By sending crafted HTTP requests and analyzing differences in response codes, headers, and behavior, the tester is matching server responses against known signatures to identify the underlying web server software and version. This is characteristic of server fingerprinting through banner-grabbing and response analysis.

Comprehensive and Detailed Explanation:
This is a classic example of social engineering. When a system is well-secured technically, attackers often turn to exploiting human vulnerabilities - such as:
Talking to employees and gaining their trust
Bribing disgruntled or low-level staff
Gaining physical access or insider information through manipulation
From CEH v13 Courseware:
Module 7: Social Engineering
Incorrect Options:
A: Zero-days are rare and expensive; not always feasible.
C: DDoS is disruptive, not data-oriented.
D: MiTM is a complex network-based attack, unlikely effective against a hardened internal mainframe.
Reference:CEH v13 Study Guide - Module 7: Psychological Approaches to Social EngineeringKevin Mitnick's "The Art of Deception" - Real-world examples of insider targeting

Application Flaws is the best classification because the root cause is a coding error in the application's input handling that results in a buffer overflow. In CEH-aligned vulnerability categorization, application flaws include implementation mistakes such as improper bounds checking, unsafe string handling, and inadequate input validation. The scenario explicitly states Lucas used fuzz testing against input validation logic and triggered a buffer overflow using malformed taxpayer ID strings, then observed unintended disclosure of payroll data due to unchecked data boundaries. Those details point to defective code behavior at runtime, not an administrative or configuration issue.
Poor Patch Management typically refers to failing to apply vendor patches or updates, leaving known vulnerabilities exploitable. The prompt does not indicate the issue was a previously known, patched defect that remained unpatched; instead, it describes a newly discovered weakness traced to an internal module and a
"coding oversight." Misconfigurations or weak configurations involve insecure settings such as overly permissive access controls, exposed services, default credentials, or insecure cloud storage policies. None of those are the trigger here; the trigger is malformed input causing memory corruption. Design Flaws relate to weaknesses in the system's architecture or security model, such as missing authorization logic, flawed trust boundaries, or insecure workflows. While poor design can contribute to impact, the specific vulnerability mechanism described is an implementation-level memory handling failure.
Therefore, the correct classification is Application Flaws, because the vulnerability is fundamentally an input- processing and bounds-checking defect in the application code that results in a buffer overflow and data exposure.

A Kerberoasting attack is a technique that exploits the Kerberos authentication protocol to obtain the password hash of a service account that has a Service Principal Name (SPN). An attacker can request a service ticket (TGS) for the SPN using a valid user's ticket (TGT) and then attempt to crack the password hash offline. To prevent the attacker from using the TGS to access the service, the system administrator should invalidate the TGS as soon as possible. This can be done by changing the password of the service account, which will generate a new password hash and render the old TGS useless. Alternatively, the system administrator can use tools like Mimikatz to purge the TGS from the memory of the domain controller or the client system. Performing a system reboot, deleting the compromised user's account, or changing the NTLM password hash used to encrypt the ST are not effective ways to invalidate the TGS, as they do not affect the encryption of the TGS or the validity of the TGT. References:
* EC-Council CEHv12 Courseware Module 11: Hacking Webservers, page 11-24
* What is a Kerberoasting Attack? - CrowdStrike
* How to Perform Kerberoasting Attacks: The Ultimate Guide - StationX

The activity involves retrieving and analyzing web service description files to enumerate available operations, parameters, and message structures. This is characteristic of WSDL probing, where attackers inspect WSDL definitions to map service functionality and discover hidden or undocumented methods before further exploitation.