answer(s): D
From trace, 0x1A0B is 6667, IRC Relay Chat, which is one port used. Other ports are in the 900's.
Which of the following Netcat commands would be used to perform a UDP scan of the lower 1024 ports?
The proper syntax for a UDP scan using Netcat is "Netcat -u -v -w2 <host> 1-1024". Netcat is considered the Swiss-army knife of hacking tools because it is so versatile.
Sniffing is considered an active attack.
Answer(s): B
Sniffing is considered a passive attack.
A file integrity program such as Tripwire protects against Trojan horse attacks by:
Tripwire generates a database of the most common files and directories on your system. Once it is generated, you can then check the current state of your system against the original database and get a report of all the files that have been modified, deleted or added. This comes in handy if you allow other people access to your machine and even if you don't, if someone else does get access, you'll know if they tried to modify files such as /bin/login etc.
Erik notices a big increase in UDP packets sent to port 1026 and 1027 occasionally. He enters the following at the command prompt.$ nc -l -p 1026 -u -vIn response, he sees the following message.cell(?(c)????STOPALERT77STOP! WINDOWS REQUIRES IMMEDIATE ATTENTION.Windows has found 47 Critical Errors. To fix the errors please do the following:1. Download Registry Repair from: www.reg-patch.com2. Install Registry Repair3. Run Registry Repair4. Reboot your computerFAILURE TO ACT NOW MAY LEAD TO DATA LOSS AND CORRUPTION!What would you infer from this alert?
The "net send" Messenger service can be used by unauthorized users of your computer, without gaining any kind of privileged access, to cause a pop-up window to appear on your computer. Lately, this feature has been used by unsolicited commercial advertisers to inform many campus users about a "university diploma service"...
Post your Comments and Discuss EC-Council 312-50 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50 content, but please register or login to continue.