ECCouncil 312-50v13 - Certified Ethical Hacker Exam (CEH v13 AI)

The correct answer is B. Repackaging Legitimate Apps after modifying their internal structure.

The scenario states that the application looks and behaves like the legitimate rewards app, but binary comparison shows structural differences and sandbox monitoring reveals unauthorized outbound connections. This means the original legitimate application was modified and redistributed through an unofficial marketplace.

CEH mobile social engineering material defines repackaging legitimate apps as an attack where the attacker downloads a legitimate application, modifies it to contain malware, and uploads the repackaged version to a third-party app store for users to download . Another CEH reference explains that repackaged applications may be distributed through third-party stores and can send credentials or other data to an attacker-controlled server .

Option A. SMiShing is incorrect because no fraudulent SMS message is involved.

Option C. Fake Security Applications is incorrect because the app is not pretending to be a security tool.

Option D. Publishing Malicious Apps is close, but that usually refers to creating a malicious app that merely imitates a trusted brand. The binary comparison confirms this is a modified version of the legitimate app, making repackaging more accurate.

Therefore, the best answer is B. Repackaging Legitimate Apps after modifying their internal structure.

The capability described—administrators instantly provisioning servers, storage, and compute through a web portal without needing the provider to manually intervene—is the NIST cloud characteristic called on-demand self-service. In NIST’s cloud computing model, on-demand self-service means a consumer can unilaterally provision computing capabilities (such as server time and network storage) as needed automatically, without requiring human interaction with each service provider.

The scenario explicitly highlights that the admins can scale resources “instantly” through a dashboard and that there is “no manual involvement from the cloud provider.” That is exactly what on-demand self-service captures: rapid provisioning driven by the customer through automated orchestration and APIs/portals.

Why the other options are not the best match:

Broad network access (D) means cloud capabilities are available over the network and accessed through standard mechanisms by heterogeneous platforms (mobile, laptops, workstations). While the dashboard is accessed over the network, broad access is about reachability and standard access mechanisms, not the self-provisioning behavior.

Resource pooling (C) refers to the provider’s multi-tenant model where physical/virtual resources are pooled and dynamically assigned; it explains how the provider can offer elasticity, but the user-facing “provision it yourself” aspect is on-demand self-service.

Measured service (B) refers to metering and monitoring resource usage for billing/optimization; it doesn’t explain instant self-provisioning.

Therefore, the characteristic is A. On-demand self-service.

CEH v13 states that vulnerabilities with a CVSS score ≥ 9.0 are critical and require immediate containment. When remote code execution is possible, the system may already be compromised.

The recommended response is to isolate the affected system, preventing lateral movement, then perform a forensic audit before applying patches. Immediate patching without isolation may alert attackers or destroy evidence.

Thus, option D aligns with CEH incident response best practices.

The correct answer is C. To Conceal the Origin of Reconnaissance Activity and Reduce Attribution Risk.

The tester is routing reconnaissance traffic through an intermediary external system so that monitoring logs show the intermediary as the apparent source. The primary objective is operational concealment: making it harder for defenders to attribute the activity to the tester’s real machine, organization, or location.

CEH-aligned firewall-evasion material describes bypassing through external systems and related techniques used to make traffic appear to come from another host or pathway rather than the original source .

Option A is incorrect because routing reconnaissance through an intermediary does not by itself establish persistence inside the target network.

Option B is incorrect because the scenario does not describe bypassing application authentication controls.

Option D is incorrect because IP spoofing changes source IP information at the packet level, while the scenario describes routing through an intermediary system that actually forwards the traffic.

Option C is correct because the intermediary system is used to hide the true origin of reconnaissance activity.

Therefore, the best answer is C. To Conceal the Origin of Reconnaissance Activity and Reduce Attribution Risk.

The behavior described—manipulating request parameters so the application retrieves and exposes files from the server’s local directories—is characteristic of Local File Inclusion (LFI). LFI occurs when an application uses user-controllable input to construct a file path (often for templates, language files, includes, or uploads) and fails to properly validate or constrain it. An attacker can then supply values such as relative path traversal sequences to force the application to access unintended local resources, leading to disclosure of sensitive files (configuration files, credentials, keys, environment files) and sometimes further impact depending on context.

In the scenario, Sophia is testing a “template upload feature,” then “modifying the input parameters in an upload request” to “trick the application into retrieving sensitive files from the server’s local directories,” allowing her to view internal configuration files. That is a textbook LFI outcome: unauthorized read access to local files through a web interface, caused by improper input validation and insecure file path handling.

Why the other options are less accurate:

Insecure deserialization (A) involves unsafe processing of serialized objects, often leading to remote code execution; it is not about retrieving local files via path manipulation.

Cookie poisoning (B) is tampering with cookie values to escalate privileges or alter application behavior; it does not inherently explain local file retrieval.

File injection (C) is a broader term and can refer to multiple file-related abuses, but the specific pattern of including or reading local files via parameters is most precisely labeled Local File Inclusion.

Therefore, the correct answer is D. Local File Inclusion.

The correct answer is D. Obtain written permission to hack. In CEH methodology, the ethical difference between a hacker and an ethical hacker is authorization. Before any testing, scanning, exploitation, or information gathering begins, the ethical hacker must have written approval from the system owner. The CEH-aligned penetration testing lifecycle places rules of engagement, customer requirements, scope definition, legal agreements, contracts, and NDAs in the pre-attack or preparation phase before active testing begins. Written permission defines what systems may be tested, which techniques are allowed, when testing may occur, who must be notified, and what liability protections apply. Verbal permission is not sufficient because it is difficult to prove and may not clearly define legal boundaries. Hacking the web server before permission would be unauthorized activity, and gathering target information before approval may also violate scope and legal requirements. Therefore, the most important pre-assessment action is to obtain written authorization. CEH exam guidance also emphasizes that an ethical hacker always obtains written permission before testing.

Directory Traversal, also called path traversal, is a web attack in which an attacker manipulates file path input so the server accesses files outside the intended web directory. In CEH guidance on web application attacks, this commonly happens when an application builds a file path from user-controlled input such as a URL parameter that indicates a filename, folder, language pack, template, or download resource. If the server does not properly validate and normalize the supplied path, an attacker can inject traversal sequences such as dot-dot-slash patterns or encoded equivalents to move up directories and retrieve sensitive files.

The scenario describes Ethan changing URL parameters and receiving “data from areas of the system that should be restricted,” specifically “configuration files not intended for public access.” That is the hallmark outcome of directory traversal: unauthorized read access to files like application configs, environment settings, keys, or server configuration that can later enable deeper compromise. This is not password cracking because no credential guessing or authentication attack is involved. It is not web cache poisoning, which targets shared caching infrastructure to serve poisoned content to other users. It is not HTTP response splitting, which relies on injecting CRLF characters to manipulate response headers and potentially cause caching or XSS side effects.

CEH-aligned remediation focuses on strict allowlisting of permitted file resources, canonicalizing paths before access, rejecting traversal tokens and their encoded forms, using indirect object references instead of raw file paths, and enforcing least-privilege permissions so sensitive configuration files are not web-accessible even if a validation mistake occurs.

The best answer is D. Insecure routing protocols because the scenario describes legacy neighbor-to-neighbor device communications that lack encryption and integrity validation, allowing operational routing data to be exchanged without verification. In CEH-aligned network hacking concepts, this is a classic weakness of older or improperly secured routing protocols (and related network control-plane exchanges) where routers trust updates from neighbors and do not cryptographically validate the authenticity and integrity of routing information.

When routing updates are accepted without strong verification, an attacker who can position themselves on the same segment (or spoof a trusted neighbor) may inject or manipulate routing information. This can enable attacks such as route injection, route poisoning, man-in-the-middle (MITM) traffic redirection, blackholing traffic, or causing instability/denial of service by continuously advertising bad routes. The mention of “neighboring systems” and “operational data” strongly maps to routing adjacencies where devices exchange reachability and topology information. The absence of integrity checks makes it feasible to alter routing messages in transit or forge them, and the absence of encryption can expose routing details that further assists reconnaissance and targeted manipulation.

Why the other options are less accurate:

Firewall vulnerabilities relate to filtering and policy enforcement, but the core issue here is the trust model and protection of routing/control messages, not firewall rule flaws.

Lack of password protection is too generic and typically refers to weak/no credentials on management access, not unauthenticated routing exchanges.

Lack of authentication is conceptually related, but the question asks for the type of vulnerability most clearly present given “legacy communication mechanisms” between neighbors carrying operational data—this is most specifically categorized in CEH terms as insecure routing protocols (i.e., routing updates lacking authentication/integrity and sometimes encryption).

In practice, organizations mitigate this by enabling routing protocol authentication (where supported), using cryptographic integrity protections, restricting routing adjacencies, and segmenting or filtering routing/control-plane traffic to trusted peers only.

CEH v13 highlights HTML smuggling as a modern technique used to bypass perimeter defenses by leveraging browser-side execution. Instead of downloading a malware file directly—which firewalls and IDS can detect—an attacker embeds obfuscated JavaScript or HTML within an attachment. When the victim opens the file, the browser reconstructs the payload locally using APIs like Blob or URL.createObjectURL. This method avoids external network transfers during the payload creation stage, allowing it to bypass content filters, sandboxing, and inline inspection tools. CEH emphasizes that HTML smuggling is especially dangerous because it operates within the browser environment, which security appliances implicitly trust. Port forwarding (Option B) relates to tunneling traffic, not file reconstruction. XSS (Option C) requires injecting scripts into web pages, not delivering malware. HTTP header spoofing (Option D) manipulates request metadata, not payload construction. Therefore, HTML smuggling precisely matches the described behavior.

This question relates to Malware Analysis, specifically PDF-based malware, as covered in the CEH v13 Malware Threats module. The presence of /JavaScript and /OpenAction keywords identified by pdfid strongly indicates potentially malicious behavior triggered when the PDF is opened.

CEH v13 recommends static analysis of PDF stream objects as the next step to understand embedded malicious logic. Tools such as PDFStreamDumper allow analysts to extract, decompress, and inspect object streams within a PDF file, revealing obfuscated JavaScript code or exploit payloads.

The /OpenAction keyword indicates that the embedded JavaScript executes automatically when the document is opened, a common technique used in PDF-based attacks to exploit reader vulnerabilities or download secondary payloads.

Other options are insufficient:

VirusTotal provides detection results but not behavioral insight.

PE Explorer is irrelevant because PDFs are not Portable Executable files.

Hashing only helps identify known malware, not analyze behavior.

CEH v13 emphasizes manual inspection of embedded scripts to determine intent, making PDFStreamDumper the correct next step.

CEH teaches that insufficient input validation on mobile applications enables code injection attacks. Injecting JavaScript or crafted payloads into fields validates whether the application improperly processes untrusted data. If executed, it confirms that the app is vulnerable to injection-based attacks.

The IT team’s action—capping how many requests a single user can make per second and then delaying or dropping aggressive connections—is the defining behavior of rate limiting. In DDoS conditions, especially when the portal is under a surge of automated or abusive traffic, rate limiting enforces a policy that restricts request frequency from a source (such as an IP address, session, API key, or user identifier). This helps preserve availability by preventing any one client (or a small set of clients) from consuming a disproportionate share of application and infrastructure resources.

The key wording in the scenario is that “aggressive connections are delayed or dropped while most legitimate customers continue to use the service.” Rate limiting is designed for precisely this outcome: it introduces friction for abusive traffic patterns while allowing typical user behavior through. Depending on implementation, controls can respond with delays (throttling), temporary blocks, connection resets, or HTTP error responses (for example, “too many requests”) when limits are exceeded. This is commonly applied at the edge (reverse proxy/CDN), load balancer, WAF, or application gateway to reduce pressure on backend services.

Why the other options are not the best match:

Shutting Down Services (B) is an extreme measure that sacrifices availability to stop an attack; the scenario explicitly states service largely continues.

Absorb the Attack (C) refers to scaling capacity or using scrubbing centers/CDNs to handle volume without necessarily restricting individual requester behavior; the described control is specifically per-user request caps.

Degrading Services (D) generally means intentionally reducing functionality or quality (e.g., disabling non-essential features) to keep core services alive; here, the main technique is enforcing request-rate thresholds.

Thus, the countermeasure strategy being used is A. Rate Limiting.

The correct answer is D because world-writable cron directories allow unauthorized users or attackers to add or modify scheduled tasks. In Linux, cron is used to run commands or scripts automatically at defined times, and CEH-aligned material identifies crontab as the mechanism for listing scheduled jobs/tasks. If cron directories are writable by everyone, an attacker can place a malicious script or cron entry that repeatedly runs after compromise, after login, or after reboot. This supports the CEH system-hacking phase of maintaining access, also called persistence. The uploaded red-team reference specifically associates Linux “permanent access” with cron-based scheduled execution. Linux permissions are based on read, write, and execute rights, and overly permissive settings such as full access for all users create serious control weaknesses. This is not SQL injection or XSS because no web application input is involved. It is not primarily DoS. The best CEH answer is persistence.

CEH defines passive reconnaissance as collecting information without directly engaging the target.

Option A is incorrect for passive reconnaissance because Nmap scanning actively probes systems, generating detectable traffic.

Options B, C, and D rely on publicly available information and are standard passive techniques.

CEH classifies Nmap scanning as active footprinting.