A penetration tester discovers that a web application uses unsanitized user input to dynamically generate file paths. The tester identifies that the application is vulnerable to Remote File Inclusion (RFI). Which action should the tester take to exploit this vulnerability?
Answer(s): C
JustificationOption C – Provide a URL pointing to a remote malicious script to include it in the web applicationRFI occurs when an application incorporates unsanitized user-supplied data into a file-inclusion function (e.g., include , require , fopen with a URL). By crafting the input as a fully-qualified remote URL that points to attacker-controlled code, the tester can force the server to fetch and execute that script, achieving remote code execution without any local file access or file upload.Option A – Use directory traversal to access sensitive system filesDirectory traversal exploits path manipulation to read local files, but it does not cause the server to include a remote file. It targets a different class of vulnerability and does not achieve code execution from an external source.Option B – Inject a SQL query into the input field to perform SQL injectionSQL injection manipulates database query strings; it is unrelated to file-path handling. RFI exploits the inclusion mechanism, not database query construction.Option D – Upload a malicious shell to the server and execute commands remotelyThis describes a file-upload or remote-shell scenario, which requires the ability to upload files to the server. RFI does not require file upload; it simply leverages the inclusion of a remote URL supplied by the attacker.Conclusion: The only action that directly exploits the unsanitized file-path inclusion mechanism is to supply a malicious remote URL, making Option C the correct choice.
OWASP Web Security Testing Guide – Remote File Inclusion : https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/1-Testing_for_XML_External_Entity_XXE Palo Alto Unit 42 – Remote File Inclusion Attacks : https://unit42.paloaltonetworks.com/remote-file-inclusion-rfi-attacks/
During an internal penetration test within a large corporate environment, the red team gains access to an unrestricted network port in a public-facing meeting room. Upon connecting a laptop, the tester deploys an automated tool configured to continuously send DHCPDISCOVER requests using thousands of randomly generated spoofed MAC addresses. Within minutes, several employees report that their devices are unable to access the internal network or obtain valid IP configurations. The IT team observes that the DHCP server’s IP lease pool is completely depleted, even though few devices are actually connected at the time. What type of attack did the penetration tester perform?
Answer(s): B
Answer(s): B. DHCP starvationTechnical justificationThe attacker floods the DHCP server with DHCPDISCOVER packets that contain spoofed MAC addresses . Because each request includes a unique, non-existent MAC, the server cannot associate those requests with any legitimate client-MAC binding. The server interprets each request as a new lease request and attempts to allocate an IP address from its pool. With thousands of such requests , the lease database is rapidly exhausted, leaving no free addresses for legitimate workstations. The observable symptom—devices being unable to obtain a valid IP address despite few actual devices being present—matches classic DHCP starvation : the attacker starves legitimate clients of address resources rather than altering existing assignments.Why the other options are not appropriateA: Rogue DHCP relay injection – A relay injection would involve compromising or inserting a DHCP relay agent to forward requests to a rogue server, enabling address spoofing or exhaustion. In this scenario, no relay is mentioned; the attacker directly sends DHCPDISCOVER packets, not relayed traffic. C. DNS cache poisoning – This attack manipulates DNS resolver caches to redirect queries to malicious servers. It does not affect IP address allocation, nor does it involve MAC spoofing or DHCP lease depletion. D. ARP spoofing – ARP spoofing corrupts the Ethernet-level address mapping to intercept traffic. While it can disrupt connectivity, it does not generate DHCPDISCOVER floods that exhaust a DHCP lease pool.Therefore, the described behavior is precisely a DHCP starvation attack, where an attacker deliberately overwhelms the DHCP service to deny legitimate clients IP addresses.
Cisco DHCP Basics and Mitigation Strategies – https://www.cisco.com/c/en/us/support/docs/security/digital-certificates/213975-dhcp-security.html NIST Special Publication 800-115 – Technical Guide to Information Security Testing and Evaluation (Chapter on DHCP attacks) – https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final
A penetration tester performs a vulnerability scan on a company’s web server and identifies several medium-risk vulnerabilities related to misconfigured settings. What should the tester do to verify the vulnerabilities?
Answer(s): D
Technical justificationWhy option D is correctConducting controlled exploitation with publicly available scanners or scripts (e.g., Nikto, Burp Suite, or Metasploit modules) validates that the identified misconfigurations can actually be leveraged to achieve the claimed impact (information disclosure, privilege escalation, etc.). This step confirms the vulnerability’s existence, verifies the attack surface, and provides concrete evidence of risk for remediation and reporting. It aligns with penetration-testing best practices (e.g., OWASP Testing Guide v4, Section 4.2) that require proof-of-concept validation before risk classification.Why the other options are unsuitableA: Conduct a denial-of-service (DoS) attack – A DoS test is unrelated to confirming a misconfiguration and may cause unnecessary service disruption, which is outside the scope of a vulnerability verification phase. B. Ignore the vulnerabilities – Medium-risk findings still warrant verification; dismissing them neglects the tester’s responsibility to provide accurate risk assessment. C. Perform a brute-force attack on the login page – Brute-forcing is a separate technique; without first confirming that the misconfiguration permits credential-related exploitation, such an attack is speculative and may violate ethical hacking boundaries.
OWASP Testing Guide v4 – https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing NIST Special Publication 800-115 – https://csrc.nist.gov/publications/detail/sp/800-115/rev-1/final
A cyber adversary is performing external reconnaissance on a large enterprise network with multiple perimeter defenses in place, including packet-filtering firewalls and intrusion detection systems (IDS). The goal is to enumerate the firewall's rule set to identify which TCP and UDP ports are permitted for inbound traffic to internal systems. To minimize noise and avoid immediate detection, the attacker wants to use a method that mimics normal traffic flows while providing insight into how the firewall handles packets based on port and protocol combinations. Which reconnaissance technique should the attacker choose to effectively map the firewall’s filtering behavior without raising alerts?
Introduction In external reconnaissance, an adversary must select a technique that reveals the firewall’s rule-based behavior while remaining stealthy. The correct choice must (1) differentiate allowed versus blocked traffic on a per-port and per-protocol basis, (2) generate traffic that can be classified as benign-looking, and (3) provide the necessary feedback (e.g., ICMP unreachable, TCP reset, or no response) to reconstruct the rule set.Why Firewalking is the Optimal TechniqueFirewalking involves crafting packets with altered TTL (Time-To-Live) values so that they either reach the firewall’s inspection point or are dropped, resulting in characteristic ICMP or TCP responses that indicate whether a particular port-protocol combination is permitted, filtered, or denied. By incrementally increasing TTL, the attacker can probe each layer of the perimeter defense, mimicking legitimate traffic flow (e.g., TCP SYN to a web server port) without triggering the typical alerts associated with aggressive port scans. This method yields granular mapping of the ACL (Access Control List) for individual ports and protocols, which is precisely what the scenario describes. Firewalking also allows the attacker to differentiate stateful inspection behavior (e.g., “stateless deny” vs. “stateful allow”) by observing whether a subsequent packet can traverse the firewall after an initial allowed flow.Why the Other Options Are InferiorA: Conducting full SYN scans on all ports – SYN scans are inherently noisy; they generate a high volume of connection attempts that trigger IDS/IPS signatures. The traffic pattern is atypical for normal applications, making it easy to detect. C. Sending ICMP Echo requests to the broadcast address – ICMP Echo is unrelated to TCP/UDP port filtering; it only tests host reachability and does not provide insight into which ports are permitted. Moreover, many firewalls block ICMP at the perimeter, rendering the technique ineffective for mapping port-specific rules. D. Passive DNS monitoring – Passive DNS reveals domain-to-IP mappings and does not interact with the firewall’s packet-filtering engine. It cannot uncover which ports or protocols are allowed through the perimeter defenses.Conclusion Firewalking best satisfies the requirement to covertly enumerate the firewall’s filtering behavior on a port-by-port, protocol-by-protocol basis while appearing as legitimate traffic. The technique’s reliance on TTL manipulation to provoke specific responses from the firewall aligns with the scenario’s emphasis on stealth and detailed rule-set discovery.
EC-Council, CEH v13 Official Study Guide – Chapter 5: Footprinting and Reconnaissance – https://www.eccouncil.org/ceh-certification/ceh-study-guide/ Nmap Project, Nmap Network Scanning – Firewall/IDS Evasion and Firewalking – https://nmap.org/book/iptables-firewall-testing.html
During a security assessment, an attacker identifies a flaw in a multi-user file system. The system first verifies access rights to a temporary file created by a user. However, immediately after this verification, and before the file is processed, the attacker manages to swap the original file with a malicious version. This manipulation happens in the brief interval between the system's access verification and the moment it handles the file, resulting in the malicious file being treated as legitimate. Which vulnerability is the attacker exploiting?
JustificationThe described behavior matches a classic TOCTOU (Time-of-Check-to-Time-of-Use) flaw: the system validates that the caller has the right to access a temporary file before the file is actually opened for processing. During the tiny interval between the permission check and the subsequent operation, the attacker replaces the legitimate file with a malicious one. Because the subsequent code trusts the previously verified identity of the file, it proceeds to treat the attacker-controlled content as if it were authorized, enabling privilege escalation or unauthorized access.Option C (Time-of-validation/time-of-execution issue in resource management logic) directly captures this type of race-condition vulnerability. It refers to mismatched ordering between validation and consumption of a resource, which is exactly what the scenario illustrates.Why the other options are less appropriateA – Integer overflow involves arithmetic limits being exceeded; the bug here does not rely on numeric bounds. B – Null pointer dereference concerns improper handling of a null reference; no null value is mentioned in the description. D – Improper certificate validation pertains to TLS/PKI trust checks; the attack vector is at the file-system level, not a network trust chain.
TOCTOU (Time-of-Check-to-Time-of-Use) Vulnerabilities – MITRE CWE: https://cwe.mitre.org/data/definitions/367.html Linux filesystem permissions and TOCTOU considerations – Red Hat Documentation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening_guide/using-the-toctou-vulnerability-to-escalate-privileges_securityCorrect answer: C .
A penetration tester is conducting a security assessment for a client and needs to capture sensitive information transmitted across multiple VLANs without being detected by the organization's security monitoring systems. The network employs strict VLAN segmentation and port security measures to restrict unauthorized access. Which advanced sniffing technique should the tester use to discreetly intercept and analyze traffic across all VLANs?
Correct choice: C – Exploit a VLAN hopping vulnerability to access multiple VLANsWhy this is the best techniqueVLAN hopping forces a trunk port to forward frames tagged with multiple VLAN IDs, allowing the tester to inject or capture traffic from all VLANs traversing the trunk without needing internal ports or privileged access. The attack can be performed with a single compromised host or a crafted packet, keeping the activity difficult to detect by the organization’s monitoring tools that typically watch only regular host-to-host traffic. It requires only knowledge of mis-configured trunk ports (e.g., allowed VLAN lists, native VLAN mismatches), which is common in poorly hardened environments, making it a realistic “advanced sniffing” method in a penetration-test scenario.Why the other options are less suitableA: Deploy a rogue DHCP server – Redirection of traffic is limited to DHCP clients; it does not provide visibility into arbitrary VLAN traffic and will be quickly noticed by network devices that enforce DHCP snooping. B. Use ARP poisoning – Works only within the same broadcast domain; once the traffic spans VLAN boundaries, ARP poisoning cannot capture inter-VLAN packets and will generate numerous address-resolution anomalies that trigger alerts. D. Implement switch port mirroring – Requires legitimate administrative access to the switch and configuration changes that are logged and audited; a tester without privileged credentials cannot enable it covertly, and security monitoring often watches for unauthorized mirroring commands.Concise justificationVLAN hopping exploits the trust relationship between switches, allowing an attacker to “tag” traffic with multiple VLAN IDs and thereby view or inject frames across segment boundaries, satisfying the need for stealthy, cross-VLAN sniffing while bypassing typical security controls.
EC-Council, Certified Ethical Hacker v13 – Exam Objectives (Chapter 9: Network Mapping and Scanning) – https://www.eccouncil.org/ceh-certification/ EC-Council, CEH v13 Official Courseware – VLAN Attack Techniques – https://www.eccouncil.org/ceh-version-13/
During a penetration test against a network defended by a signature-based Intrusion Detection System (IDS), the tester initiates a port scan but notices that traditional scanning methods like full SYN or TCP Connect scans are being flagged and blocked. To evade detection, the tester modifies their approach: they split the TCP headers into multiple smaller IP segments before sending them across the network. This ensures that the IDS sees only incomplete segments of the packet. Once these segments reach the target, the destination host reassembles them and processes the scan as a normal SYN request. No alerts are raised on the IDS, yet the scan reveals open ports on the target. Which evasion technique has the tester most likely employed to avoid triggering IDS alerts?
Technical JustificationThe tester deliberately splits a TCP SYN (or other) packet into multiple IP fragments so that each fragment is smaller than the IDS signature threshold. Because signature-based IDS engines inspect whole packets, they fail to recognize the fragmented payload as a complete SYN scan, resulting in no alert while the target’s TCP stack reassembles the fragments and processes the scan as a normal SYN request. This method directly exploits the IDS’s limitation to detect only complete packets, making it the classic “packet fragmentation” evasion technique.Why the other options are less suitableA – IP decoying with randomized address positions – This technique hides the source address by using multiple IPs, but it does not alter packet structure; a signature-based IDS can still detect the SYN payload and raise an alert. B – Packet crafting with randomized window size – Modifying the TCP window field may bypass simple heuristic checks, yet most IDS signatures are based on the presence of a SYN flag and sequence numbers, not the window value; fragmentation is required to avoid detection of the whole packet. D – SYN scan with spoofed MAC address – MAC address spoofing is only relevant on a LAN and does not affect network-layer IDS; the SYN scan would still be visible to the IDS in its entirety.Therefore, the technique that best matches the described scenario—splitting packets to evade signature-based detection—is Packet fragmentation to bypass filtering logic .
Nmap Network Scanning – Fragmentation Options: https://nmap.org/book/man.html#xrefs-fragmentation SANS Institute – IDS/Evasion Techniques Overview: https://www.sans.org/reading-room/whitepapers/vulnerability/evading-ids-37224
During a security assessment of an organization’s internal network, a penetration tester discovers that UDP port 123 is open on a critical host, indicating that the Network Time Protocol (NTP) service is active. The tester suspects the NTP server could reveal insights into how the internal network synchronizes time, which could assist in lateral movement or correlating timestamps in logs. To gather more information, the tester decides to enumerate the list of NTP peers and determine their synchronization status, offset, and stratum levels to understand the hierarchy and redundancy in the time synchronization infrastructure. Which command should the tester use to retrieve this specific information?
Answer(s): A
Answer(s): A – ntpqWhy ntpq is the right choice ntpq is the primary query tool for NTP daemons; it can request the peer list , synchronization status , offset ,jitter , clock dispersion , and stratum of each peer.By issuing the peers or rv command (e.g., ntpq -p ), the tester receives exactly the hierarchical and redundancy details needed to map the NTP topology. The output includes peer addresses, stratum numbers, reference identifiers, and timing statistics— information that directly supports enumeration of peers and assessment of synchronization quality.Why the other options are unsuitableB: ntpdc – Deprecated client utility; it provides limited status information and lacks robust peer enumeration capabilities. It is mainly retained for backward compatibility and does not expose the detailed peer table that ntpq does.C: ntpdate – Used for setting the local clock using NTP packets; it performs a one-shot time sync and never enumerates peers or reports status. D. ntptrace – Traces the NTP synchronization chain from a given server back to the root source; it is useful for exploring the ancestry of a single server but does not query the local daemon’s peer view or provide real-time offset/stratum data for all peers.Therefore, ntpq is the precise, standardized command for retrieving the peer list and associated synchronization metrics needed for the assessment.
NTP Project – Manual Page: ntpq – https://manpages.debian.org/ntp/ntp-doc/ntpq.8.en.htmlNTP Community – Using ntpq to Query Peers – https://support.ntp.org/std/leaf/ntpq.html
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.