An e-commerce platform hosted on a public cloud infrastructure begins to experience significant latency and timeout issues during its peak sales hours. Security logs indicate thousands of incoming HTTP connections, each of which starts sending headers extremely slowly and never completes the full request. Over time, the number of open connections rises beyond the server’s handling capacity, leading to system instability and service unavailability. The network team verifies that these connections are not transmitting malformed packets or high volumes of traffic and appear to originate from legitimate IPs. Which specific DoS technique is most likely responsible for the degradation of service?
Answer(s): C
Technical justificationThe scenario describes many legitimate-looking HTTP requests that send headers extremely slowly and never complete the full request. This behavior ties up server worker threads and exhausts the connection pool, causing latency spikes and eventual denial of service. Slowloris is specifically designed to keep a single HTTP connection open while sending data at a snail-pace, thereby consuming limited server resources and preventing legitimate clients from establishing new connections. It does not rely on packet-level anomalies or high-volume traffic floods, which matches the observed characteristics. UDP application-layer flooding (A) overwhelmingly depends on massive UDP datagrams; the traffic here isHTTP, not UDP, and the attack vector is request-level, not protocol-level. Fragmentation flood attack (B) exploits IP fragmentation to overload the reassembly engine. The logs show normal packets that complete the request headers, not fragmented IP fragments. SYN flood with spoofed source IPs (D) floods TCP three-way handshakes with spoofed source addresses, exhausting the half-open connection state. The connections in the case are already established TCP sessions that remain open but idle, a hallmark of Slowloris rather than a SYN-based flood.Consequently, option C – Slowloris holding web server connections precisely aligns with the described behavior and is the most likely cause.
OWASP – Slowloris Attack: https://owasp.org/www-project-modsecurity-core-rule-set/3.3/attacks/slowloris.html NIST Special Publication 800-115 – Technical Guide To Information Security Testing And Assessment (Section on Application-Layer DoS Techniques): https://csrc.nist.gov/publications/detail/sp/800-115/final
A penetration tester is evaluating the security of a mobile application and discovers that it lacks proper input validation. The tester suspects that the application is vulnerable to a malicious code injection attack. What is the most effective way to confirm and exploit this vulnerability?
Why Option C is the most effectiveThe vulnerability described is a lack of proper input validation, which can allow an attacker to inject malicious code that the application will execute. In a mobile app, this often manifests as reflected or stored code injection (e.g., JavaScript, native command payloads) when user-supplied data is reflected back in the UI or passed to back-end services. By deliberately entering a crafted JavaScript payload into an input field and monitoring the app’s response (e.g., pop-up alerts, unexpected network requests, altered UI), the tester can confirm the presence of the injection point and gauge its impact . This technique directly tests the validation logic and reveals whether untrusted data can be treated as executable code, which is the core of the suspected vulnerability.Why the other options are unsuitableOption A – Dictionary attack on the mobile app’s encryption algorithmEncryption attacks target cryptographic strength, not input validation. Finding weak encryption is unrelated to confirming a code-injection flaw.Option B – Brute-force attack on the login pageThis tests password complexity, not whether unsanitized input can be executed as code. It does not verify the injection vector.Option D – Directory traversal to access internal storageWhile directory traversal can expose files, it exploits file-system navigation rather than input validation of user-supplied data. It is not the most direct method to prove a code-injection issue.
OWASP Mobile Top 10 – Injection: https://owasp.org/www-project-mobile-top-10/2016/A2 EC-Council CEH Handbook (v13) – Chapter on Web & Mobile Application Penetration Testing: https://www.eccouncil.org/ceh-certification/handbook/
A penetration tester is assessing an IoT thermostat used in a smart home system. The device communicates with a cloud server for updates and commands. The tester discovers that communication between the device and the cloud server is not encrypted. What is the most effective way to exploit this vulnerability?
Answer(s): A
Technical JustificationOption A – Man-in-the-Middle (MitM) on unencrypted traffic is the most direct and effective exploitation path because the thermostat sends commands and receives updates over plaintext protocols (e.g., HTTP or MQTT without TLS). An attacker can position a rogue intermediary on the same network segment to capture, modify, or inject malicious payloads, potentially issuing unauthorized commands or redirecting the device to a malicious update server. This attack leverages the exact weakness identified – lack of encryption – and requires no specialized authentication bypass or server-side vulnerabilities.Option B – Cross-Site Scripting (XSS) on the thermostat’s web interface would only be viable if the device exposed a user-facing web UI that processed unsanitized input. While many IoT devices have minimal or no UI, the scenario describes only cloud communication; therefore, an XSS vector is improbable and less reliable.Option C – Brute-force local admin login presumes the existence of a local administrative interface protected by a weak password policy. The description does not mention any locally stored credentials or login portal, making this approach speculative and generally ineffective in a purely cloud-centric communication flow.Option D – SQL injection on the cloud server’s login page targets a server-side database query language flaw. The vulnerability disclosed pertains specifically to the device-to-cloud link, not to the server’s application logic. Unless additional unsanitized input points are known, an SQLi attack is out of scope for the given assessment.Conclusion: The most immediate and high-impact exploitation of the identified flaw is a MitM attack that intercepts and manipulates unencrypted device-cloud traffic.
OWASP Internet of Things Security Project – https://owasp.org/www-project-internet-of-things/ NIST Special Publication 800-183 – Guide to IoT Security – https://csrc.nist.gov/publications/detail/sp/800-183/final
An attacker places a malicious VM on the same physical server as a target VM in a multi-tenant cloud environment. The attacker then extracts cryptographic keys using CPU timing analysis. What type of attack was conducted?
Answer(s): A – Side-channel attackThe attacker runs a malicious VM on the same physical host, co-locating it with the victim VM. By measuring precise timing variations (e.g., CPU cycle counts) of shared micro-architectural resources such as caches, the attacker infers secret cryptographic keys. This is a classic side-channel technique that exploits implementation-specific behaviors (cache hits/misses, execution time) rather than software vulnerabilities or configuration errors.Why the other choices are not applicableB: Cache poisoned denial of service (CPDoS) – focuses on forcing a denial-of-service by manipulating cache state, not on extracting cryptographic material. C. Cloud cryptojacking – involves hijacking cloud resources to mine cryptocurrency; it does not rely on timing-based key extraction. D. Metadata spoofing – typically refers to falsifying identity or service metadata, not to timing-based side-channel extraction of secrets.Key conceptsMulti-tenant environments share physical resources; side-channel attacks leverage shared micro-architectural state. Timing analysis of cache behavior is a well-known side-channel vector used to recover AES keys, RSA private keys, etc.
Intel® 64 and IA-32 Architectures Optimization Reference Manual – Section on cache-related performance events. “Cache-Based Side-Channel Attacks” – NIST Cryptographic Standards and Guidelines, Special Publication 800-115.
A penetration tester identifies that a web application’s login form is not using secure password hashing mechanisms, allowing attackers to steal passwords if the database is compromised. What is the best approach to exploit this vulnerability?
JustificationOption C – Perform a dictionary attack using a list of commonly used passwords against the stolen hash values is the most appropriate exploitation technique.If the application stores passwords with weak or unsalted hashing, the stored hash can be cracked offline by comparing it to a dictionary of common passwords (e.g., “rockyou.txt”). This directly leverages the identified weakness and can recover the clear-text credentials without interacting with the live application. Certified Ethical Hacker (CEH) v13 emphasizes “Password Cracking” as a post-exploitation activity when password storage mechanisms are weak, making this the textbook example of exploiting the vulnerability.Option A – Capture the login request using a proxy tool and attempt to decrypt the passwords is ineffective.Modern password transmission may be encrypted (TLS), and the stored hashes are not transmitted in plain text; therefore there is nothing to “decrypt” from the proxy capture. Moreover, decryption would require knowledge of the encryption key, which is not available in this scenario.Option B – Conduct a brute-force attack on the login form to guess weak passwords is impractical and noisy.Brute-forcing directly against the live login endpoint is rate-limited, triggers account-lockout mechanisms, and is easily detected by IDS/IPS. Offline cracking of the hash (Option C) is far more efficient and stealthy, which aligns with best practice for exploiting weak hashing.Option D – Input a SQL query to check for SQL injection vulnerabilities in the login form is unrelated.While SQL injection is a valid testing technique, it does not address the specific issue of insecure password hashing. The question asks for the best way to exploit the identified hashing weakness, not to discover a separate injection flaw.Conclusion Option C directly utilizes the captured hash values and a dictionary-based cracking method, which is the recommended approach when weak password hashing is discovered. It maximizes success probability while minimizing detection, fitting the CEH v13 methodology.
CEH v13 – Password Cracking Techniques : https://www.eccouncil.org/ceh-certification/ OWASP Authentication Cheat Sheet – Password Storage :https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
A penetration tester evaluates a company’s secure web application, which uses HTTPS, secure cookie flags, and strict session management to prevent session hijacking. To bypass these protections and hijack a legitimate user’s session without detection, which advanced technique should the tester employ?
Answer(s): D
A penetration tester is assessing a company’s executive team for vulnerability to sophisticated social engineering attacks by impersonating a trusted vendor and leveraging internal communications. What is the most effective social engineering technique to obtain sensitive executive credentials without being detected?
JustificationOption A – Targeted spear-phishing email is the most effective because it combines personalization with relevance to the executive’s workflow. An attacker can reference recent projects, internal terminology, or known business initiatives, making the request appear legitimate and urgent. This tailored approach bypasses generic spam filters and reduces suspicion, allowing the attacker to capture credential verification requests without raising alarms.Option B – Fake social-media profile can gather information but typically requires a longer engagement period and may be detected by executive security awareness programs that monitor unusual connection attempts. Credential harvesting through this channel is slower and less reliable for immediate, high-value credential extraction.Option C – Impersonating the CEO via phone is high-risk; privileged executives often verify the caller’s identity through callback procedures or internal policies, and sudden requests to change passwords can trigger fraud-prevention controls. Moreover, voice-based social engineering is easier to log and trace.Option D – Mass phishing email lacks the personalization needed to successfully target high-profile individuals. Such bulk campaigns are routinely flagged by email security gateways, and they do not leverage the executive’s context, decreasing success rates and increasing detection likelihood.Therefore, Option A provides the optimal blend of contextual relevance, urgency, and stealth, making it the technique most likely to obtain executive credentials undetected.
ENISA, Phishing and Social Engineering – Best Practices for Prevention, 2023. https://www.enisa.europa.eu/publications/phishing-and-social-engineering NIST, Special Publication 800-63B – Digital Identity Guidelines (Section on Credential Harvesting and Phishing Mitigation), 2020. https://csrc.nist.gov/publications/detail/sp/800-63b/rev-1/final
A penetration tester is evaluating a web application that does not properly validate the authenticity of HTTP requests. The tester suspects the application is vulnerable to Cross-Site Request Forgery (CSRF). Which approach should the tester use to exploit this vulnerability?
Technical justificationOption C is the appropriate technique because a CSRF attack relies on convincing the victim’s browser to submit a state-changing request to the target application using the victim’s authenticated session. By crafting a malicious page that issues an authenticated request (e.g., a POST to change an account password or submit a transfer), the tester can demonstrate that the application does not verify the request’s origin (e.g., via Referer , Origin , or anti-CSRF tokens). This directly tests the suspected lack of request authenticity validation.Why the other options are unsuitableOption A (SQL injection) exploits insufficient input sanitization, not missing request authentication. It requires the application to embed unsanitized data in SQL statements, which is unrelated to validating the request’s source. Option B (brute-force login) targets credential strength and authentication thresholds, not the authenticity of subsequent requests once a session is established. Option D (directory traversal) aims to read unauthorized files on the server and does not involve manipulating the client’s authenticated session or testing request source validation.Thus, the tester should generate a malicious site that triggers a forged request on behalf of an authenticated user to confirm the CSRF weakness.
OWASP CSRF Prevention Cheat Sheet – https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html RFC 6454 – The Browser Object Model (BrOM) – Section on “Same-origin policy and request authentication” – https://tools.ietf.org/html/rfc6454#section-5.2These resources provide detailed guidance on CSRF mechanics and mitigation techniques, supporting the rationale above.
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.