ECCouncil 312-50v13 - Certified Ethical Hacker Exam (CEHv13)

A digital signature is created by hashing the document and encrypting that hash with the sender’s private key. Since the hash is specific to the original content, any change to the document invalidates the signature, making it non-transferable to another document.

Reference – CEH v13 Official Study Guide:

Module 20: Cryptography

Quote:

“Digital signatures are based on hashing the document and signing the digest with the private key. This makes each signature unique to the document and ensures tamper resistance.”

Incorrect Options:

B. Incorrect — signature is tied to one document.

C. Hashes are not plain; they are encrypted.

D. Keys can be reused, but signatures are document-specific.

Patch management is that the method that helps acquire, test and install multiple patches (code changes) on existing applications and software tools on a pc, enabling systems to remain updated on existing patches and determining that patches are the suitable ones. Managing patches so becomes simple and simple.

Patch Management is usually done by software system firms as a part of their internal efforts to mend problems with the various versions of software system programs and also to assist analyze existing software system programs and discover any potential lack of security features or different upgrades.

Software patches help fix those problems that exist and are detected solely once the software’s initial unharness. Patches mostly concern security while there are some patches that concern the particular practicality of programs as well.

Blind SQL Injection is a type of SQL injection attack where no error messages or data are directly returned to the attacker. Instead, the attacker sends specially crafted SQL queries that result in true or false responses. Based on how the application responds (such as redirecting to a different page or loading time), the attacker infers information about the backend database.

According to CEH v13:

Blind SQLi is used when standard SQL injection yields no visible output.

It comes in two forms:

Boolean-based: Infers information based on application behavior.

Time-based: Infers information based on server response time delays.

Incorrect Options:

A. Time-based SQLi is a sub-type of Blind SQLi, but the question describes Boolean-based behavior.

B. Union SQL injection uses the UNION keyword to fetch additional rows; requires visible output.

C. Error-based SQL injection relies on database error messages.

Reference – CEH v13 Official Courseware:

Module 14: Hacking Web Applications

Section: “Types of SQL Injection”

Subsection: “Blind SQL Injection (Boolean and Time-Based)”

===========

CHNTPW (Change NT Password) is a Linux-based utility that allows attackers or administrators to:

Reset Windows user account passwords

Unlock disabled or locked user accounts

Remove password protection without knowing the original password

It works by editing the Windows SAM (Security Account Manager) file located in the Windows system directory.

Reference – CEH v13 Official Study Guide:

Module 5: System Hacking

Quote:

“CHNTPW is a tool that can reset or change passwords on Windows systems by directly editing the SAM database. It is commonly run from a Linux LiveCD.”

Incorrect Options:

A. John the Ripper is for cracking passwords, not resetting them directly.

B. SET (Social Engineering Toolkit) is for phishing and payloads, not password resets.

D. Cain & Abel is a password recovery tool for Windows but runs on Windows, not Linux.

===========

https://www.infocyte.com/blog/2019/02/16/cybersecurity-101-what-you-need-to-know-about-false-positives-and-false-negatives/

False positives are mislabeled security alerts, indicating there is a threat when in actuality, there isn’t. These false/non-malicious alerts (SIEM events) increase noise for already over-worked security teams and can include software bugs, poorly written software, or unrecognized network traffic.

False negatives are uncaught cyber threats — overlooked by security tooling because they’re dormant, highly sophisticated (i.e. file-less or capable of lateral movement) or the security infrastructure in place lacks the technological ability to detect these attacks.

A multihomed firewall refers to a firewall with two or more network interfaces (NICs), each connected to different network segments. The purpose of a multihomed firewall is to allow filtering and segmentation of traffic between multiple network zones, such as:

External network (e.g., Internet)

Internal network (e.g., LAN)

To qualify as multihomed, the system must have at least two network interfaces. This allows it to sit between two networks and inspect/filter traffic passing through it.

Reference – CEH v13 Official Study Guide:

Module 13: Evading IDS, Firewalls, and Honeypots

Section: Firewall Architecture

Quote:

“A multihomed firewall is a system with two or more NICs connected to different networks, typically used to control traffic between internal and external networks. The minimum number of interfaces is two.”

Incorrect Options Explained:

A. 3 interfaces may be used in advanced setups (e.g., with a DMZ), but not the minimum.

B & C. 4 or 5 connections are not required unless designing more complex segmentation.

===========

A DMZ (Demilitarized Zone) is a physical or logical subnet that separates an internal local area network (LAN) from untrusted networks—typically the Internet. It allows an organization to provide external-facing services while isolating internal systems from direct exposure.

From CEH v13 Official Courseware:

Module 13: Hacking Web Applications

Module 14: Hacking Web Servers

Module 1: Introduction to Ethical Hacking – Security Architecture Concepts

CEH v13 clearly outlines:

“A DMZ is critical when deploying Internet-facing servers such as web servers, FTP servers, or mail servers. It provides a buffer zone that allows public access to specific resources while keeping the internal network isolated.”

Bob’s assumption is flawed for several reasons:

DMZs can be implemented even with stateless firewalls using strict access control rules.

Relying solely on IP-based filtering is error-prone and doesn’t offer layered defense.

A DMZ provides an essential layer of segmentation, protecting internal assets from compromised public servers.

Incorrect Options:

A/D: DMZ can still make sense even with stateless firewalls if properly configured.

B: IP filtering is insufficient as a sole security measure; does not replace the need for network segmentation.

Wireless network assessment determines the vulnerabilities in an organization’s wireless networks. In the past, wireless networks used weak and defective data encryption mechanisms. Now, wireless network standards have evolved, but many networks still use weak and outdated security mechanisms and are open to attack. Wireless network assessments try to attack wireless authentication mechanisms and gain unauthorized access. This type of assessment tests wireless networks and identifies rogue networks that may exist within an organization’s perimeter. These assessments audit client-specified sites with a wireless network. They sniff wireless network traffic and try to crack encryption keys. Auditors test other network access if they gain access to the wireless network.

Expanding your network capabilities are often done well using wireless networks, but it also can be a source of harm to your data system . Deficiencies in its implementations or configurations can allow tip to be accessed in an unauthorized manner.This makes it imperative to closely monitor your wireless network while also conducting periodic Wireless Network assessment.

It identifies flaws and provides an unadulterated view of exactly how vulnerable your systems are to malicious and unauthorized accesses.

Identifying misconfigurations and inconsistencies in wireless implementations and rogue access points can improve your security posture and achieve compliance with regulatory frameworks.

The phrase "testing the network using the same methodologies and tools employed by attackers" precisely describes Penetration Testing.

Penetration testing involves:

Simulating real-world attacks.

Using tools and techniques similar to those used by malicious hackers.

Actively exploiting vulnerabilities to assess the security posture of systems.

From CEH v13 Courseware:

Module 1: Introduction to Ethical Hacking

Module 5: Vulnerability Assessment vs. Penetration Testing

CEH v13 Study Guide states:

“Penetration testing is a simulated cyberattack against your system to check for exploitable vulnerabilities. It uses the same tools, techniques, and processes as attackers to find and validate security weaknesses.”

Incorrect Options:

A. Vulnerability Scanning: Only identifies potential issues; it doesn’t attempt to exploit them.

C. Security Policy Implementation: Refers to governance and documentation, not testing.

D. Designing Network Security: Refers to planning a secure architecture.

Reconnaissance is the first phase of ethical hacking and also part of the cyber kill chain. It involves gathering publicly available information about a target, such as employee names, company structure, and branding, which is later used in social engineering or phishing attacks.

Reference – CEH v13 Official Study Guide:

Module 2: Footprinting and Reconnaissance

Quote:

“Reconnaissance involves gathering information from public sources such as websites, social networks, and press releases. This is used to craft targeted phishing messages or exploit organizational weaknesses.”

Incorrect Options Explained:

A & B. Not formal terms in ethical hacking.

D. Enumeration involves interacting with systems to extract technical data.

The hacker’s next step to confirm the XSS vulnerability would be to utilize a script hosted on the application’s domain to test the form. This is because the application’s CSP allows scripts from its own domain, but not from inline or external sources. Therefore, the hacker can try to inject a payload that references a script file on the same domain as the application, such as:

where script.js contains some benign code, such as alert('XSS') or print('XSS'). If the script executes in the browser, then the hacker has confirmed the XSS vulnerability. Otherwise, the CSP has blocked the script and prevented the XSS attack.

The other options are not feasible or effective for the following reasons:

A. Try to disable the CSP to bypass script restrictions: This option is not feasible because the hacker cannot disable the CSP on the server side, and the browser enforces the CSP on the client side. The hacker would need to modify the browser settings or use a browser extension to disable the CSP, but this would not affect the victim’s browser or the application’s security.

B. Inject a benign script inline to the form to see if it executes: This option is not effective because the application’s CSP disallows inline scripts, meaning scripts that are embedded in the HTML code. Therefore, the hacker would not be able to inject a script tag or an event handler attribute that contains some code, such as:

 or 

The CSP would block these scripts and prevent the XSS attack.

D. Load a script from an external domain to test the vulnerability: This option is not effective because the application’s CSP disallows scripts from external domains, meaning scripts that are loaded from a different domain than the application. Therefore, the hacker would not be able to inject a script tag that references a script file on another domain, such as:

The CSP would block these scripts and prevent the XSS attack.

Shoulder surfing is a social engineering technique that involves looking over someone’s shoulder to observe sensitive information, such as passwords, PINs, or credit card numbers, that they enter on their computer, phone, or ATM. It is the least likely method of social engineering to yield beneficial information based on the data collected by Maltego, because it requires physical proximity and access to the target’s devices, which may not be feasible or safe for the hacker. Moreover, shoulder surfing does not leverage the information obtained by Maltego, such as domains, DNS names, Netblocks, or IP addresses, which are more relevant for network-based attacks.

The other options are more likely to yield beneficial information based on the data collected by Maltego, because they involve exploiting the target’s trust, curiosity, or negligence, and using the information obtained by Maltego to craft convincing scenarios or messages. Impersonating an ISP technical support agent to trick the target into providing further network details is a form of pretexting, where the hacker creates a false identity and scenario to obtain information or access from the target. Dumpster diving in the target company’s trash bins for valuable printouts is a technique that relies on the target’s negligence or lack of proper disposal of sensitive documents, such as network diagrams, passwords, or confidential reports. Eavesdropping on internal corporate conversations to understand key topics is a technique that exploits the target’s curiosity or lack of awareness, and allows the hacker to gather information about the target’s projects, plans, or problems, which can be used for further attacks or extortion. References:

Social Engineering: Definition & 5 Attack Types

How to Use Maltego Transforms to Map Network Infrastructure: An In-Depth Guide

Social engineering: Definition, examples, and techniques

SOX stands for Sarbanes-Oxley Act of 2002. It is a U.S. federal law enacted to protect shareholders and the general public from accounting errors and corporate fraud.

Key points:

Requires strict internal controls and financial disclosures in publicly traded companies.

Mandates regular audits and IT security controls related to financial data.

Applies especially to accounting systems, databases, access controls, and IT procedures related to financial reporting.

Incorrect Options:

A. PCI-DSS relates to securing credit card data.

B. FISMA pertains to federal agency cybersecurity standards.

D. ISO/IEC 27001:2013 is an international information security standard, not a legal requirement for financial integrity.

Reference – CEH v13 Official Courseware:

Module 01: Introduction to Ethical Hacking

Section: “Compliance and Legal Concepts”

Table: "Major Laws and Regulations in Information Security"

===========

Comprehensive and Detailed Explanation:

Fake antivirus (also known as scareware) tricks users into downloading malware disguised as legitimate antivirus software.

The best approach:

Google the product name and URL.

Check reputable forums, antivirus vendors, or security advisories.

Look for phishing warnings or reports of malware.

From CEH v13 Courseware:

Module 7: Social Engineering and Phishing Scams

Module 6: Malware Threats → Rogue Software

Bollards are short vertical posts installed to control or direct road traffic, but more importantly, they act as physical security controls to prevent vehicle-ramming attacks or unauthorized vehicle entry into sensitive or secure areas such as building entrances. They are often reinforced and strategically placed to withstand high-speed collisions.

This is a physical security control described in CEH v13 Module 01 (Introduction to Ethical Hacking) and further discussed in physical security best practices for preventing unauthorized physical access.

Incorrect Options:

B. Receptionist is a human control, not a physical barrier for vehicles.

C. Mantrap is used to control personnel access, not vehicle access.

D. Turnstile controls pedestrian entry, not vehicles.