Deck 2: Information Gathering

Question 1

Based on the following command, which of the following statements are true? (Choose two)
Lynx -dump http://www.google.com/search?q=site:eccouncil.org+ceh > ceh_search.txt

A) Lynx is a command line browser. We are passing in a URL that contains a search and dumping the results to a text file for further review.
B) Lynx is a command line browser and is extremely useful to the attacker that only has a remote shell on a system (no GUI).
C) Lynx is a little known tool in the Google API. It provides access to undocumented functions and can access even Darknet data.
D) Lynx is an internal Linux command that tunnels an HTTP connection across a firewall and permits access to data anonymously. Since we do not want to be caught searching for a hacking class, this is the best tool to use.

Answer 1

Lynx is a command line browser. We are passing in a URL that contains a search and dumping the results to a text file for further review.
Lynx is a command line browser and is extremely useful to the attacker that only has a remote shell on a system (no GUI).

Question 2

What is the difference between the inurl: and the allinurl: operators?

A) Using inurl: is like a logical OR and using allinurl: is like a logical AND
B) There is no difference, the allinurl is not listed on the help page because it has been discontinued
C) With inurl: only the first keyword must be in the URL and additional keywords can be anywhere on the page. The allinurl: operator means all of the keywords must be in the URL.
D) With inurl: only the first keyword must be in the URL and additional keywords can be anywhere on the page. The allinurl: operator means any of the keywords must be in the URL.

Answer 2

With inurl: only the first keyword must be in the URL and additional keywords can be anywhere on the page. The allinurl: operator means any of the keywords must be in the URL.

Question 3

What is the difference between the filetype: and ext: operators?

A) Filetype: looks for executables where ext: looks for data files
B) They are synomyms of each other, but the ext: is intended more for negation
C) There is no such thing as a filetype: operator
D) There is no such thing as an. ext: operator

Answer 3

They are synomyms of each other, but the ext: is intended more for negation

Question 4

What would a search for the string "include <stdio.h>" produce?

A) Nothing as the (hash0 character comments out the remaining string
B) Library files from Visual Studio
C) Source code for scripts written in "C"
D) A well known vulnerability in the IIS ISAPI for IPP (Internet Printing Protocol)

Question 5

What is the following search trying to accomplish?
Intitle:"This page cannot be found" and "Please try the following"

A) Broken links produce these errors and indicate a malfunctioning server that is exposing weaknesses
B) Server errors that provide valuable information about what went wrong with the script
C) 404 errors produce pages that include these phrases as a common matter, the search doesn't really tell the attacker anything
D) The first phrase produced too many results. The second phrase was added to refine the search

Question 6

When playing around Chuck tries a search for "intitle:index.of" because he saw it in a hacker book. The first entry was for a site called Ibiblio and it looked interesting.
What should Chuck do next?

A) Since Google hacking is anonymous; Chuck should start hacking away at the Ibiblio site. Who knows what this thing is, but it looks fun to attack.
B) Ibiblio is a popular host for downloads, they present a directory listing routinely and this target is not something Chuck should bother with because directory listing are not always a problem
C) Chuck should look further into the results or perhaps add the site: operator to his search
D) Stupid Google is only showing useless results that aren't even web pages. The hacker book must have had a typo as usual and Chuck should just move on to something else.

Question 7

Janet read on the Internet that free hosting services will offer scripts to customers that have security holes. It is possible that these holes are not always patched. She also read that Matt's PERL scripts are quite popular.
What would Janet do next? (Choose two)

A) Use Google to locate Matt's script archive, guess on a popular script like formmail.pl, and use Google to look for vulnerabilities. Pop a code string into Google again and try to find vulnerable sites.
B) Use Google to search for webhosts that use these scripts and sign up for a free account. Download the scripts and analyze them for vulnerabilities.
C) These scripts are old and outdated. No one uses stuff like this anymore so Janet should ignore the article and move on.
D) Webhosts would not release vulnerable code, particularly the free services. They recognize their responsibility and invest a lot of money in ensuring the safety of their products. Janet has no angle here and should move on.

Question 8

The "title" of a web page, (for instance, that is used in the intitle: Google search operator) is located where in the web documents?

A) Name of the physical file on the webserver
B) <head><title>This is the title</title></head>
C) Mapped in a configuration file on the webserver
D) In the status bar of the web browser

Question 9

Which of the following is a hacking tool for automating Google searches?

A) Bing
B) GoogleGet
C) AutoGoo
D) Goolag Scanner

Question 10

Brian wants to demonstrate an example of hacking Google's adsense system. He decides to setup a "splog". What is Brian trying to illustrate?

A) Articles full of keywords but with dubious content value
B) Splurging on a burst of advertising on high cost, high impact traffic sites
C) Posting comments on trendy, spur of the moment type blog articles that have timely and up to the minute reporting
D) A network of connected sites that promote high click through actions. Example" "Click here" results in a sentence or two of promotion copy only to require yet another click to hopefully one day view some content.

Question 11

Sean hears about the practice of "Web Scraping," and realizes this could be a good way to make some extra cash.
What is Sean going to do?

A) Run a series of "Make money online" workshops and tell people to do what he is doing look for things to sell online
B) "Scrape" information from other information sources and add his own insightful commentary
C) Steal other web pages, place them under his own domains, place Google adsense onto those pages, and rake in the money when the keywords cause search hits
D) Purchase domains that have recently expired, then sell them to their previous owners for a profit, even if he had no intent of ever using those domains for anything

Question 12

What will the following search phrase ask for?
Site:example.com -ext:html -ext:htm -ext:asp -ext:php

A) All indexed pages on the example.com site including for those with extensions html, htm, asp, and Php
B) All non-indexed pages on the example.com site expect for those with extensions html, htm, asp, and Php
C) All html, htm, asp, and php pages on every site other than example.com
D) All indexed pages on the example.com site other than those with extensions html, htm, asp, and php

Question 13

Using automated tools to search Google violates their terms of service. Searching known Google appliances, however, is a different matter.
Which of the following tools is designed to work this way?

A) GoogleGather
B) GScanPlus
C) GooApp
D) Gooscan

Question 14

Claire wants to sabotage her rival's latest adsense campaign. She reduces the CTR (Click Through Rate) of her competitor by viewing pages their ads are shown, then is careful not to click the ads. To make enough of a difference, fake pages are setup with keywords that attract the ads, then bots automate clicking the pages by the thousands.
What is this an example of?

A) Good old fashioned competition
B) Impression Fraud
C) Click fraud
D) Can't be done

Question 15

"Google Zeitgeist" is a project that does what?

A) It is a Slashdot hoax
B) Legal issues brought on my privacy concerns in Germany
C) A project that is meant to demonstrate "The spirit of the times"
D) A conspiracy of Google to own all of the world's information

Question 16

Which of the following tools can an attacker use for almost all footprinting needs, including whois, http banner grabbing, and traceroutes?

A) Google Earth
B) My IP Suite
C) Neotrace
D) Sam Spade

Question 17

Which of the following tools runs under Windows, has a GUI, and can be used for footprinting web servers?

A) Nikto
B) Wikto
C) Dogpile
D) Web Ferret

Question 18

Which of the following commands would be used to request a zone transfer?

A) nslookup; server ns1.example.dom; ls -d example.dom
B) dig @ns1.example.dom - -zone-transfer
C) host -t ZONE example.dom ns1.example.dom
D) dig @ns1.example.dom example.dom IXFR

Question 19

Which of the following are valid RIRs?

A) LACNIC, LAPNIC, AFLAC
B) ARIN, LAPNIC, RIPE NCC
C) ARIN, APNIC, LAPNIC
D) ARIN, LACNIC, AfriNIC

Question 20

When attending a hacker meeting for the first time, John was asking about purchasing domain names. He was told in order to avoid identify theft or other forms of harassment, it is a good idea not to put correct information in the Whois record when buying a Domain name. (Select the best statement)

A) He was given bad advice. Incorrect information is a violation of the IEEE and IETF terms of service.
B) He was given bad advice. Incorrect information is a violation of the ICANN terms of service.
C) He was given good advice. Domain poachers use the contact information to steal domains all the time.
D) He was given good advice. You never want to put a personal address in the whois and proxy services that will hide the information are outrageously expensive.

Question 21

Which of the following tools will help the attacker learn how long a webserver has been up for and what type of server its running (indicating perhaps it has not been updated in awhile)?

A) This cannot be determined remotely
B) BidiBlah Suite
C) http://uptime.netcraft.com/up/graph
D) www.archive.org

Question 22

When looking at some log files, Casey noticed some strange entries that involved a request to TCP port 53 and the string "AXFR."
What was the attacker attempting?

A) It was a common virus scan
B) Directory traversal
C) Verify the accounts on a mail server
D) Zone transfer

Question 23

How long will the secondary server wait before asking for a zone update if the regular update hasn't yet been answered?
Lab.dom. IN SOA ns.lab.dom. (200030432 7200 3600 1209600 1800)

A) 2 Hours
B) 60 Minutes
C) 14 Days
D) 1 Week

Question 24

What is the name of the tool that will show old versions of websites that might reveal email addresses or other information that could be harvested?

A) Web the Ripper
B) Black Widow
C) The Wayback Machine
D) HTTrack website copier

Question 25

Which of the following are ways to footprint email addresses or systems?

A) Send an email to a domain that will bounce back and analyze the headers
B) Telnet into port 25 and issue the VRFY command on names collected from the company directory
C) Embed a "web bug" in the HTML email and spam it out to everyone
D) All of the above

Question 26

Dave used the engine at http://www.kartoo.com to footprint his competitor's domain. What was Dave trying to accomplish?

A) Pinpoint targets for a Denial of Service attack
B) Assemble competitive intelligence
C) Find press releases or negative stories
D) Find the names of company officers

Question 27

While researching a public company, Tony wanted to figure out the names of important company officials and what they paid for the business. Which resource is best used for this research?

A) The Edgar database
B) Findlaw.com
C) cnbc.com
D) Finance.yahoo.com

Question 28

When performing a traceroute, Gregory notices that the last two entries are the same IP address. What does this mean? (Choose two)

A) There is a cluster or load balancer on that segment
B) There is an SPI firewall at the gateway
C) One of the two hosts is a honeypot
D) Gregory needs to try a Layer 4 traceroute since this result is impossible

Question 29

Which of the following is the best statement in terms of footprinting a network?

A) Map the network, discover live hosts, discovery open ports, discover services
B) Discover live hosts, discover open ports, discover services, map the network
C) Find the network block, traceroute to the webserver, scan all hops looking for segments
D) Call the front desk and ask to talk to the network administrator. Tell him that network topologies must be a matter of public record for investors and you want a copy mailed right away.

Question 30

If the standard traceroute tool is not working, the attacker can then try which of the following?

A) Call the front desk and ask them to ping you, since traffic coming from them will be successful
B) Telnet to various ports and run a packet sniffer to watch the backscatter
C) "lft" is an advanced traceroute tool that can incorporate various Layer 4 techniques and it might work instead
D) Post a message on the nmap hackers mailing list and ask someone else to try it from their address

Question 31

Amberlee attempts a UDP scan into a DMZ and no results are returned. What could be the possible reasons? (Choose four)

A) The network segment is down
B) ICMP Type 3 messages are being filtered on the way back
C) She is only scanning UDP ports that are open, like 53
D) The filter is blocking all UDP traffic
E) The SYN flags are filtered by the stateful firewall

Question 32

While DNS walking during the recon phase, Ryan discovers two hosts that should exist and have available services, but when he performs an inverse scan on them he gets confusing results. He can reach them through a web browser, confirming they have http services running, but the scan produces only RST, ACK responses. Why?

A) Ryan is inverse scanning a Windows host
B) Ryan is inverse scanning a Linux host
C) The filter is returning the RST flags to discourage the scan
D) The HTTP server always responds with a RST if the browser agent is not Mozilla or IE

Question 33

Larry doesn't want to learn how subnetting or routing works, and just wants to take a wild guess at a scan. He has an inside position so scanning private addresses is OK. He downloads Angry IP and puts in a range of 192.168.0.0/16.
What is the best statement in regard to what Larry is doing?

A) Seems like Larry is taking a reasonable approach. He expects the scan to take awhile, and he can do other things while he waits.
B) 192.168.0.0/16 is an RFC 1918 compliant range, but this scan will attempt to reach over 65000 hosts and there are better ways of doing this.
C) RFC 1918 specifies 192.16.1.0/24 as a private range, and Larry is trying a class B mask. Larry is wasting his time
D) He should get the network block from ARIN and scan from the outside if he wants to make sure he sees every inside host.

Question 34

When attempting an operating system fingerprinting scan, NMap requires which of the following?

A) An open port
B) Specific services like HTTP on the target since OS detection is basically a banner grab
C) A packet filtering firewall between the scanner and the target
D) One open port and one closed port

Question 35

Which of the following tools is best used for passive OS fingerprinting?

A) Cheops
B) Queso
C) NMap
D) p0f

Question 36

Clement is running a sniffer while performing a scan. He noticed a few ICMP Type 3 Code 13 messages. What does this mean?

A) Timestamp requests
B) Administratively prohibited
C) Destination unreachable, the network is down
D) Time to live has expired

Question 37

Which of the following commands would successfully conduct a UDP scan of ports 1 through 100?

A) nc -u -v -w3 [target ip] 1-100
B) hping3 -8 -S -p 1-100 [target ip]
C) nmap -sU -v -v [target ip] 1-100
D) uscan -p 1-100 [target ip]

Question 38

Which of the following represents a stealth scan?

A) SYN; SYN/ACK; ACK; RST
B) SYN; SYN/ACK; RST
C) SYN; SYN/ACK; FIN
D) SYN; SYN/ACK

Question 39

Ted is looking at packet dumps of a scan and notices the flags UPF are set. He also notices the target port is always 31337. What does Ted conclude?

A) He is watching normal traffic
B) Someone is scanning for subseven
C) This is a harmless UDP scan
D) Someone is scanning for back orifice

Question 40

Monty wants to check a block of phone numbers for rogue infrastructure, what tool or technique would he use?

A) War dialing with Ettercap
B) War dialing with THC-Scan
C) Dialing for Dollars with Cold-Call Pro DX
D) Robo-dialing with DialDick.exe

Question 41

In addition to the TTL field, which of the following can be analyzed during OS fingerprinting to identify the target OS? (Choose 5)

A) The setting of the DF bit
B) Window size
C) IPID incrementing
D) ToS bits
E) Initial NACK field
F) Datagram size

Question 42

Which of the following is not one of the states of a port?

A) Half-open
B) Listening
C) Filtered
D) Established

Question 43

Frank's boss wants to start performing vulnerability scans and a golf partner recommended SAINT. He sets up a Windows machine and asks Frank to get started but immediately Frank runs into a problem.
What is wrong?

A) SAINT only runs on UNIX
B) Frank's boss needed SATAN, he bought the wrong product
C) SAINT only scans wireless networks
D) Vulnerability scans only tell the attackers where the weaknesses are

Question 44

Bart is running an nmap vanilla scan and believes the results are inaccurate. He decides that slowing down his scan might increase the accuracy, believing that latency or congestion is causing some dropped responses.
Which of the following choices will help Bart get the job done?

A) nmap -sT -v -T5 [Target IP]
B) nmap -sT -v -T0 [Target IP]
C) nmap -sV -v -T0 [Target IP]
D) nmap -sT -v --slow [Target IP]

Question 45

Sean is trying to scan a network using the evasion technique of fragmenting his traffic with the -f option in NMap. What is the MTU (Maximum Transfer Unit) for an Ethernet network?

A) Depends on the speed of the link
B) 53
C) 65535
D) 1500

Question 46

Which example is the correct syntax for establishing a null session?

A) net use \\IPC$ \[target ip] "" / user : ""
B) net use \\[target ip]\IPC$ "" / user : ""
C) net use \\[target ip]\IPC$ '' / user : ''
D) net use \\[target ip]\NULL$ "" / user : ""

Question 47

What of the following lists of tools are used in a Linux system to gather information locally about what is running?

A) netstat, pstools, nbtstat, procmon
B) top, netstat, lsof, ps
C) ps, top, nbstat, net use
D) rpcinfo, ldap, nbstat, ps

Question 48

Which of the following Linux permissions will allow the owner to have full access, the members of the group to have Read and Write access, and the world to have only Read access?

A) chmod 764 foo.sh
B) chmod 664 foo.sh
C) cacls u+rwx g+rx o+r
D) calcs ./foo.sh /G owner:RWX /G group:rx /G world:R

Question 49

Which of the following represents an OID?

A) S-1-5-7-341656734543-512
B) S-1-5-7-545632867586-1001
C) AD3424FDA31404EE
D) 1.2.1.1.1.2.1.3.1.4.6

Question 50

What are LSASS and GINA?

A) On a Linux system they are responsible for logins, much like PAM is for Windows
B) On a Windows system they manage SIDs and user account databases
C) On a Linux system they govern access to TCP based services along with Inetd and TCPWrappers
D) On a Windows host they comprise part of the authentication subsystem

Question 51

You are poking around in a Linux box and run the ls -l command and notice a curious entry:
_rwsr_xr_x 1 root users 381 2009-02-29 6:32 yes Which of the following statements is true? (Choose two)

A) The octal equivalent is of these permissions is 755 + SUID
B) The answer to the command was "yes" and the file requested does exist
C) The octal equivalent is of these permissions is 4755
D) The SGID bit is set and the file "yes" is executable with the root UID

Question 52

Shalicia wants to find all of the currently open connections on a Windows host; which command would provide this information?

A) netstats -an
B) netstat /an
C) nbtstat -an
D) nmap -sT -P0 -v [target ip]

Question 53

Edward is trying to locate the computers on a network by their computer names. What command line tool can he use? (Choose two)

A) Windows doesn't have a scanner that will help with discovery
B) He needs to install a tool first
C) He could use "net view" with no arguments
D) He could use the nbstat tool with the -r or -c or -n options to at least see names of machines he might have discovered via natural protocol behaviors

Question 54

Kevaun wants to find file shares on a remote system. Which of the following commands would provide this information?

A) netstat /an
B) nbtstat -A
C) net view \ \[servername]
D) nbstat -shares [target ip]

Question 55

Chris is using a Linux box and is also attempting to enumerate the network for computer names and shares. What command below would he run?

A) smbclient -L [target ip]
B) nbtstat -L [target ip]
C) net view \ \[domain]
D) Linux doesn't support Windows file sharing, so Chris is wasting his time

Question 56

From his Linux host, Kempton wants to connect to an unprotected share he has discovered. What should he do next (assuming he has a credential)?

A) smbclient \\\ \[target ip]\\c$ -U administrator
B) nbtstat \\[target ip]\c$ -u administrator
C) net view \\\\[target ip]\\ipc$ "" user : ""
D) Kempton cannot have a credential yet. He needs to read the system hacking chapter in the CEH courseware and try some of those techniques first.

Question 57

Joe extracts a SID using the tool "SIDExtracter." Which of the following SIDs has administrator privileges?
S-1-5-21-1147638176-875867241-945 Fred
S-1-5-21-1147638176-875867241-134 Paul
S-1-5-21-1147638176-875867241-777 Steve
S-1-5-21-1147638176-875867241-500 Liz

A) Fred
B) Paul
C) Steve
D) Liz

Question 58

What is a "NULL" user in the context of the Windows operating system?

A) An account with no user name or password
B) A user that has been disabled
C) The system user of the "NULL" service
D) An internal "loopback" user

Question 59

Sara has been asked to perform a port scan on a number of servers to check for access points that should not be running but would have elevated privileges. She is not familiar with port numbers and isn't sure how to scan only those that we know meet the scanning criteria. What advice would you give her?

A) She should scan 1-1023
B) She should scan 0-63535 just to be sure
C) She should scan 1-49151
D) She should consult the network documentation and avoid the scan altogether.

Question 60

When performing a pen test Russell have been asked to perform a thorough network footprint for small company of about 50 hosts. He checks the address of his own machine and notices that it is a class c. Knowing there are multiple network segments he runs the following command: nmap -sS -p 0-65535 -P0 -O 192.0.0.0/8 >> /root/footprint.nmap
Which of the following statements describes what Russell has done?

A) The -sS scan looks for "Services" and this is not compatible with the -P0 (Do not ping first) option
B) He shouldn't run a dangerous scan like this as root, otherwise its OK
C) He is being thorough just as his boss asked him to. This range will be sure to notice everything.
D) He tried to scan 65536 ports on about 16 Million addresses. This is excessive traffic and is not a good approach.

Question 61

Cade ran a scan on a system and could not identify the operating system. There does seem to be a webserver running though. How can that fact help Cade figure out the rest of the system?

A) Telnet to the open port an grab a banner
B) Use a browser to view the web page
C) Use an FTP client to connect to port 80 and observe the error messages
D) View the source code of the index.html page

Question 62

Cade ran a scan on a system and could not identify the operating system. There does seem to be a webserver running though. How can that fact help Cade figure out the rest of the system?

A) Telnet to the open port an grab a banner
B) Use a browser to view the web page
C) Use an FTP client to connect to port 80 and observe the error messages
D) View the source code of the index.html page

Question 63

Knowing ports is important for attackers, pentesters and analysts. On a windows system, what are the port numbers for the following protocols (in order)?
Kerberos, WINS, RPC, SMB Session, CIFS

A) 82, 42, 139, 135, 445
B) 88, 445, 42, 445, 139
C) 42, 88, 135, 139, 445
D) 88, 42, 135, 139, 445

Question 64

During the network footprinting phase it is often helpful to get information from DNS that can reveal hosts, which in turn reveal network segments and traceroute can reveal even more. Obtaining records like CNAME, MX, and A are examples of this. Of the following answers, what is the best way to describe what the attacker is looking for?

A) Zone harvest
B) Zone Poison
C) Zone transfer
D) Zone estimate

Question 65

Which of the following is an example of a UNC link?

A) \\server\share
B) UNC : / / server.com / share
C) file:\\unc.server.com\share
D) UNC shares can only be accessed via drive mapping, not addresses.