EC-COUNCIL Certified Ethical Hacker v13 - 312-50

During a red team exercise, a Certified Ethical Hacker (CEH) is attempting to exploit a potential vulnerability in a target organization's web server. The CEH has completed the information gathering and footprinting phases and has mirrored the website for offline analysis. It has also been discovered that the server is vulnerable to session hijacking. Which of the following steps is most likely to be part of a successful attack methodology while minimizing the possibility of detection?

• A. Launch a direct brute-force attack to crack the server's administrative password.
• B. Perform vulnerability scanning using automated tools to identify additional weaknesses.
• C. Attempt SQL injection to extract sensitive database information.
• D. Hijack an active session and immediately modify server configuration files.

At a regional data services provider in Zurich, Switzerland, a security review was conducted on a Microsoft IIS deployment that included administrative components used to handle user authentication and credential storage. During the assessment, the team observed that when privileged users interacted with certain data fields, crafted input could be injected and executed within their active session context, indicating improper neutralization of user-controlled input within a backend credential-handling module.
Further testing confirmed that the injected content was rendered during interactions involving stored credential data, enabling potential exposure or manipulation of sensitive authentication information. The behavior was triggered during normal application usage and did not depend on transport-layer manipulation or malformed protocol-level inputs.
Which of the following IIS vulnerabilities is described in this scenario?

• A. XSS in password manager
• B. CCURE passwords exposed to administrators
• C. CRLF cross-site scripting vulnerability
• D. TYPO3 cross-site scripting (XSS) vulnerability

A penetration tester is evaluating a customer relationship application for a company in Denver, Colorado. To identify weaknesses, he submits large volumes of randomized and malformed data to various input fields and observes how the application responds to unexpected input patterns.
During this process, the system produces inconsistent behavior and error conditions that reveal weaknesses in how certain inputs are handled. By repeatedly supplying unpredictable data patterns, the tester uncovers areas where improper input validation may allow manipulation.
Which SQL injection detection method is illustrated in this scenario?

• A. Dynamic Testing
• B. Function Testing
• C. Fuzz Testing
• D. Static Testing

A fintech platform in Tallinn, Estonia, engaged a security assessor to evaluate the robustness of its encrypted web communications during a controlled penetration-testing exercise. The assessment focused on secure client-server interactions occurring under high transaction loads generated by automated scripts.
The assessor observed that numerous requests containing sensitive session-related data were transmitted repeatedly in a consistent format. By inducing the application to generate a large volume of encrypted exchanges, the assessor collected the resulting ciphertexts and applied statistical analysis. Over time, portions of the protected information were inferred without directly decrypting individual communications. The weakness was traced to predictable biases in the encryption process when repeated data was encrypted under comparable conditions.
What type of cryptographic attack is demonstrated?

• A. Pass-the-cookie attack
• B. RC4 NOMORE attack
• C. Cookie snooping
• D. Same-site attack

During a late-night shift at IronWave Logistics in Seattle, cybersecurity analyst Marcus Chen notices a pattern of high-port outbound traffic from over a dozen internal machines to a previously unseen external IP. Each system had recently received a disguised shipping report, which, when opened, initiated a process that spread autonomously to other workstations using shared folders and stolen credentials. Upon investigation, Marcus discovers that the machines now contain hidden executables that silently accept remote instructions and occasionally trigger coordinated background tasks. The compromised endpoints are behaving like zombies, and malware analysts confirm that the payload used worm-like propagation to deliver a backdoor component across the network.
Which is the most likely objective behind this attack?

• A. To establish a botnet for remote command and control
• B. To execute a ransomware payload and encrypt all data
• C. To deploy a Remote Access Trojan (RAT) for stealthy surveillance
• D. To exfiltrate sensitive information and tracking data