You are attempting to map out the firewall policy for an organization. You discover your target system is one hop beyond the firewall. Using hping2, you send SYN packets with the exact TTL of the target system starting at port 1 and going up to port 1024. What is this process known as?
Answer(s): B
Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker’s host to a destination host through a packet-filtering device. This technique can be used to map ‘open’ or ‘pass through’ ports on a gateway. More over, it can determine whether packets with various control information can pass through a given gateway.
Joe the Hacker breaks into company’s Linux system and plants a wiretap program in order to sniff passwords and user accounts off the wire. The wiretap program is embedded as a Trojan horse in one of the network utilities. Joe is worried that network administrator might detect the wiretap program by querying the interfaces to see if they are running in promiscuous mode.Running “ifconfig –a” will produce the following:# ifconfig –a1o0: flags=848<UP, LOOPBACK, RUNNING, MULTICAST> mtu 8232inet 127.0.0.1 netmask ff000000hme0:flags=863<UP, BROADCAST, NOTRAILERS, RUNNING, PROMISC, MULTICAST> mtu1500inet 192.0.2.99 netmask ffffff00 broadcast 134.5.2.255 ether8:0:20:9c:a2:35What can Joe do to hide the wiretap program from being detected by ifconfig command?
Answer(s): C
The normal way to hide these rogue programs running on systems is the use crafted commands like ifconfig and ls.
SNMP is a protocol used to query hosts, servers, and devices about performance or health status data. This protocol has long been used by hackers to gather great amount of information about remote hosts. Which of the following features makes this possible? (Choose two)
Answer(s): B,C
Simple Network Management Protocol (SNMP) is a protocol which can be used by administrators to remotely manage a computer or network device. There are typically 2 modes of remote SNMP monitoring. These modes are roughly 'READ' and 'WRITE' (or PUBLIC and PRIVATE). If an attacker is able to guess a PUBLIC community string, they would be able to read SNMP data (depending on which MIBs are installed) from the remote device. This information might include system time, IP addresses, interfaces, processes running, etc. Version 1 of SNMP has been criticized for its poor security. Authentication of clients is performed only by a "community string", in effect a type of password, which is transmitted in cleartext.
Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weaknesses and key loggers.Which of the following options best represents the means that Bob can adopt to retrieve passwords from his clients hosts and servers.
Answer(s): A
Different types of keylogger planted into the environment would retrieve the passwords for Bob..
ExhibitJoe Hacker runs the hping2 hacking tool to predict the target host’s sequence numbers in one of the hacking session.What does the first and second column mean? Select two.
Answer(s): A,B
Post your Comments and Discuss EC-Council EC0-350 exam prep with other Community members: