EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 12 )

Updated On: 31-Jul-2026

You are a penetration tester tasked with testing the wireless network of your client Brakeme SA. You are attempting to break into the wireless network with the SSID “Brakeme-Internal.” You realize that this network uses WPA3 encryption.
Which of the following vulnerabilities is the promising to exploit?

  1. Cross-site request forgery
  2. Dragonblood
  3. Key reinstallation attack
  4. AP misconfiguration

Answer(s): B

Explanation:

B is correct because the Dragonblood vulnerability directly targets the WPA3 encryption protocol used in the wireless network.
WPA3, while a significant improvement over its predecessors, is not immune to vulnerabilities. The Dragonblood attack exploits weaknesses in the WPA3 protocol's handshake mechanisms, allowing an attacker to conduct downgrading attacks or dictionary-style password cracking. This vulnerability can compromise the integrity of the authentication process, making it a promising avenue for penetration testing.
Evaluation of Incorrect Options:

A: Cross-site request forgery: This is primarily a web application vulnerability that affects how browsers authenticate users, making it irrelevant for wireless network penetration testing, especially concerning WPA3.
C: Key reinstallation attack (KRACK): This vulnerability specifically targets the WPA2 protocol, allowing attackers to reinstall an already-in-use key. Since the network in question uses WPA3, this attack is not applicable.
D: AP misconfiguration: While misconfigurations can often lead to vulnerabilities, this option lacks specificity. It does not directly exploit a protocol's inherent weaknesses like Dragonblood, making it less promising in a targeted attack scenario on the WPA3 encryption.
References:
https://www.cisco.com/c/en/us/products/security/wpa3-security.html https://www.dekra.com/en/fileadmin/Document/2020-09-27_WPA3_Dragonblood_Vulnerability.pdf https://www.bbc.com/news/technology-47770774


Reference:

References:
https://www.cisco.com/c/en/us/products/security/wpa3-security.html https://www.dekra.com/en/fileadmin/Document/2020-09-27_WPA3_Dragonblood_Vulnerability.pdf https://www.bbc.com/news/technology-47770774



What is the common name for a vulnerability disclosure program opened by companies in platforms such as HackerOne?

  1. White-hat hacking program
  2. Bug bounty program
  3. Ethical hacking program
  4. Vulnerability hunting program

Answer(s): B

Explanation:

B is correct because a "Bug bounty program" specifically incentivizes ethical hackers to identify and report vulnerabilities in a company's systems.
In the context of cybersecurity, "bug bounty programs" facilitate a structured process for vulnerability disclosure, allowing companies to leverage external expertise in identifying weaknesses. This approach enhances a company's security posture while providing ethical hackers with monetary rewards for their findings, thereby establishing a mutually beneficial relationship.
Evaluation of Other Options:

A: White-hat hacking program : While this term may refer to activities conducted by ethical hackers, it lacks the formalized and incentivized structure characteristic of a bug bounty program. It does not inherently involve an organized mechanism for reporting vulnerabilities or compensation.
C: Ethical hacking program : Similar to the white-hat hacking program, this term focuses more on the methodology rather than the initiative to disclose vulnerabilities. Ethical hacking encompasses various practices, without the formal incentive structure that qualifies a program as a bug bounty.
D: Vulnerability hunting program : This term may imply a system for searching for vulnerabilities, but does not intrinsically convey the organized structure or incentive-based framework found within bug bounty programs. It lacks the clarity and recognition that a bug bounty program entails, which is specifically designed for public engagement and reward.
In summary, the term "Bug bounty program" is distinctively recognized and established for its focus on rewarding individuals for disclosing security vulnerabilities, setting it apart from the other options presented.
References:
https://www.hackerone.com/blog/What-is-a-Bug-Bounty-Program https://www.synack.com/what-is-a-bug-bounty-program https://www.csoonline.com/article/3283402/what-is-a-bug-bounty-program-and-how-does-it-work.html


Reference:

References:
https://www.hackerone.com/blog/What-is-a-Bug-Bounty-Program https://www.synack.com/what-is-a-bug-bounty-program https://www.csoonline.com/article/3283402/what-is-a-bug-bounty-program-and-how-does-it-work.html



A DDoS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete.
Which attack is being described here?

  1. Desynchronization
  2. Slowloris attack
  3. Session splicing
  4. Phlashing

Answer(s): B

Explanation:

The correct answer is B. Slowloris attack.
The Slowloris attack is characterized by its method of sending partial HTTP requests to a target server, thus exploiting how many web servers handle incoming requests. This attack maintains multiple connections open by never completing the requests, effectively tying up server resources. The behavior described in the question aligns with the Slowloris technique because it keeps connections alive with incomplete requests, ultimately overwhelming the server's capacity to handle legitimate traffic.
Evaluation of Other Options:

A: Desynchronization: This technique typically involves manipulating the TCP handshake to disrupt the synchronization between the client and server. It does not entail sending partial requests or keeping connections open, making it inappropriate in this context.
C: Session splicing: This method focuses on breaking a session into multiple segments to bypass security filters. Unlike Slowloris, it is not specifically designed to keep server connections open while preventing request completion.
D: Phlashing: This is a specific form of attack aimed at damaging or corrupting firmware on devices, especially routers. Phlashing does not involve layer 7 HTTP requests or maintaining open connections, thus being unsuitable for the scenario described.
In summary, the Slowloris attack uniquely fits the criteria of manipulating server resources through partial requests, which is not the case with the other listed options.
https://www.imperva.com/learn/application-security/ddos/slowloris-attack/ https://www.acs.com.hk/en/products/1200/slowloris-attack/ https://www.cloudflare.com/learning/ddos/slowloris-attack/



Andrew is an Ethical Hacker who was assigned the task of discovering all the active devices hidden by a restrictive firewall in the IPv4 range in a given target network.
Which of the following host discovery techniques must he use to perform the given task?

  1. UDP scan
  2. ARP ping scan
  3. ACK flag probe scan
  4. TCP Maimon scan

Answer(s): B

Explanation:

B is correct because an ARP ping scan efficiently discovers active devices on a local network by leveraging the characteristics of the Address Resolution Protocol.
When a firewall restricts traffic, traditional port scanning techniques, such as SYN or UDP scans, might fail to elicit replies from devices due to filtering mechanisms. An ARP ping scan is advantageous because it operates at the link layer, allowing it to bypass IP layer restrictions imposed by firewalls. By sending ARP requests to each IP address in the range, any device that is active responds with an ARP reply, confirming its presence on the network.
Evaluation of Incorrect Options:

A: UDP Scan: This technique can be ineffective against firewalls, as many firewalls drop unsolicited UDP packets without responding. Thus, it may not reveal devices concealed behind restrictive rules.
C: ACK Flag Probe Scan: While this method can identify open ports on unfiltered devices, its capability to discover active devices is limited. Many firewalls ignore ACK packets, which may lead to inaccurate results.
D: TCP Maimon Scan: This scan method is beneficial for identifying closed or filtered ports by exploiting TCP flag combinations. However, like the UDP scan, it may not work effectively against restrictive firewalls designed to ignore or block specific packet types, resulting in missed devices.
In conclusion, the ARP ping scan not only excels in locating active hosts within constrained environments but also evades common firewall filtering techniques.


Reference:

https://www.cisco.com/c/en/us/support/docs/ip/arp/9611-arp-packet-capture.html " target="_blank"> https://www.cisco.com/c/en/us/support/docs/ip/arp/9611-arp-packet-capture.html https://www.sans.org/white-papers/100864/ " target="_blank"> https://www.sans.org/white-papers/100864/ https://www.stateless.net/docs/arp-scanning/
" target="_blank"> https://www.stateless.net/docs/arp-scanning/



Abel, a cloud architect, uses container technology to deploy applications/software including all its dependencies, such as libraries and configuration files, binaries, and other resources that run independently from other processes in the cloud environment. For the containerization of applications, he follows the five-tier container technology architecture. Currently, Abel is verifying and validating image contents, signing images, and sending them to the registries.
Which of the following tiers of the container technology architecture is Abel currently working in?

  1. Tier-1: Developer machines
  2. Tier-2: Testing and accreditation systems
  3. Tier-3: Registries
  4. Tier-4: Orchestrators

Answer(s): B

Explanation:

B is correct because Abel is engaged in the processes of verifying, validating, and signing images, which fall under the responsibilities of testing and accreditation systems.
In the context of container technology architecture, Tier-2 encompasses the procedures that ensure the integrity and security of container images prior to deployment. This tier involves rigorous testing against security vulnerabilities, compliance checks, and the validation of image contents against operational standards. By actively engaging in the processes of validating and signing images, Abel is directly contributing to the quality assurance phase that characterizes Tier-2 operations, thereby enhancing the reliability of deployed applications.
Evaluation of Incorrect Options:

A: Tier-1: Developer machines This tier is primarily focused on the development lifecycle, including coding and initial image creation. Activities in this tier involve developers creating and modifying their applications within a contained environment, which does not address image validation and security measures.
C: Tier-3: Registries While registries are essential for storing and distributing container images, activities in this tier typically involve the management of image storage, version control, and accessibility rather than the verification or signing of image contents. Therefore, it does not align with Abel's current tasks.
D: Tier-4: Orchestrators This tier deals with the automated deployment, management, and scaling of containerized applications through orchestration tools. Functions such as resource allocation and load balancing are key here, making it irrelevant to processes of image validation and signing that Abel is focused on.
For a comprehensive understanding of container architecture and its tiers, refer to the following resources:
https://www.docker.com/resources/what-container https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/ https://www.redhat.com/en/topics/containers/what-is-containerization



Henry is a cyber security specialist hired by BlackEye – Cyber Security Solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unicornscan tool to discover the OS of the target system. As a result, he obtained a TTL value, which indicates that the target system is running a Windows OS. Identify the TTL value Henry obtained, which indicates that the target OS is Windows.

  1. 128
  2. 255
  3. 64
  4. 138

Answer(s): A

Explanation:

The TTL value of 128 is indicative of a Windows operating system.
The Time-to-Live (TTL) value serves as a crucial indicator in the process of OS fingerprinting. In networking, TTL values are decremented by each hop a packet takes; different operating systems set their initial TTL values differently upon packet creation. Windows operating systems, including various versions ranging from Windows NT to Windows 10, typically default to a TTL value of 128. This characteristic aligns with common practices in network design and packet transmission management in Microsoft environments.
In contrast, evaluating the other TTL values:
TTL 255 : Typically associated with Cisco routers and not designated for OS identification. High TTL values suggest a device that has not traversed many hops, but they are not indicative of a specific operating system.
TTL 64 : Commonly associated with Unix/Linux operating systems. This default is set for many distros and would incorrectly suggest that the target host is based on a Unix-like OS, which conflicts with the observed result of a Windows OS.
TTL 138 : This value is not standard for any well-known operating system and could result from misconfigurations or non-typical settings. Therefore, it lacks utility in accurate OS fingerprinting when aligned against standard industry benchmarks.
In summary, a TTL of 128 definitively indicates a Windows OS based on established norms in OS fingerprinting, whereas the other values either indicate different systems or lack relevance.
References:
https://www.cisecurity.org/white-papers/the-impact-of-tcp-ip-on-system-security/ https://www.rapid7.com/blog/post/2016/05/04/os-fingerprinting-in-nmap/ https://www.cio.com/article/239730/networking-what-you-need-to-know-about-ttl.html


Reference:

References:
https://www.cisecurity.org/white-papers/the-impact-of-tcp-ip-on-system-security/ https://www.rapid7.com/blog/post/2016/05/04/os-fingerprinting-in-nmap/ https://www.cio.com/article/239730/networking-what-you-need-to-know-about-ttl.html



Daniel is a professional hacker who is attempting to perform an SQL injection attack on a target website, www.moviescope.com. During this process, he encountered an IDS that detects SQL injection attempts based on predefined signatures. To evade any comparison statement, he attempted placing characters such as “’or ‘1’=‘1’” in any basic injection statement such as “or 1=1.” Identify the evasion technique used by Daniel in the above scenario.

  1. Char encoding
  2. IP fragmentation
  3. Variation
  4. Null byte

Answer(s): C

Explanation:

C is correct because Daniel is utilizing variation to alter the SQL attack pattern while avoiding detection by the IDS signatures.
The evasion technique of "variation" involves modifying the structure or representation of the SQL injection payload to circumvent detection mechanisms. By introducing the characters “’or ‘1’=‘1’”, Daniel adjusts the syntax of the injection to prevent the IDS from recognizing the signature that would trigger an alert. This morphing of the input retains the attack's logic while changing its appearance, thereby enabling Daniel to leverage the injection without being detected. This method reflects a fundamental characteristic of SQL injection attacks, where varying the input enhances an attacker's chances of success against signature-based detection systems.
Critical evaluation of other options:

A: Char encoding: While this technique involves altering the characters in an injection payload—such as using hexadecimal or Unicode representations—it was not employed in Daniel's case. He relied on direct text manipulation instead.
B: IP fragmentation: This technique splits an IP packet into smaller fragments to maneuver around network barriers. However, it is irrelevant in SQL injection contexts, as it does not affect the payload sent to the SQL server.
D: Null byte: In this context, the null byte injection technique typically aims to terminate strings or alter execution paths, especially in file inclusion vulnerabilities. Daniel's approach does not include null bytes but modifies the SQL payload format directly.
For further reading:
SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection Web Application Security: https://www.sans.org/white-papers/39535/ Intrusion Detection Systems: https://www.cisecurity.org/white-papers/understanding-intrusion-detection-systems/



SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application.
Which of the following SQLi types leverages a database server’s ability to make DNS requests to pass data to an attacker?

  1. In-band SQLi
  2. Union-based SQLi
  3. Out-of-band SQLi
  4. Time-based blind SQLi

Answer(s): C

Explanation:

C is correct because Out-of-band SQLi utilizes the database server's capability to make external connections, such as DNS requests, to communicate data to an attacker.
Out-of-band SQL injection (SQLi) exploits a database's ability to make DNS or HTTP requests, effectively allowing an attacker to extract data without directly retrieving results through the application's interface. This technique is particularly potent when the application is configured to limit the visibility of error messages or when other means of data retrieval are blocked.
Evaluation of Incorrect Options:

A: In-band SQLi : This type of injection involves using the same communication channel to both launch the attack and retrieve the data. It lacks the capability to leverage external communications for data exfiltration, making it less stealthy and more detectable compared to Out-of-band SQLi.
B: Union-based SQLi : While union-based SQL injection allows attackers to retrieve results from multiple tables by combining them in a single query, it doesn't exploit the database's DNS or HTTP capabilities to transfer data outside the application, rendering it ineffective for the specific scenario described.
D: Time-based blind SQLi : This method relies on the response time of the database to infer information, effectively using delays to infer whether a condition is true or false without directly retrieving data.
While this can be an effective technique, it does not involve making external requests, hence cannot facilitate data exfiltration through DNS requests.
References:
https://owasp.org/www-community/attacks/SQL_Injection https://www.acunetix.com/blog/articles/sql-injection-explained/ https://www.imperva.com/learn/application-security/sql-injection-sqli/


Reference:

References:
https://owasp.org/www-community/attacks/SQL_Injection https://www.acunetix.com/blog/articles/sql-injection-explained/ https://www.imperva.com/learn/application-security/sql-injection-sqli/



Viewing page 12 of 133
Viewing questions 56 - 60 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!