A security researcher is analyzing a target organization’s publicly accessible cloud infrastructure. While reviewing the website’s HTML source code, the researcher discovers direct references to files hosted on Amazon S3. What is the most effective way to identify additional publicly accessible bucket URLs used by the target?
Answer(s): D
JustificationOption D – Use Google advanced search operators to enumerate S3 bucket URLs This is the most effective method because attackers often expose bucket names in public-facing HTML, configuration files, or API responses. By crafting targeted Google dorks (e.g., site:.com intitle:"index of" "2025"or bucketlist.txt patterns) the researcher can discover additional bucket endpoints without accessing internal systems. Google indexes publicly reachable URLs, allowing rapid enumeration of exposed S3 resources and revealing mis-configured buckets that may be leveraged for data leakage or further exploitation.Option A – Use SQL injection to extract internal file paths SQL injection only works against vulnerable input fields that query a database. It does not help locate publicly hosted S3 URLs, which are external resources. Moreover, performing injection on a production environment can trigger alarms and cause legal/ethical issues.Option B – Exploit XSS to force the page to reveal the S3 links While XSS can inject malicious scripts that read DOM elements, it requires that the target page reflect user-controlled content and that the script be able to access the needed data. This approach is unreliable for systematically enumerating all S3 bucket URLs and adds unnecessary complexity compared to a simple search query.Option C – Perform packet sniffing to intercept internal S3 bucket names S3 bucket names are part of the request host header; they travel over the internet via HTTPS. Unless the traffic is unencrypted, sniffing a network segment that contains the target’s traffic is impractical and often illegal. It also cannot reliably discover hidden or authenticated buckets that are not exposed through URLs.Therefore, the correct and most efficient technique is to leverage public search engines with advanced operators to map out publicly accessible S3 buckets.
Google Advanced Search Operators documentation: https://support.google.com/websearch/answer/2466433 AWS S3 Public Buckets Best Practices & Detection: https://docs.aws.amazon.com/AmazonS3/latest/userguide/locating-your-buckets.html
During a security assessment, a consultant investigates how the application handles requests from authenticated users. They discover that once a user logs in, the application does not verify the origin of subsequent requests. To exploit this, the consultant creates a web page containing a malicious form that submits a funds transfer request to the application. A logged-in user, believing the page is part of a promotional campaign, fills out the form and submits it. The application processes the request successfully without any reauthentication or user confirmation, completing the transaction under the victim’s session. Which session hijacking technique is being used in this scenario?
Answer(s): C
Correct answer: C – Cross-Site Request Forgery (CSRF)Why C is the best fitThe vulnerability stems from the application’s failure to validate the origin of authenticated requests. An attacker can cause a user’s browser to submit a forged HTTP request (a “bank-transfer” form) while the user’s valid session cookie is automatically included. Because the server does not require any additional user verification (no re-authentication, no CSRF token), the request is processed as if it came from the legitimate user, resulting in an unauthorized transaction. This matches the classic CSRF definition: an authenticated user is tricked into performing state-changing actions on behalf of the attacker without their explicit consent.Why the other options are less appropriateA – Session fixation : The scenario does not involve the attacker forcing a known session ID onto the victim; the session is already active. B – Cross-site scripting (XSS) : No malicious script is executed in the victim’s browser; the attack merely submits a forged request, making XSS irrelevant. D – Session replay : Replay attacks involve re-sending a captured legitimate request. Here the request is newly constructed by the attacker, not a captured one.Key technical pointsAbsence of anti-CSRF measures (e.g., synchronizer token, double-submit cookie). Use of the victim’s existing authentication cookie to make the server treat the forged request as legitimate. The attack exploits the trust relationship between the browser and the server, not the integrity of the session identifier itself.
OWASP CSRF Prevention Cheat Sheet – https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html RFC 7231 – https://tools.ietf.org/html/rfc7231 (section on HTTP authentication and request semantics)
A penetration tester is testing a web application’s product search feature, which takes user input and queries the database. The tester suspects the input is not properly sanitized. What is the best approach to confirm the presence of SQL injection?
Technical JustificationOption C – “Enter 1’ OR ‘1’=‘1’ to check if all products are returned.”This is the classic Boolean-based SQL injection payload that tests whether the application’s search routine reflects unsanitized input directly in the query. If the returned result set contains all products (or an unexpectedly large set), it confirms that the input is being concatenated insecurely into the SQL statement, allowing the attacker to manipulate the logical evaluation of the query. The payload does not alter the database state, making it safe for discovery while still providing a clear indicator of injection susceptibility.Why Option A is unsuitable; DROP TABLE products; -- attempts a state-changing command . While it could demonstrate that the application is vulnerable, it poses a high risk of data loss and is generally prohibited in controlled testing environments. Moreover, many modern DBMSs guard against dropping tables via application-level permissions, making the payload unreliable for confirming only injection; it could also be blocked by WAFs or input filters.Why Option B is unsuitableInjecting a script such as <script>alert(1)</script> tests for Cross-Site Scripting (XSS) , not SQL injection. If the application reflects the payload without proper encoding, the tester would observe client-side script execution, but this does not verify that the underlying query is vulnerable to SQL manipulation.Why Option D is unsuitableDirectory traversal payloads ( ../ , ../../ ) aim to access the file system on the server. This technique is irrelevant to verifying SQL injection in a database query and may trigger separate security controls (e.g., file-access restrictions) unrelated to the injection vulnerability.Conclusion Option C provides a low-impact, repeatable, and logically definitive test for SQL injection by observing the application’s response to a crafted Boolean condition. It isolates the vulnerability without causing side effects, aligning with best practices for penetration testing and exam-style questions.
OWASP SQL Injection Prevention Cheat Sheet – https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html EC-Council Certified Ethical Hacker (CEH) v13 Official Courseware – https://www.eccouncil.org/ceh-certification/ (accessed 2025)
A penetration tester is tasked with mapping an organization’s network while avoiding detection by sophisticated intrusion detection systems (IDS). The organization employs advanced IDS capable of recognizing common scanning patterns. Which scanning technique should the tester use to effectively discover live hosts and open ports without triggering the IDS?
Answer(s): A
Technical JustificationIdle (Zombie) Scan (Option A) – This technique uses a third-party “zombie” host with predictable IP ID increment behavior. The scanner sends idle probes that only the zombie can predictably respond to, allowing the tester to discover live hosts and open ports without establishing a direct connection to the target. Because the traffic never originates from the tester’s IP and appears as innocuous IP ID changes, IDS/IPS signatures that detect typical scan patterns (e.g., SYN, ACK, FIN, Connect) are evaded. It therefore offers the highest stealth for detecting hosts and ports under sophisticated IDS monitoring.TCP Connect Scan (Option B) – This scan completes the TCP three-way handshake to each port, leaving a full connection state on both the scanner and the target. The presence of SYN-ACK/ACK exchanges and the final ACK makes the traffic highly detectable by IDS signatures that look for repeated SYN/ACK or full TCP handshakes. Consequently, it is less suitable for covert enumeration.ICMP Echo Scan (Option C) – Pinging devices with ICMP Echo Requests is commonly blocked or rate-limited by firewalls and IDS. Even when successful, it only confirms the presence of a host; it provides no insight into open ports. IDS typically flag repeated ICMP traffic as scanning activity, reducing its stealth value.FIN Scan (Option D) – Sending TCP packets with the FIN flag can bypass some stateful inspection, but modern IDS/IPS readily detect FIN scans as part of known evasion techniques. Moreover, many services silently drop FIN packets or send RST replies, limiting the ability to reliably identify open ports, and the scan can still generate detectable patterns if repeated in a predictable manner.Conclusion – An Idle scan leveraging a third-party zombie host is the most effective method for covert host and port discovery while avoiding detection by advanced IDS because it operates indirectly, uses predictable IP ID behavior, and leaves minimal footprint on the target network.
1. Nmap Network Scanning, Chapter 3 – Idle Scan: https://nmap.org/book/advanced-technique/idlescan.html 2. US-CERT – “Scanning Techniques and Countermeasures”: https://www.us-cert.gov/ncas/alerts/2014/01/09/scanning-techniques-and-countermeasures
During a black-box internal penetration test, a security analyst is tasked with identifying potentially exploitable services running on an SNMP-enabled Linux server. The target organization uses SNMPv2, and the default community string “public” has not been changed. The analyst confirms that UDP port 161 is open and accessible. To gather service-related intelligence for privilege escalation or lateral movement, the analyst decides to enumerate all running processes on the host. Which Nmap command would most effectively retrieve the required information?
Why option A is the correct choiceTarget: UDP port 161 is the standard SNMP agent port; a black-box internal scan must use UDP to query it. Script requirement: To retrieve a list of running processes on the remote host, Nmap must invoke the snmp-processes script. This script specifically queries the SNMP hrDeviceTable / hrRunningPerf MIBs that contain process-related information and returns a parsed inventory of processes. Command syntax:-sU → forces UDP scanning for the SNMP service.-p 161 → limits the probe to the SNMP agent port.--script snmp-processes → loads the appropriate script that performs the process enumeration.Result: The output will include process IDs, executable names, and command-line arguments, providing the intelligence needed for privilege escalation or lateral movement.Why the other options are unsuitableB: snmp-win32-services – This script enumerates Windows services on a Windows host; it does not gather process information and is irrelevant on a Linux target. C. snmp-interfaces – Focuses on interface statistics (e.g., ipAdressTable, ifTable). It reveals network configuration but not the list of running processes. D. snmp-sysdescr – Only returns the generic system description string (OS type, version, vendor). It contains no actionable process data and cannot be used for enumeration.Therefore, Option A uniquely combines UDP targeting of port 161 with the snmp-processes script, which directly yields the required process-level intelligence.
Nmap Scripting Engine – snmp-processes script: https://nmap.org/nsedoc/scripts/snmp-processes.htmlOfficial SNMP documentation (process enumeration via HOST-RESOURCES-MIB): https://www.ibr.cs.tu-bs.de-services/ssi/handbook/mibs/HOST-RESOURCES-MIB.html
A penetration tester is tasked with scanning a network protected by an IDS and firewall that actively blocks connection attempts on non-standard ports. The tester needs to gather information on the target system without triggering alarms. Which technique should the tester use to evade detection?
Answer(s): B
Answer(s): BTCP ACK scan – Sends ACK packets to probe whether a port is filtered or unfiltered by the firewall, allowing stealthy mapping without completing a connection. Fragmented packet scan – Splits TCP/IP headers across multiple packets to evade signature-based IDS detection while still reaching the target. Low-and-slow scan – Sends a limited number of probes per minute and randomizes timing to stay below detection thresholds of traffic-volume monitors.Technical justification for B vs. other options TCP ACK scan exploits the fact that firewalls often allow ACK packets regardless of port state, enabling the tester to infer filtered versus unfiltered ports without completing three-way handshakes. A full TCP Connect scan would require opening new connections on non-standard ports, which the IDS/Firewall would drop and alert on. A SYN flood attack is noisy and would definitely trigger alarms, defeating the stealth objective. While a low-and-slow scan reduces volume, it does not inherently bypass the IDS filtering of non-standard ports; the ACK scan directly maps firewall rules and avoids connection attempts altogether, making it the most suitable evasion technique.
1. [Nmap User Manual – TCP ACK Scan]( https://nmap.org/book/man-html/ tcp-ack.html) 2. SANS Penetration Testing Best Practices – Evasion Techniques
During a red team engagement simulating a targeted attack on a smart office environment, an ethical hacker identifies a thermostat used for regulating temperature across multiple floors. While analyzing its firmware management process, the tester discovers that the device accepts older versions without verifying their integrity or authenticity. The attacker successfully loads a previously deprecated firmware that contains known vulnerabilities and gains unauthorized access to the broader network by exploiting reintroduced flaws. No mechanisms are in place to prevent version rollback or verify firmware trustworthiness. Which IoT security issue is most accurately demonstrated in this scenario?
Correct option: A – Lack of secure update mechanismsWhy A is correct The thermostat permits loading older, already-deprecated firmware without any integrity- or authenticity-check. In a properly secured IoT device, update mechanisms must enforce version control,cryptographic verification (e.g., signed packages), and rollback protection to prevent hostile or vulnerable firmware from re-introducing known vulnerabilities. The scenario explicitly describes the absence of these controls, which is a textbook case of an insecure update/upgrade process.Why the other options are less suitableB: Denial-of-service through physical tampering – The attack described involves code injection and network pivoting, not physical destruction or service disruption. C. Insecure network service exposure – While the thermostat is network-connected, the core issue is not the exposure of a service port but the insecure handling of firmware updates. D. Use of insecure third-party components – The vulnerability stems from the update mechanism itself, not from an external library or hardware component supplied by a third party.
NIST Special Publication 800-183 – Guide to Securing the Internet of Things (Section 4.3: Secure Firmware Updates). https://csrc.nist.gov/publications/detail/sp/800-183/final OWASP Internet of Things Project – Top 10 IoT Vulnerabilities (Item 7: Insecure Firmware). https://owasp.org/www-project-internet-of-things/Prepared for CEHv13 certification review – concise, technically precise justification.
During a security assessment of a company’s internal web application, a penetration tester examines how the application processes input values passed in the web address query string. The application includes a feature that dynamically fetches documents based on a filename value provided in the web address (e.g., https://intranet.example.com/view?file=report.txt). By altering this input to include sequences like ../../../../etc/passwd, the tester successfully navigates beyond the intended storage location and accesses restricted files. Further manipulation reveals access to sensitive configuration files, source code, and internal scripts, confirming that the application lacks proper input sanitization and isolation of file access paths. Which attack method does this scenario illustrate?
Attack Method: Directory Traversal (Path Traversal) via URL Parameter ManipulationTechnical Justification The tester exploits the application’s failure to validate and sanitize the file parameter in the query string,allowing absolute or relative path sequences such as ../../../../etc/passwd to be interpreted by the backend file-reading routine. Because the code concatenates the supplied value directly with a base directory without imposing a whitelist, the resulting resolved path can escape the intended repository and point to arbitrary files on the server’s filesystem. This technique enables unauthenticated read access to privileged files (e.g., /etc/passwd , configuration files, source code), directly violating the principle of least privilege and exposing sensitive data.Why Option D Is CorrectDirectory traversal precisely describes the use of ../ sequences within a URL to ascend directory structures and retrieve files outside the intended scope. It aligns with the scenario’s description of “altering this input to include sequences like ../../../../etc/passwd” to gain unauthorized file access.Why Other Options Are Not FittingA – Brute-force attack on admin credentials involves systematic password guessing; the described activity does not target authentication mechanisms. B – Buffer-overflow exploitation concerns overflowing fixed-size buffers in memory, typically triggered by malformed request headers or bodies, which is unrelated to path manipulation in a query string. C – Cross-Site Scripting (XSS) injects client-side script into web pages to hijack user sessions or rewrite page content; the scenario involves server-side file access, not script injection into rendered HTML.
OWASP Top 10 – A04:2021 – Insecure Design (covers lack of proper input validation leading to attacks like directory traversal). NIST SP 800-53 Rev. 5 – AC-6 Least Privilege (principles that underpin controlling file access and preventing unauthorized reads).
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.