A penetration tester performs a vulnerability scan on a company’s network and identifies a critical vulnerability related to an outdated version of a database server. What should the tester prioritize as the next step?
Answer(s): C
JustificationThe tester must validate that the identified vulnerability can actually be exploited before escalating further actions. Using publicly available proof-of-concept tools or exploits is the standard, reproducible method for confirming a critical database issue while limiting impact on production systems. This step provides concrete evidence of risk, informs remediation priorities, and satisfies the ethical-hacker principle of “do no unnecessary harm.”Why the other choices are unsuitableA: Conduct a brute-force attack – Brute-forcing login pages is noisy, may trigger security alerts, and does not specifically target the known database flaw; it wastes time and increases detection risk. B. Perform a denial-of-service attack – Launching a DoS attack violates ethical-hacking rules, can cause service disruption, and does not contribute to proof-of-exploitation for remediation. D. Ignore the vulnerability – Skipping verification contravenes the purpose of a penetration test and leaves potential risk unaddressed; it is never an appropriate next step.Conclusion – Exploiting the vulnerability with known tools (Option C) provides the most targeted, efficient, and responsible verification, allowing the tester to confirm exploitability and move toward remediation or reporting.
OWASP Testing Guide – Section 4.2: Vulnerability Validation https://owasp.org/www-project-web-security-testing-guide/v42/ NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Assessment https://csrc.nist.gov/publications/detail/sp/800-115/final
During routine network monitoring, the blue team notices several LLMNR and NBT-NS broadcasts originating from a workstation attempting to resolve an internal hostname. They also observe suspicious responses coming from a non-corporate IP address that claims to be the requested host. Upon further inspection, the security team suspects that an attacker is impersonating network resources to capture authentication attempts. What type of password-cracking setup is likely being staged?
Answer(s): D
Why option D is the correct choiceLLMNR/NBT-NS abuse : When a workstation issues an LLMNR or NetBIOS-NS query for an internal name, an attacker can spoof the reply from a rogue IP address. The victim will accept the reply and may authenticate to the bogus service, causing the target to transmit its authentication tokens (e.g., NTLM challenge-response) toward the attacker. Hash capture : The captured authentication exchange yields the target’s NTLM password hash. An attacker can then feed this hash into an offline cracking tool (e.g., hashcat, John the Ripper) to recover the clear-text password. This is precisely “exploiting name resolution to capture password hashes.” Direct relevance to the scenario : The observed broadcast replies from a foreign IP attempting to resolve an internal hostname match the classic pattern of link-local name-resolution poisoning, the first step in harvesting credentials for later cracking.Why the other options are unsuitableA: Decrypt login tokens from wireless networks – This describes a wireless-specific attack (e.g., PMKID capture) that does not involve LLMNR/NBT-NS or host-name resolution. B. Match captured credentials with rainbow tables – While rainbow tables can be used later for cracking, the scenario’s key step is the capture of hashes via name-resolution spoofing; the question asks what is being staged initially, not the subsequent cracking method. C. Use CPU resources to guess passphrases quickly – CPU-heavy brute-force attacks are unrelated to the network-level name-resolution manipulation described; they do not explain the observed LLMNR/NBT-NS traffic.Thus, the staged password-cracking setup is best characterized as exploiting name resolution to capture password hashes (option D).
Microsoft Docs – LLMNR and NetBIOS name resolution : https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc781272(v=ws.10) MITRE ATT&CK – T1071.004 (Application Layer Protocol: Web Protocols) (includes LLMNR/NBT-NS abuse): https://attack.mitre.org/techniques/T1071/004/
During a comprehensive internal penetration test, a tester attempts to enumerate open services using a UDP scan across a wide range of ports on a target system. After transmitting multiple UDP probes, the tester observes that some ports generate immediate ICMP “Destination Unreachable – Port Unreachable” (Type 3, Code 3) responses. However, the majority of the ports remain silent, providing no reply or error message. No firewall rules or IDS alerts have been triggered at this stage. The tester suspects that the scan results are inconclusive for several of the probed ports. Based on the observed behavior, what can the tester reasonably conclude about the non-responsive ports?
Answer(s): B
Technical justificationA UDP scan sends a lightweight probe to each target port and waits for a reply.When the destination port is open , many operating systems respond with an ICMP “Port Unreachable” (Type 3/Code 3) because there is no listening process; this is the expected response that Nmap or similar tools interpret as “open|filtered” after a timeout.When the probe receives no reply at all , the packet may be filtered by a stateful firewall or the packet may be dropped silently ; the lack of an ICMP error does not indicate that the port is definitely closed.Therefore, ports that remain silent after the initial probe should be considered potentially open or filtered , and a more reliable assessment typically requires:1. Retransmission of the UDP probe (to compensate for transient loss), 2. Increasing the timeout to accommodate slower responses, and 3. Optionally, service-specific follow-up (e.g., sending a protocol-specific payload after a successful probe).Why option B is correct – It accurately reflects that silent ports could be either open (responding with an unreachable ICMP only after a timeout) or filtered (dropped by a firewall) and that additional probing (re-sending) is needed to gather definitive evidence.Why the other options are unsuitableA: No indication of rate-limiting or systematic blocking of all probes; only some ports responded with ICMP errors. C. Closing a port typically yields no response, but the absence of an ICMP error does not prove the port is closed; it may simply be filtered. D. Three-way handshakes are a TCP concept; UDP services do not require such handshakes, so this reasoning is irrelevant to the observed behavior.
EC-Council, “Certified Ethical Hacker (CEH) v13 – Network Scanning Techniques” , official syllabus – https://www.eccouncil.org/ceh/certification-courses/ceh-v13/ Nmap Project, “UDP Service Discovery” , documentation – https://nmap.org/book/man-osdetect.html
During a targeted phishing campaign, an attacker gains access to a trusted internal system within a corporate network protected by advanced firewalls, IDS, and email security gateways. To maintain persistence and evade content inspection, the attacker crafts a malicious HTML email attachment containing obfuscated JavaScript code. When the user opens the attachment in a browser, a hidden JavaScript blob dynamically reconstructs a malware payload and triggers an automatic file download on the client side. No external connections are initiated during this process, making it difficult for network security tools to detect or block the attack. Which evasion technique is being employed to bypass the firewall and IDS protections?
The technique used is HTML smuggling , where the attacker embeds an obfuscated HTML/JS attachment that rebuilds the malicious payload inside the victim’s browser and triggers a file download without any outbound network activity. This method bypasses firewalls and IDS/IPS because the malicious code never generates detectable connections; all inspection points see only benign HTML and JavaScript. Why the other options are unsuitable:HTTP header spoofing modifies request headers but does not hide malicious payload reconstruction inside a local file download. Port forwarding is a network-level routing technique and does not involve client-side code execution or evasion of content inspection. Cross-site scripting injects script into a trusted web page, but the scenario describes a self-contained malicious attachment that reconstructs a payload locally, which is the hallmark of HTML smuggling.
https://www.acunetix.com/blog/web-security/what-is-html-smuggling/ https://www.crowdstrike.com/blog/html-smuggling-technique-used-by-attackers/
During a red team simulation, an attacker attempts to deliver a payload to a web server hosted within a segmented enterprise network. The target environment uses a Network-based Intrusion Detection System (NIDS) that performs deep packet inspection and pattern matching against known attack signatures. To avoid triggering alarms, the attacker decides to manipulate the structure of the packets rather than the actual attack code. The approach involves crafting packets with intentionally malformed checksums and modifying specific fields so that the packets are accepted by the IDS but discarded by the destination system. This leads the IDS to process and log a different set of data than what the actual target receives, effectively bypassing signature detection. Which evasion technique is the attacker employing to deceive the IDS into misinterpreting the attack traffic while the payload remains unchanged on the target system?
Answer(s): D – Insertion AttackWhy the insertion attack fits bestDefinition – An insertion attack modifies or inserts non-essential fields, headers, or padding in a packet so that the packet is accepted by the IDS (which parses the manipulated structure) but altered by the receiving host (which enforces stricter validation). What the attacker achieves – By deliberately corrupting the checksum or tweaking fields such as IP header length, options, or TCP flags, the packet reaches the IDS unchanged from its perspective (the IDS sees a “well-formed” packet) yet is dropped or altered by the destination because it violates the host’s protocol stack rules. Consequently, the IDS logs traffic that never actually arrives at the target, allowing the real payload (which can be hidden elsewhere) to bypass signature-based detection. Alignment with the scenario – The description specifically says the attacker “manipulates the structure of the packets rather than the actual attack code” and “causes the IDS to process and log a different set of data than what the actual target receives.” This is the textbook description of an insertion technique used to deceive DPI-based IDSs.Why the other options do not applyOption Reason for exclusionRequires reassembly of fragmented TCP streams across multiple sessions or connections, typically to hide payloads across several packets. The scenario describes a single-packet manipulation focused on checksum and header fields, not on splitting a session across multiple flows.A: Session splicingRefers to code that changes its binary signature on each generation (e.g., by reordering instructions). The payload itself is unchanged ; only the packet structure is altered. Polymorphic techniques affect the payload, not the packet headers or checksums.B: Polymorphic shellcodeInvolves breaking a packet into fragments to evade IDS signature detection of the complete packet. The technique relies on the IDS missing the reassembled payload because fragments are processed separately. Here the attacker does not fragment the payload; they simply alter header fields (e.g., checksum) to make the IDS accept the packet while the host rejects it.C: Fragmentation attackKey technical pointsChecksum manipulation : Changing the IP or TCP checksum forces the receiving stack to reject the packet, yet many IDSs compute checksums on the fly and will still treat the packet as valid if the rest of the header looks correct. Header padding / option fields : Adding or altering non-essential options can confuse signature engines that rely on exact byte sequences, allowing the attacker to embed malicious data in those fields. Effect on IDS vs. destination : The IDS sees a syntactically correct packet and logs it; the destination discards it due to protocol violations, effectively “inserting” benign-looking traffic that never reaches the application.Conclusion – The attacker is employing an insertion attack , a classic evasion method that exploits mismatches between IDS parsing and destination stack validation to hide malicious traffic while keeping the payload unchanged.
RFC 791 – Internet Protocol RFC 793 – Transmission Control Protocol Network Intrusion Detection: An Artist's Arms Race – By Richard Bejtlich, 2004 (Chapter on insertion attacks) Practical IDS Tuning – By Charles Brookes, 2005 (Discussion of header manipulation techniques)(Links to publicly available RFCs and books are provided for further reading.)
A penetration tester is evaluating a secure web application that uses HTTPS, secure cookie flags, and regenerates session IDs only during specific user actions. To hijack a legitimate user’s session without triggering security alerts, which advanced session hijacking technique should the tester employ?
Chosen option: DJustification:Session fixation allows an attacker to pre-define a session identifier and force the victim’s browser to use it, enabling hijacking without generating new session IDs and thus avoiding alerts that are often triggered by token regeneration or prediction attempts. The other options either require additional vulnerabilities (e.g., XSS or certificate flaws) or rely on predictable token generation, which is less likely in a session that uses secure flags and regeneration on sensitive actions.Why other options are less suitable:A – MITM on certificates: Requires exploiting TLS validation weaknesses, which is outside the scope of session hijacking and would likely trigger certificate warnings. B – Token prediction: Involves guessing or brute-forcing session IDs; if IDs are properly random and regenerated after login, prediction becomes impractical. C – XSS to steal tokens: Needs an injection vector and executes script in the victim’s browser, which can be detected by modern Web Application Firewalls and does not directly manipulate the session ID.References:1. OWASP Testing Guide – Session Management: https://owasp.org/www-project-web-security-testing-guide/v41/4-Testing_Guide/1-Web_Application_Security_Testing/4-Testing_for_Session_Management 2. NIST SP 800-53 Rev. 5 – Authentication and Session Management Controls:https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/finalIs there anything else I can help with?
References:1. OWASP Testing Guide – Session Management: https://owasp.org/www-project-web-security-testing-guide/v41/4-Testing_Guide/1-Web_Application_Security_Testing/4-Testing_for_Session_Management 2. NIST SP 800-53 Rev. 5 – Authentication and Session Management Controls:https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/finalIs there anything else I can help with?
A penetration tester is trying to attack a wireless network that uses WPA3 encryption. The tester wants to exploit the handshake to obtain the password but realizes WPA3 has stronger protections. What would be the most effective approach to compromise the network?
Why option D is the best choiceThe goal is to recover the WPA3 password by exploiting the handshake. WPA3-SAE (Simultaneous Authentication of Equals) is designed to resist offline dictionary attacks, but an attacker can force the client or AP to fall back to the older WPA2-PSK mode, which uses the vulnerable 4-way handshake. Capturing that downgraded handshake lets the tester run an offline dictionary or brute-force attack on the pre-shared key (PSK). This technique is well-documented and widely used in practice.Why the other options are unsuitableA: Brute-force directly on the WPA3 handshake – The SAE exchange includes cryptographic protections (e.g., password--derived keys, commit-reveal) that make direct brute-forcing computationally infeasible. B. Dictionary attack on the WPA3 handshake – Similar to A, SAE deliberately thwarts offline dictionary attacks; the attacker would need to capture many attempts, and success is still far less reliable than downgrading. C. SQL injection on the router’s login page – This attacks an application-layer interface, not the wireless encryption process; it has no impact on obtaining the Wi-Fi password. D. Downgrade to WPA2 and capture the handshake – By forcing a downgrade, the tester gets a WPA2 4-way handshake, which can be cracked offline with known password-cracking tools. This is the standard, most effective method for compromising WPA3-protected Wi-Fi when direct cracking is impractical.ConclusionUse the downgrade-to-WPA2 technique to obtain a usable handshake, then apply a password-cracking tool. This approach aligns with real-world penetration-testing methodology and is the recommended path for extracting the WPA3 password. Last
https://www.wi-fi.org/en-us/learn-about-wifi-security https://www.nist.gov/publications/800-188-guide-to-wireless-security Last
A company hires a hacker to test its network security by simulating real-world attacks. The hacker has permission and operates within legal boundaries. What is this type of hacker called?
Correct Answer: B – White Hat HackerA White Hat hacker operates under explicit, written authorization and stays strictly within legal and contractual boundaries while conducting penetration testing. This aligns with the scenario where the company has hired the hacker to simulate attacks, granting permission to probe the network. White-hat activities are guided by professional ethics, documented scopes, and post-engagement reporting, ensuring accountability and compliance.Why the other options are unsuitableA – Grey Hat Hacker: Performs testing without formal permission or follows a vague “implied consent,” which can expose the tester to legal risk; not appropriate for a strictly authorized engagement. C – Black Hat Hacker: Engages in unauthorized, malicious exploitation for personal gain or disruption, violating laws and ethical standards—contrary to the lawful context described. D – Script Kiddie: Relies on pre-written scripts with limited technical depth and typically lacks the strategic approach, scope definition, and accountability expected of a professional penetration test.
EC-Council – Certified Ethical Hacker (CEH) – Types of Hackers https://www.eccouncil.org/training/certified-ethical-hacker-ceh/ CISA – Understanding Threat Actors and Their Motivations https://www.cisa.gov/understanding-cybersecurity-threat-actors
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.