A penetration tester evaluates an industrial control system (ICS) that manages critical infrastructure. The tester discovers that the system uses weak default passwords for remote access. What is the most effective method to exploit this vulnerability?
Answer(s): B
Why option B is the best choiceThe vulnerability is the presence of weak default passwords that are intended for initial provisioning but are not changed. An attacker can directly log in using those credentials, obtain legitimate system access, and then manipulate PLCs, SCADA commands, or configuration files to affect operational processes. This method provides stealthy, persistent control over the ICS while minimizing detection risk compared with noisy or unrelated attack vectors.Why the other options are less suitableA – Brute-force guessing – Default passwords are often predictable; however, brute-force attacks generate excessive traffic and may trigger intrusion-detection alerts, making them slower and more conspicuous than simply using the preset credentials. C – Denial-of-service – A DoS attack merely disrupts service; it does not provide the ability to control or reconfigure the system, which is the core goal of exploiting a credential weakness in an ICS. D – Cross-Site Request Forgery – CSRF attacks rely on a web interface and user-initiated requests; many ICS environments have limited or hardened web exposure, and the flaw described is not web-application-centric but credential-based.
https://www.cisa.gov/ics-security-statements https://www.nist.gov/cyberframework
A red team member uses an access token obtained from an Azure function to authenticate with Azure PowerShell and retrieve storage account keys. What kind of abuse does this scenario demonstrate?
Answer(s): C
Why option C is correctThe red-team member obtains an access token that was issued to an Azure Function (a resource with a managed identity ). Using that token to call Azure PowerShell and extract storage-account keys bypasses normal permission checks and allows the attacker to act as the managed identity to read secrets that it should not be able to access. This behavior matches the definition of exploiting managed identities for unauthorized access.Why the other options are less appropriateA – Enumeration of user groups with AzureGraph – No indication that the attacker enumerated Azure AD groups or used the Azure Graph API; the activity is focused on storage-account key retrieval. B – Lateral movement via Stormspotter – Stormspotter is a tool for detecting lateral movement via Azure AD token abuse; the scenario describes a direct token use, not a specific lateral-movement technique name. D – Gathering NSG rule information – No mention of querying Network Security Groups or any related reconnaissance; the focus is on storage-account keys, not network configuration.
Managed Identities for Azure Functions: https://learn.microsoft.com/azure/active-directory/managed-identities-quickstart Azure PowerShell authentication with tokens: https://learn.microsoft.com/powershell/module/az.accounts/get-azaccesstoken
A penetration tester is assessing a mobile application and discovers that the app is vulnerable to improper session management. The session tokens are not invalidated upon logout, allowing the tokens to be reused. What is the most effective way to exploit this vulnerability?
Correct answer: C – Perform a replay attack by using the same session token after the user logs outOnce a session token is issued, it remains valid until it is explicitly invalidated by the server.If the application does not invalidate the token on logout, the token can continue to be accepted for subsequent requests. An attacker who captures a valid token can reuse it after the legitimate user logs out, thereby maintaining an authenticated session without needing any fresh credentials. This session replay directly exploits the lack of proper session termination and is the most straightforward and effective method for leveraging the vulnerability.Why the other options are unsuitableA – Brute-forcing valid session tokens – Session tokens are typically high-entropy random strings; brute-force is impractical and would require an unrealistically large number of attempts. B – Using a CSRF attack to steal tokens – CSRF can cause a victim to perform unintended actions, but it does not itself retrieve or reuse a session token after logout; the token still needs to be obtained first. D – SQL injection to retrieve tokens from the database – While possible in a vulnerable backend, it presupposes that the attacker can inject SQL and access the credential store, which is a different class of vulnerability and not the direct exploitation of improper session invalidation.Thus, the most effective exploitation technique is to replay the captured session token after the legitimate session has been terminated.
OWASP – Session Management ( https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Session_Management ) NIST – Guide to Testing for Authentication, Authorization, and Session Management ( https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final )
A penetration tester is assessing the security of a corporate wireless network that uses WPA2-Enterprise encryption with RADIUS authentication. The tester wants to perform a man-in-the-middle attack by tricking wireless clients into connecting to a rogue access point. What is the most effective method to achieve this?
Why option C is the most effective methodA rogue access point that advertises the identical SSID can be deployed on the same frequency as the legitimate WLAN. By broadcasting a stronger signal or by using a de-authentication (or disassociation) frame injection, the attacker forces clients to disconnect from the authorized AP and reconnect to the rogue one. Once a client re-associates, all traffic is redirected through the attacker’s AP, enabling a classic man-in-the-middle scenario on unencrypted protocols (e.g., HTTP, DNS, LDAP) and even allowing credential harvesting from TLS-protected sessions if the attacker performs SSL-strip attacks.This technique directly exploits the trust that WPA2-Enterprise places in the SSID and does not require compromising the RADIUS server or cracking encryption keys, which are far less reliable and more time-consuming.Why the other options are less suitableOption A – Dictionary attack on the RADIUS server – WPA2-Enterprise uses EAP methods that rely on strong certificates or passwords; a dictionary attack on the RADIUS service is impractical and would not give immediate access to client sessions. Option B – XSS on the wireless controller’s login page – While XSS can compromise a web interface, it does not provide a direct vector to intercept wireless traffic or force clients onto a rogue AP. Option D – Brute-force attack to crack WPA2 – WPA2-Enterprise typically uses enterprise-level passwords or certificates, making brute-force infeasible; even if a pre-shared key (PSK) network were present, cracking it does not grant control over AP association flows the way a rogue AP with de-auth does.Conclusion The most direct and reliable way to position oneself between wireless clients and the legitimate network is to create a fake AP with the same SSID and use de-authentication frames to lure clients into connecting to it, thereby achieving a true man-in-the-middle position.
EC-Council, CEH v13 – Wireless Attacks (official courseware) – https://www.eccouncil.org/ceh-certification/certified-ethical-hacker-v13/ Ahamad, M., et al., Wi-Fi Hacking and Security – https://www.wirelesssecurity.org/wifi-hacking-and-security.pdf
A penetration tester is targeting a wireless network secured with WPA2-PSK. The tester captures the handshake but wants to speed up the process of cracking the pre-shared key. Which approach would be most effective?
Answer C – Use a dictionary attack with a large wordlist to crack the WPA2 keyWhy C is optimalThe WPA2-PSK handshake is the only data captured, so the attack must focus on the pre-shared key (PSK). A dictionary attack feeds the captured 4-way handshake to a cracking tool (e.g., hashcat, aircrack-ng) that tests millions of candidate passphrases against the PBKDF2-SHA-1 derived PMK. An extensive, well-curated wordlist (such as rockyou.txt or a custom list of common passwords) dramatically increases the probability of finding the correct key while requiring far fewer resources than a full brute-force search. Modern GPU-accelerated hashcat modes (e.g., --session , --potfile-disable ) can process billions of key trials per second, making the approach both fast and highly successful against weak passwords.Why the other options failA: Manual brute-force – Testing every possible 8-63-character combination is infeasible; the keyspace is astronomically large, resulting in impractically long compute times without specialized hardware. B. SQL injection – This attack targets database-driven applications, not wireless authentication protocols; it cannot bypass WPA2-PSK verification. D. Cross-Site Scripting (XSS) – XSS exploits web-application input mechanisms and has no relevance to the wireless handshake; it cannot affect the PSK derivation process.
Hashcat Documentation – WPA/WPA2 Mode 2500 : https://hashcat.net/wiki/doku.php?id=john_wpa_hccp Aircrack-ng Wiki – Dictionary Attack : https://www.aircrack-ng.org/doku.php? id=how_to_use#dictionary_attackThese sources provide the technical details and command-line examples used to implement dictionary attacks against captured WPA2 handshakes.
A penetration tester suspects that a web application’s login form is vulnerable to SQL injection due to improper sanitization of user input. What is the most appropriate approach to test for SQL injection in the login form?
Technical justificationThe goal of a penetration test focused on the login component is to verify whether unsanitized input can be leveraged to manipulate the underlying SQL query.Option B directly attempts to alter the authentication logic by inserting a tautological condition ( ' OR '1'='1 ) in both fields, which is the classic authentication bypass vector for SQLi. If the application concatenates user input into the SQL statement without proper escaping, this payload will cause the condition to evaluate as true, allowing the tester to log in without valid credentials. This test is both targeted and safe (it only probes the authentication flow and does not disclose data). Option A (directory traversal) is unrelated to the login form’s input handling and would only be relevant if the server exposed file-system resources via user-controlled parameters. Option C (brute-force) tests password strength, not input-validation weaknesses; it does not reveal whether the application is vulnerable to SQL injection. Option D (JavaScript injection) probes for XSS, which is a different class of vulnerability and does not assess the integrity of SQL query construction.Therefore, B is the most appropriate technique for confirming SQL injection susceptibility in the login form, whereas the other options address distinct or irrelevant attack surfaces.
OWASP Testing Guide v4.2 – SQL Injection Testing NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment (Chapter on Web Application Vulnerability Scanning) – PDF
During a red team operation on a segmented enterprise network, the testers discover that the organization’s perimeter devices are configured to deeply inspect only connection initiation packets, especially TCP SYNs and HTTP requests. However, response traffic and acknowledgment packets within ongoing sessions are allowed with minimal inspection. The red team needs to covertly transmit payloads to an internal compromised host using a method that blends into existing session traffic and avoids detection. Which approach should they take to bypass these defensive mechanisms?
JustificationACK tunneling (Option B) exploits the fact that ACK packets, which close an established TCP session, are normally permitted to pass with minimal inspection. By embedding covert payloads within the data carried by these ACKs, the red team can communicate with the compromised host while staying inside legitimate traffic that the perimeter devices already allow. This stealthy use of allowed ACK flow bypasses the deep-packet inspection of SYNs and HTTP requests.Port knocking (Option A) relies on triggering open ports by sending SYN packets to closed services. Since the perimeter devices are configured to closely examine SYN initiations, such a pattern would likely be flagged, making it unsuitable for covert exfiltration.ICMP flooding (Option C) generates a high-volume of ICMP messages, which are often rate-limited or blocked at the edge. Moreover, the traffic pattern is conspicuous and can be detected as an anomaly, reducing stealth.SYN scanning (Option D) involves sending SYN packets to discover open ports. This directly conflicts with the defensive focus on inspecting SYN initiation packets, leading to rapid detection and interruption of the scanning activity.Therefore, ACK tunneling is the most appropriate technique for covertly transmitting payloads within permitted session traffic while avoiding deep inspection of connection-initiation packets.
RFC 793 – Transmission Control Protocol (TCP) specifications, including the role of ACK packets. MITRE ATT&CK – “Command-and-Control: Application Layer Protocol” (T1071) describing use of allowed protocols such as TCP ACKs for covert communications.
A penetration tester suspects that the web application’s “Order History” page is vulnerable to SQL injection because it displays user orders based on an unprotected user ID parameter in the URL. What is the most appropriate approach to test this?
Correct option – B: Modifying the userId parameter to userId=1 OR 1=1 tests the application for a classicSQL-Injection vector by forcing a tautology that should return all rows if the input is unsanitized. This directly confirms whether the backend query is vulnerable to injection without altering the application’s functionality or requiring external payloads.Why the other options are unsuitable:A – JavaScript injection evaluates XSS capability, which is unrelated to the observed weakness (parameter handling in the URL). C – Directory traversal targets file-system access and does not address the injection risk presented by the userId variable.D – Brute-force login seeks valid credentials; however, the vulnerability is not dependent on authentication bypass but on how the supplied parameter is incorporated into a SQL statement.Therefore, option B is the most targeted and efficient test for the suspected SQL-Injection flaw.
OWASP Testing Guide v4 – Injection Testing: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/02a-Input_vectors/01a-Testing_for_SQL_Injection NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment (Section on Web Application Penetration Testing): https://csrc.nist.gov/publications/detail/sp/800-115/final
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.