An attacker extracts the initial bytes from an encrypted file container and uses a tool to iterate through numeric combinations. What type of cryptanalytic technique is being utilized?
Answer(s): C
Answer(s): C – Test every possible password through automationWhy C is correctThe attacker has only the initial bytes of the encrypted container, so they lack the key but can still try to recover the password that protects it. Brute-force (exhaustive-search) attacks automate iteration over a defined key-space (here, possible passwords) and test each candidate until the correct one is found. This matches the description “iterate through numeric combinations” that targets a password-derived key rather than the underlying encryption algorithm itself.Why the other options are unsuitableA: Force encryption key through quantum solving – Quantum-computing attacks are theoretical and not yet practical for password-derived keys; they involve exploiting quantum algorithms, not brute-forcing passwords. B. Seek identical digests across hash outputs – This describes a collision or rainbow-table lookup, which requires hash values to compare; the scenario involves an encrypted file, not hash comparison. D. Analyze output length to spot anomalies – Length analysis is used to infer properties of the plaintext or padding, not to recover a password by exhaustive enumeration.
CEH v13 Exam Blueprint – Brute-Force and Password-Cracking Techniques: https://www.eccouncil.org/ceh-certification/ceh-v13-exam-blueprint/ NIST Special Publication 800-115 – “Guidelines on Password Security” (describes exhaustive-search attacks): https://csrc.nist.gov/publications/detail/sp/800-115/final
During an internal red team engagement, a penetration tester is tasked with mapping the network topology of an organization with multiple segmented subnets. The tester initiates a series of traceroutes from a compromised host to various internal devices across these segments. Upon analyzing the output, the tester observes that a specific IP address, 10.10.10.1, consistently appears as the second-to-last hop before reaching several target systems located in different IP ranges. Despite varying final destination IPs, this intermediate address remains constant. No signs of DNS spoofing, ICMP anomalies, or host-level misconfigurations are present. What does this repeated hop pattern most likely indicate in the context of network architecture?
Answer(s): A
Technical JustificationThe traceroute results show a consistent second-to-last hop of 10.10.10.1 for diverse destination networks. Such an address is typical of a Layer 3 gateway or backbone router that interconnects multiple subnets; packets destined for any internal host must pass through it before reaching the final subnet. Because the hop remains the same regardless of the ultimate destination, it points to a core routing point , not an endpoint-specific issue (loopback misconfig, DNS poisoning, or a proxy).Why the other options are less appropriateB: Transparent proxy – Proxies operate at Layer 7 and forward traffic based on application criteria; their IPs would not appear uniformly as a fixed hop in ICMP Traceroute across unrelated subnets. C. Loopback misconfiguration – Loopback interfaces are host-local and would affect only traffic destined for the originating device, not a common intermediate hop for many separate subnets. D. DNS poisoning – DNS manipulation influences name resolution, not the path displayed by Traceroute; the hop address would still reflect the actual routing path.Conclusion The repeated hop is best explained by a core router that aggregates routing for multiple internal subnets (Option A).
Cisco Documentation – Understanding Traceroute and IP Routing: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_routing/15-mt/ipaddr-15-mt-book/traceroute.html RFC 1393 – TCP/IP Tutorial (ICMP extended features, including traceroute behavior): https://datatracker.ietf.org/doc/html/rfc1393
A penetration tester submits altered ciphertexts to a web server and pays close attention to how the server responds. When the server produces different error messages for certain inputs, the tester starts to infer which inputs result in valid internal processing. Which cryptanalytic method is being used in this scenario?
Answer(s): B
Correct option: B – Exploit padding error feedback to recover dataThe tester deliberately injects modified ciphertexts and observes the server’s error messages. Different error responses (e.g., “invalid padding” vs. “valid plaintext”) reveal whether the decryption routine accepted a particular padding block. This implicit feedback enables an attacker to iteratively adjust bytes of the ciphertext, test padding validity, and ultimately reconstruct the original plaintext—a classic padding-oracle attack. The attacker is not measuring timing, randomness, or performing random bit-flips; the core insight is that error messages serve as an oracle for padding correctness , allowing systematic recovery of data.Why the other options are less suitableA: Compare traffic timing – Timing can disclose secret information only when the server’s processing is deliberately made observable (e.g., speculative execution), not when the only observable is an error message. C. Flip bits randomly – Random bit flips do not produce systematic error patterns that can be leveraged to infer internal processing; they are ineffective for targeted ciphertext manipulation. D. Inspect randomness – Randomness analysis across sessions would require large samples and statistical modeling to detect leaks, but it does not provide the direct, per-message error feedback that drives a decryption attack.
NIST SP 800-38A – Modes of Operation – discusses padding standards and the security assumptions underlying padding validation. Bleichenbacher’s Padding Oracle Attack on RSA – classic example of exploiting padding error messages to recover plaintext.
A penetration tester is tasked with uncovering historical content from a company’s website, including previously exposed login portals or sensitive internal pages. Direct interaction with the live site is prohibited due to strict monitoring policies. To stay undetected, the tester decides to explore previously indexed snapshots of the organization’s web content saved by external sources. Which approach would most effectively support this passive information-gathering objective?
Technical JustificationOption A – cache: operatorAllows retrieval of Google’s cached copy of a page without sending a request to the target web server, ensuring the tester remains invisible to any monitoring or intrusion-detection rules. The cached version mirrors the exact HTML source that was indexed at the time of capture, providing historical content (e.g., old login portals) exactly as it appeared when originally indexed. Because the request runs through Google’s own servers, the tester can access the snapshot without direct interaction with the organization’s site, satisfying the “passive information-gathering” requirement.Option B – intitle: loginRelies on current Google index results that match the phrase “login” in page titles. This forces an active query to Google’s search engine and returns up-to-date results, which may trigger alerts on the site’s monitoring tools. The output focuses on current pages, not historical snapshots, and therefore does not meet the objective of retrieving already-exposed content.Option C – intext: “login” site:target.comSearches for occurrences of the literal string “login” within the indexed pages of the target domain. This still requires Google to query the live site’s domain and can surface real-time results that expose the tester’s intent. As with option B, it does not provide cached historical versions and may be logged by the site’s security controls.Option D – link: operatorLists pages that contain backlinks to the specified target. It does not guarantee that the linked pages are login portals and it performs an active lookup of backlink data, which can be detected by monitoring solutions. Additionally, many modern sites receive backlinks from numerous external sources, making the operator less reliable for locating specific historical internal pages.Hence, Option A is the most effective passive technique because it extracts historical, previously indexed snapshots through Google’s cached view without directly contacting the target site, thereby minimizing detection risk.
Cache operator – Google Search Help: https://support.google.com/websearch/answer/2466433 Advanced search operators – Google Search Help: https://support.google.com/websearch/answer/2462515
A penetration tester is tasked with compromising a company's wireless network, which uses WPA2-PSK encryption. The tester wants to capture the WPA2 handshake and crack the pre-shared key. What is the most appropriate approach to achieve this?
Answer(s): D
Technical JustificationOption D – De-authentication attack → handshake captureForces a wireless client to re-authenticate, generating a fresh WPA2 4-way handshake that can be saved. The captured handshake contains the necessary cryptographic elements (AES-GCMP/CCMP MIC, ANonce, SNonce) required for offline cracking tools (e.g., hashcat, aircrack-ng) to perform dictionary or rule-based PSK recovery. This method is widely accepted in penetration-testing methodology because it does not require compromising the AP itself; it merely exploits the normal re-authentication flow defined by the 802.11 standard.Why Option A is unsuitableDirect brute-forcing of WPA2-PSK on the air is impractical; the protocol uses a 256-bit PRF and each guess requires a full 4-way handshake, dramatically increasing computational cost. Without first obtaining a valid handshake, the attacker cannot verify guesses, making exhaustive key search infeasible in a short engagement.Why Option B is irrelevantCross-Site Scripting targets web-application input vectors and can affect a router’s admin interface only if a vulnerable web service is exposed. The question focuses on compromising the wireless encryption itself, not on compromising a management web portal; XSS would not yield a WPA2 handshake or reveal the PSK.Why Option C is less appropriateA Man-in-the-Middle (MITM) attack that spoofs the router’s MAC address would require positioning the tester between clients and the AP and maintaining transparent traffic flow. While MITM can be used for packet injection or traffic sniffing, it does not directly provide the WPA2 handshake needed for offline PSK cracking and is more complex than the simple de-auth technique that reliably forces a reconnection.Conclusion The de-authentication attack followed by handshake capture (Option D) is the most efficient, standard-aligned method for obtaining the data required to mount an offline dictionary attack on WPA2-PSK, aligning with industry best practices for legitimate penetration testing.References 1. Aircrack-NG Suite – How to Capture a WPA/WPA2 Handshake: https://aircrack-ng.org/doku.php? id=capture_handshake 2. Cisco Security – Understanding WPA2 and De-authentication Attacks: https://www.cisco.com/c/en/us/support/docs/security/security-framework/79788-understanding-wpa2-encryption-protocols.html
A penetration tester evaluates a company’s susceptibility to advanced social engineering attacks targeting its executive team. Using detailed knowledge of recent financial audits and ongoing projects, the tester crafts a highly credible pretext to deceive executives into revealing their network credentials. What is the most effective social engineering technique the tester should employ to obtain the necessary credentials without raising suspicion?
Technical JustificationSpear-phishing with audit-specific context (Option D) is the most effective because it exploits targeted social engineering: the attacker leverages in-depth knowledge of recent financial audits and ongoing projects, thereby crafting an email that mirrors the executive’s real-world workload. This creates a high-credibility pretext, reduces the likelihood of suspicion, and directly requests credential verification as part of a believable routine. Option A (mass phishing) lacks personalization; generic “financial report” links are easily filtered and do not align with the executive’s specific responsibilities, making them more likely to be flagged or ignored. Option B (phone call as external auditor) can be effective but introduces an additional interaction channel that may trigger verification protocols, require scripted dialogue, and is prone to detection by security awareness controls on inbound calls. Option C (fake CFO email) is plausible but usually less convincing when it does not reference concrete audit details; without that contextual specificity, senior executives may question the email’s authenticity, especially if it requests urgent credential verification.Consequently, Option D uniquely combines personalization, contextual relevance, and direct credential solicitation, matching the tactical requirements of a penetration tester seeking minimal suspicion.
CEH v13 Curriculum – Social Engineering Module: https://www.eccouncil.org/ceh-certification/ceh-v13-curriculum/ SANS Institute – “Spear Phishing Attacks and Defenses” white paper: https://www.sans.org/white-papers/387/Spear-Phishing-Attacks-and-Defenses/
While conducting a covert penetration test on a UNIX-based infrastructure, the tester decides to bypass intrusion detection systems by sending specially crafted TCP packets with an unusual set of flags enabled. These packets do not initiate or complete any TCP handshake. During the scan, the tester notices that when certain ports are probed, there is no response from the target, but for others, a TCP RST (reset) packet is received. The tester notes that this behavior consistently aligns with open and closed ports, respectively, without triggering detection systems configured to monitor connection-based scans. Based on these observations, which scanning technique is most likely being used?
Correct Answer: C – FIN scan using stealthy flag combinationsA FIN scan sends packets with only the FIN (and optionally other non-SYN flags) set, leaving the TCP state unknown to the target. Because no three-way handshake is performed, the probe does not generate the typical SYN-ACK or RST responses that IDS/IPS would flag for connection-oriented scans. When the port is open , the target replies with a RST packet (per RFC 793); no response indicates a closed port. This “silent” behavior allows the tester to map open/closed ports while evading detection rules that watch for SYN or ACK traffic. The observed pattern—RST on closed ports, no reply on open ports—matches exactly the signature of a stealthy FIN (or NULL/XMAS) scan , which exploits the quirks of RFC 793 flag handling and most intrusion-prevention filters that focus on connection-oriented traffic.Why the other options are less appropriateA: Xmas scan leveraging RFC 793 quirks – A true Xmas scan flips FIN, URG, and PSH flags simultaneously. The question only describes a special set of flags that trigger a RST on closed ports; nothing about URG/PSH is mentioned, and Xmas scans are not the only technique that produces the described behavior. B. ACK flag scan to evaluate firewall behavior – ACK scans are used to test firewall filtering (stateful vs. stateless), not to enumerate open ports. An ACK probe that receives a RST does not indicate “open,” and ACK packets typically elicit no response from closed ports; the observed RST-only pattern does not align with typical ACK functionality. D. TCP Connect scan to complete the three-way handshake – A Connect scan intentionally performs a full SYN-SYN/ACK-ACK handshake, generating explicit SYN packets that are easily detected by IDS/IPS. The question explicitly states that no handshake occurs and that detection systems do not fire, which contradicts the nature of a TCP Connect scan.
RFC 793 – Transmission Control Protocol (TCP). Nmap Network Scanning, Chapter 4 – “Stealthy Scanning Techniques,” https://nmap.org/book/stealth-scanning.htmlThese sources describe the mechanics of FIN and other non-SYN scans and how they generate RST on closed ports without completing a handshake.
An ethical hacker needs to gather sensitive information about a company’s internal network without engaging directly with the organization's systems to avoid detection. Which method should be employed to obtain this information discreetly?
Correct answer: B – Analyze the organization’s job postings for technical detailsJob postings often disclose the technologies, platforms, and security tools the company uses, giving an ethical hacker insight into the internal network architecture without any direct interaction. This technique falls under open-source intelligence (OSINT) and is specifically designed to avoid detection because it involves only publicly available information.Why the other options are less suitableA – Exploit a public vulnerability in the company’s web server – Requires actively compromising a system, which can trigger alerts and is not discreet. C – Perform a WHOIS lookup on the company’s domain registrar – Only reveals registration data (registrant, dates, name servers) and does not provide substantive details about the internal network. D – Use port scanning tools to probe the company’s firewall – Involves direct network probing that can be logged by security monitoring solutions, making it a noisy and detectable activity.
EC-Council CEH v13 Certification Overview – https://www.eccouncil.org/ceh-certification/ CEH v13 Exam Objectives – https://www.eccouncil.org/ceh/v13/objectives/
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.