Pass the ECCouncil CEH v13 312-50v13 Questions and answers with ValidTests

The base metric represents the inherent qualities of a vulnerability, according to the Common Vulnerability Scoring System (CVSS). CVSS is a framework that numerically characterizes the severity of software vulnerabilities between the range of 0-10. CVSS consists of three metric groups: Base, Temporal, and Environmental. The base metric group captures the characteristics of a vulnerability that are constant over time and across user environments. The base metric group consists of six sub-metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and Impact. The impact sub-metric further consists of three sub-metrics: Confidentiality, Integrity, and Availability. The base metric group produces a score ranging from 0 to 10, which reflects the intrinsic and fundamental properties of a vulnerability12.

The other options are not correct for the following reasons:

A. Temporal metric represents the inherent qualities of a vulnerability: This option is incorrect because the temporal metric group captures the characteristics of a vulnerability that change over time due to events external to the vulnerability. The temporal metric group consists of three sub-metrics: Exploit Code Maturity, Remediation Level, and Report Confidence. The temporal metric group modifies the base score to reflect the current state of the vulnerability, such as the availability of exploit code, the existence of patches or workarounds, and the degree of verification of the vulnerability report12.

C. Environmental metric involves the features that change during the lifetime of the vulnerability: This option is incorrect because the environmental metric group captures the characteristics of a vulnerability that are relevant and unique to a user’s environment. The environmental metric group consists of three sub-metrics: Modified Attack Vector, Modified Attack Complexity, and Modified Privileges Required. The environmental metric group also allows the user to assign importance values to the impact sub-metrics: Confidentiality Requirement, Integrity Requirement, and Availability Requirement. The environmental metric group modifies the base and temporal scores to reflect the impact of the vulnerability on the user’s specific environment, such as the network configuration, the security objectives, and the asset value12.

D. Temporal metric involves measuring vulnerabilities based on a specific environment or implementation: This option is incorrect because the temporal metric group does not involve measuring vulnerabilities based on a specific environment or implementation, but rather on the factors that change over time due to events external to the vulnerability. The environmental metric group, not the temporal metric group, involves measuring vulnerabilities based on a specific environment or implementation, as explained in option C.

Comprehensive and Detailed Explanation:

The attack shown is a Directory Traversal Attack. It uses URL encoding (hexadecimal obfuscation) to bypass input filters and access unauthorized files such as /etc/passwd.

%2e = . (dot)

%2f = / (forward slash)

So, ../../../etc/passwd becomes %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64

The best protection against this attack is to:

Normalize and sanitize user input on the server.

Deny directory traversal patterns, whether encoded or not.

Specifically reject or deny hex-encoded path characters (%2e, %2f, etc.)

Option A directly mitigates this by preventing the server from decoding and processing hex-encoded directory traversal attempts.

From CEH v13 Courseware:

Module 10: Web Application Hacking

Topic: Directory Traversal and Input Validation

Incorrect Options:

B: IDS can alert, but it’s reactive rather than preventative.

C: SSL encrypts communication but does not prevent path traversal.

D: Active script detection is unrelated to path traversal attacks.

Bob wants Alice to verify that the message hasn’t been tampered with. This is a use case for ensuring data integrity and authenticity. The process described matches the creation of a digital signature:

Bob computes a checksum (typically a cryptographic hash) of the message.

Then, he encrypts this checksum (hash) using his own private key.

Alice receives the message and decrypts the checksum using Bob’s public key.

If the decrypted checksum matches the hash she computes from the received message, she confirms the message’s integrity and authenticity.

This is a fundamental principle of digital signatures.

Incorrect Options:

A. Alice's private key is never used by others; it's confidential.

B. Encrypting with Alice’s public key ensures confidentiality, not authenticity.

D. Bob’s public key is used by the receiver to verify authenticity, not for encryption in this context.

Reference – CEH v13 Official Courseware:

Module 20: Cryptography

Section: “Digital Signatures”

Subsection: “Using Private Keys to Sign and Public Keys to Verify”

CEH Engage Lab: Email Signing and Verification

===========

The location: operator is the least useful in providing the attacker with sensitive VPN-related information, because it does not directly relate to VPN configuration, credentials, or vulnerabilities. The location: operator finds information for a specific location, such as a city, country, or region. For example, location:paris would return results related to Paris, France. However, this operator does not help the attacker to identify or access VPN servers or clients, unless they are specifically named or indexed by their location, which is unlikely.

The other operators are more useful in providing the attacker with sensitive VPN-related information, because they can help the attacker to find pages or files that contain VPN configuration, credentials, or vulnerabilities. The intitle: operator restricts results to only the pages containing the specified term in the title. For example, intitle:vpn would return pages with VPN in their title, which may include VPN guides, manuals, or tutorials. The inurl: operator restricts the results to only the pages containing the specified word in the URL. For example, inurl:vpn would return pages with VPN in their URL, which may include VPN login portals, configuration files, or directories. The link: operator searches websites or pages that contain links to the specified website or page. For example, link:vpn.com would return pages that link to vpn.com, which may include VPN reviews, comparisons, or recommendations. References:

Google Search Operators: The Complete List (44 Advanced Operators)

Footprinting through search engines

Module 02: Footprinting and Reconnaissance

In a professional penetration test or vulnerability assessment, the most efficient and effective way to discover vulnerabilities on a Windows-based system is to use an automated vulnerability scanning tool such as Nessus.

Nessus is a widely used vulnerability scanner developed by Tenable. It performs comprehensive scans across systems to identify:

Missing patches and updates

Misconfigurations

Weak or default credentials

Known vulnerabilities and associated CVEs

Outdated software versions

CEH v13 course material emphasizes the use of tools like Nessus, OpenVAS, and Qualys during the Vulnerability Analysis phase of ethical hacking engagements.

From CEH v13 Official Study Guide (Module 05: Vulnerability Analysis):

“Vulnerability scanning tools such as Nessus and OpenVAS are used to automatically identify known vulnerabilities in systems, including operating systems, applications, and services. These tools correlate identified issues with CVE entries and offer severity ratings based on CVSS scores.”

Incorrect Options Explained:

A. The Windows Update tool only updates the operating system and Microsoft applications. It is not designed to detect security flaws or vulnerabilities comprehensively.

C. MITRE.org is an excellent source of information for known vulnerabilities (CVEs), but it does not scan systems or detect vulnerabilities in a target environment.

D. Creating a disk image is useful for forensic purposes or backup, but it does not help in actively identifying vulnerabilities in a live system.

Reference – CEH v13 Study Guide:

Module 05: Vulnerability Analysis

Section: “Vulnerability Assessment Tools”

CEH iLabs Exercise: “Using Nessus to Perform Vulnerability Scanning”

In CEH v13 Module 10 & 12: Vulnerability Analysis and Web Hacking, Netsparker is introduced as a leading automated web vulnerability scanner capable of detecting:

SQL Injection

Cross-site Scripting (XSS)

Local File Inclusion (LFI)

Misconfigured services

Authentication issues

It performs:

Crawling, attack simulation, and detailed reporting.

Ideal for automated assessment of web servers and applications.

Option Clarification:

A. Infoga: Email information gathering tool.

B. WebCopier Pro: Used for offline website downloading.

C. Netsparker: Purpose-built web vulnerability scanner.

D. NCollector Studio: Website archiving tool, not vulnerability-focused.

Active Online Attacks: Hash Injection/Pass-the-Hash (PtH) Attack A hash injection/PtH attack allows an attacker to inject a compromised hash into a local session and use the hash to validate network resources The attacker finds and extracts a logged-on domain admin account hash The attacker uses the extracted hash to log on to the domain controller

In a Windows system, a Security Identifier (SID) uniquely identifies each user and group. The SID format is:

S-1-5-21--

The Relative Identifier (RID) is the last component in the SID string.

According to Microsoft and CEH v13:

RID 500 → Built-in Administrator account

RID 501 → Guest account

RIDs > 1000 → Regular user accounts

In the given image, the SID:

s-1-5-21-1125394485-807628933-54978560-500chang

has a RID of 500, indicating the built-in administrator account.

From CEH v13:

Module 4: Enumeration

Topic: SID Enumeration

CEH v13 States:

“When enumerating Windows systems, the account with RID 500 is always the default Administrator account, unless renamed. Attackers often target this account due to its elevated privileges.”

Incorrect Options:

All others have RIDs not equal to 500 (e.g., 100, 652, 412, etc.)

The given rule syntax is consistent with Snort, a popular open-source Intrusion Detection System (IDS). This rule alerts when any TCP traffic from any source IP and port is sent to IPs within the 192.168.100.0/24 subnet on port 21 (FTP), triggering the alert message: “FTP on the network!”

The Snort rule format is:

alert protocol source_IP source_port -> destination_IP destination_port (rule_options)

CEH v13 course materials teach this rule format under IDS/IPS configuration.

From CEH v13 Guide:

“Snort rules are used in IDS/IPS to define suspicious traffic patterns. An example rule: alert tcp any any -> 192.168.1.0/24 21 (msg: 'FTP detected') triggers an alert on FTP traffic within a subnet.”

Incorrect Options:

A/C. IP tables are used in firewalls and routers but follow a completely different syntax.

B. FTP servers do not use such alerting rules.

Reference – CEH v13 Study Guide:

Module 12: Evading IDS, Firewalls, and Honeypots

Section: Snort IDS Configuration

===========

Weaponization

The adversary analyzes the data collected in the previous stage to identify the

vulnerabilities and techniques that can exploit and gain unauthorized access to the

target organization. Based on the vulnerabilities identified during analysis, the adversary

selects or creates a tailored deliverable malicious payload (remote-access malware

weapon) using an exploit and a backdoor to send it to the victim. An adversary may

target specific network devices, operating systems, endpoint devices, or even

individuals within the organization to carry out their attack. For example, the adversary

may send a phishing email to an employee of the target organization, which may include a malicious attachment such as a virus or worm that, when downloaded, installs a backdoor on the system that allows remote access to the adversary. The following are the activities of the adversary: o Identifying appropriate malware payload based on the analysis o Creating a new malware payload or selecting, reusing, modifying the available malware payloads based on the identified vulnerability

o Creating a phishing email campaign o Leveraging exploit kits and botnets

https://en.wikipedia.org/wiki/Kill_chain

The Cyber Kill Chain consists of 7 steps: Reconnaissance, weaponization, delivery, exploitation, installation, command and control, and finally, actions on objectives. Below you can find detailed information on each.

1. Reconnaissance: In this step, the attacker/intruder chooses their target. Then they conduct in-depth research on this target to identify its vulnerabilities that can be exploited.

2. Weaponization: In this step, the intruder creates a malware weapon like a virus, worm, or such to exploit the target's vulnerabilities. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or focus on a combination of different vulnerabilities.

3. Delivery: This step involves transmitting the weapon to the target. The intruder/attacker can employ different USB drives, e-mail attachments, and websites for this purpose.

4. Exploitation: In this step, the malware starts the action. The program code of the malware is triggered to exploit the target’s vulnerability/vulnerabilities.

5. Installation: In this step, the malware installs an access point for the intruder/attacker. This access point is also known as the backdoor.

6. Command and Control: The malware gives the intruder/attacker access to the network/system.

7. Actions on Objective: Once the attacker/intruder gains persistent access, they finally take action to fulfill their purposes, such as encryption for ransom, data exfiltration, or even data destruction.

WHOIS is an Internet service that allows users to query domain name registries to retrieve information about registered domain names. It includes data such as:

Registrant’s name and contact information

Domain creation and expiration dates

Registrar details and name servers

WHOIS is often used during the reconnaissance phase in penetration testing.

Reference – CEH v13 Official Study Guide:

Module 2: Footprinting and Reconnaissance

Quote:

“WHOIS databases provide public domain registration details including contact names, email addresses, and registrar information. This is useful for initial reconnaissance.”

Incorrect Options:

B. CAPTCHA is used to distinguish human users from bots.

C. IANA oversees global IP address allocation and DNS root zone management.

D. IETF is responsible for internet standards, not registrant databases.

===========

A hybrid attack combines the benefits of both dictionary and brute-force attacks. It takes words from a dictionary and applies modifications such as:

Appending or prepending numbers or symbols

Changing case (e.g., admin → Admin1!)

Leetspeak substitutions (e.g., p@ssw0rd)

From CEH v13 Official Courseware:

Module 6: Malware Threats

Topic: Password Cracking Methods

CEH v13 Study Guide states:

“A hybrid attack is a combination of dictionary and brute-force techniques. It takes dictionary words and mutates them to cover common variations, making it more effective than pure dictionary attacks.”

Incorrect Options:

A/B/D: These are not standard terminology in cryptographic or password auditing literature.

Whitelist validation (also known as allowlist validation) is a robust defensive strategy where only pre-approved input formats are accepted. This includes:

Restricting input to specific data types (e.g., integer, string)

Limiting size, format, or allowed characters

Accepting only expected values (e.g., country codes, age ranges)

This practice is highly effective in mitigating SQL injection and other input-based attacks.

Incorrect Options:

A. Output encoding prevents XSS by encoding output but doesn't validate input.

B. Enforcing least privilege is an access control principle.

D. Blacklist validation is less secure and attempts to block known bad inputs, which may be bypassed.

Reference – CEH v13 Official Courseware:

Module 14: Hacking Web Applications

Section: “Input Validation and SQL Injection Mitigation”

Subsection: “Whitelist vs Blacklist Input Validation”

===========

The official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls.

formal declaration by a designated accrediting authority (DAA) or principal accrediting authority (PAA) that an information system is approved to operate at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural safeguards. See authorization to operate (ATO). Rationale: The Risk Management Framework uses a new term to refer to this concept, and it is called authorization.

Identifies the information resources covered by an accreditation decision, as distinguished from separately accredited information resources that are interconnected or with which information is exchanged via messaging. Synonymous with Security Perimeter.

For the purposes of identifying the Protection Level for confidentiality of a system to be accredited, the system has a conceptual boundary that extends to all intended users of the system, both directly and indirectly connected, who receive output from the system. See authorization boundary. Rationale: The Risk Management Framework uses a new term to refer to the concept of accreditation, and it is called authorization. Extrapolating, the accreditation boundary would then be referred to as the authorization boundary.

A Stealth or Tunneling Virus is designed specifically to evade detection by antivirus software and system monitoring tools. These viruses work by intercepting and modifying the operating system’s service call interrupts (such as INT 13h and INT 21h in DOS systems), which are used to access files or system services.

By hooking into these interrupts, the virus can return clean or forged data to antivirus scanners, thus hiding its malicious presence from detection tools.

Tunneling viruses may also operate at a lower level to evade even more advanced antivirus detection methods, making them particularly dangerous and hard to detect.

Reference – CEH v13 Official Study Guide:

Module 6: Malware Threats

Section: Types of Viruses

Quote:

“Tunneling viruses attempt to avoid detection by antivirus programs by installing themselves in the interrupt handler chain. These viruses intercept operating system calls to conceal their activities.”

Incorrect Options Explained:

A. Macro viruses target applications like Microsoft Word/Excel and use embedded macros, but do not alter service call interrupts.

C. Cavity viruses insert code into empty spaces in files without changing the file size but do not modify interrupts.

D. Polymorphic viruses mutate their code to avoid signature-based detection but do not typically interfere with system interrupts directly.