- (Topic 2)
Windows LAN Manager (LM) hashes are known to be weak.
Which of the following are known weaknesses of LM? (Choose three.)

1. A. Converts passwords to uppercase.
2. B. Hashes are sent in clear text over the network.
3. C. Makes use of only 32-bit encryption.
4. D. Effective length is 7 characters.

Correct Answer: ABD

- (Topic 1)
One of your team members has asked you to analyze the following SOA record. What is the version?
Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400.) (Choose four.)

1. A. 200303028
2. B. 3600
3. C. 604800
4. D. 2400
5. E. 60
6. F. 4800

Correct Answer: A

- (Topic 3)
As a cybersecurity professional, you are responsible for securing a high-traffic web application that uses MySQL as its backend database. Recently, there has been a surge of unauthorized login attempts, and you suspect that a seasoned black-hat hacker is behind them. This hacker has shown proficiency in SQL Injection and appears to be using the 'UNION' SQL keyword to trick the login process into returning additional data.
However, your application's security measures include filtering special characters in user inputs, a method usually effective against such attacks. In this challenging environment, if the hacker still intends to exploit this SQL Injection vulnerability, which strategy is he most likely to employ?

1. A. The hacker alters his approach and injects a ??DROP TABLE?? statement, a move that could potentially lead to the loss of vital data stored in the application's database
2. B. The hacker tries to manipulate the 'UNION' keyword in such a way that it triggers a database error, potentially revealing valuable information about the database's structure
3. C. The hacker switches tactics and resorts to a ??time-based blind?? SQL Injection attack, which would force the application to delay its response, thereby revealing information based on the duration of the delay
4. D. The hacker attempts to bypass the special character filter by encoding his malicious input, which could potentially enable him to successfully inject damaging SQL queries

Correct Answer: D
SQL Injection is a type of attack that exploits a vulnerability in a web application that uses a SQL database. The attacker injects malicious SQL code into the user input, such as a login form, that is then executed by the database server. This can allow the attacker to access, modify, or delete data, or execute commands on the database server.
The ??UNION?? SQL keyword is often used in SQL Injection attacks to combine the results of two or more SELECT statements into a single result set. This can allow the attacker to retrieve additional data from other tables or columns that are not intended to be displayed by the application. For example, if the application uses the following query to check the user credentials:
SELECT * FROM users WHERE username = '$username' AND password = '$password' The attacker can inject a ??UNION?? statement to append another query, such as:
' OR 1 = 1 UNION SELECT * FROM credit_cards --
This will result in the following query being executed by the database server: SELECT * FROM users WHERE username = '' OR 1 = 1 UNION SELECT * FROM
credit_cards --' AND password = '$password'
The first part of the query will always return true, and the second part of the query will return the data from the credit_cards table. The ??–?? symbol is a comment that will ignore the rest of the query. The attacker can then see the credit card information in the application??s response.
However, some web applications implement security measures to prevent SQL Injection attacks, such as filtering special characters in user inputs. Special characters are symbols that have a special meaning in SQL, such as quotes, semicolons, dashes, etc. By filtering or escaping these characters, the application can prevent the attacker from injecting malicious SQL code. For example, if the application replaces single quotes with two single quotes, the previous injection attempt will fail, as the query will become:
SELECT * FROM users WHERE username = '''' OR 1 = 1 UNION SELECT * FROM
credit_cards --'' AND password = '$password'
This will result in a syntax error, as the query is not valid SQL.
In this challenging environment, if the hacker still intends to exploit this SQL Injection vulnerability, the strategy that he is most likely to employ is to bypass the special character filter by encoding his malicious input. Encoding is a process of transforming data into a different format, such as hexadecimal, base64, URL, etc. By encoding his input, the hacker can avoid the filter and still inject malicious SQL code. For example, if the hacker encodes his input using URL encoding, the previous injection attempt will become:
%27%20OR%201%20%3D%201%20UNION%20SELECT%20*%20FROM%20credit_card s%20--
This will result in the following query being executed by the database server, after the application decodes the input:
SELECT * FROM users WHERE username = '' OR 1 = 1 UNION SELECT * FROM
credit_cards --' AND password = '$password'
This will succeed in returning the credit card information, as the filter will not detect the special characters in the encoded input.
Therefore, the hacker is most likely to employ the strategy of bypassing the special character filter by encoding his malicious input, which could potentially enable him to
successfully inject damaging SQL queries. References:
✑ SQL Injection | OWASP Foundation
✑ SQL Injection Union Attacks
✑ SQL Injection Bypassing WAF

- (Topic 1)
A user on your Windows 2000 network has discovered that he can use L0phtcrack to sniff the SMB exchanges which carry user logons. The user is plugged into a hub with 23 other systems.
However, he is unable to capture any logons though he knows that other users are logging in.
What do you think is the most likely reason behind this?

1. A. There is a NIDS present on that segment.
2. B. Kerberos is preventing it.
3. C. Windows logons cannot be sniffed.
4. D. L0phtcrack only sniffs logons to web servers.

Correct Answer: B

- (Topic 2)
Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mall servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API. Which of the following tools is used by Wilson in the above scenario?

1. A. Factiva
2. B. Netcraft
3. C. infoga
4. D. Zoominfo

Correct Answer: C
Infoga may be a tool gathering email accounts informations (ip,hostname,country,??) from completely different public supply (search engines, pgp key servers and shodan) and check if email was leaked using haveibeenpwned.com API. is a really simple tool, however very effective for the first stages of a penetration test or just to know the visibility of your company within the net.