- (Topic 2)
Which type of sniffing technique is generally referred as MiTM attack?

1. A. Password Sniffing
2. B. ARP Poisoning
3. C. Mac Flooding
4. D. DHCP Sniffing

Correct Answer: B

- (Topic 1)
Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers. The time a hacker spends performing research to locate this information about a company is known as?

1. A. Exploration
2. B. Investigation
3. C. Reconnaissance
4. D. Enumeration

Correct Answer: C
Cyber Kill Chain Methodology 1. Reconnaissance - Gathering information about the target.

- (Topic 3)
A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for offline cracking. But the attacker was stopped before he could complete his attack. The system administrator needs to investigate and remediate the potential breach. What should be the immediate step the system administrator takes?

1. A. Perform a system reboot to clear the memory
2. B. Delete the compromised user's account
3. C. Change the NTLM password hash used to encrypt the ST
4. D. invalidate the TGS the attacker acquired

Correct Answer: D
A Kerberoasting attack is a technique that exploits the Kerberos authentication protocol to obtain the password hash of a service account that has a Service Principal Name (SPN). An attacker can request a service ticket (TGS) for the SPN using a valid user??s ticket (TGT) and then attempt to crack the password hash offline. To prevent the attacker from using the TGS to access the service, the system administrator should invalidate the TGS as soon as possible. This can be done by changing the password of the service account, which will generate a new password hash and render the old TGS useless. Alternatively, the system administrator can use tools like Mimikatz to purge the TGS from the memory of the domain controller or the client system. Performing a system reboot, deleting the compromised user??s account, or changing the NTLM password hash used to encrypt the ST are not effective ways to invalidate the TGS, as they do not affect the encryption of the TGS or the validity of the TGT. References:
✑ EC-Council CEHv12 Courseware Module 11: Hacking Webservers, page 11-24
✑ What is a Kerberoasting Attack? – CrowdStrike
✑ How to Perform Kerberoasting Attacks: The Ultimate Guide - StationX

- (Topic 3)
Attacker Simon targeted the communication network of an organization and disabled the security controls of NetNTLMvl by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic. He then extracted all the non- network logon tokens from all the active processes to masquerade as a legitimate user to launch further attacks. What is the type of attack performed by Simon?

1. A. Internal monologue attack
2. B. Combinator attack
3. C. Rainbow table attack
4. D. Dictionary attack

Correct Answer: A
Types of Password Attacks - Active Online Attacks: Internal Monologue Attack Attackers perform an internal monologue() attack using SSPI (Security Support Provider Interface) from a user-mode application, where a local procedure call to the NTLM authentication package is invoked to calculate the NetNTLM response in the context of the logged-on user.Attacker disables the security controls of NetNTLMv1, extracts all the non-network logon tokens from all the active processes to masquerade as legitimate users. (P.594/578)

- (Topic 3)
You are a penetration tester and are about to perform a scan on a specific server. The agreement that you signed with the client contains the following specific condition for the scan: ??The attacker must scan every port on the server several times using a set of spoofed sources IP addresses. ?? Suppose that you are using Nmap to perform this scan. What flag will you use to satisfy this requirement?

1. A. The -A flag
2. B. The -g flag
3. C. The -f flag
4. D. The -D flag

Correct Answer: D
flags –source-port and -g are equivalent and instruct nmap to send packets through a selected port. this option is used to try to cheat firewalls whitelisting traffic from specific ports. the following example can scan the target from the port twenty to ports eighty, 22, 21,23 and 25 sending fragmented packets to LinuxHint.