312-50v13 Exam Dumps - Certified Ethical Hacker Exam (CEHv13)

Comprehensive and Detailed Explanation:

The attack shown is a Directory Traversal Attack. It uses URL encoding (hexadecimal obfuscation) to bypass input filters and access unauthorized files such as /etc/passwd.

%2e = . (dot)

%2f = / (forward slash)

So, ../../../etc/passwd becomes %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64

The best protection against this attack is to:

Normalize and sanitize user input on the server.

Deny directory traversal patterns, whether encoded or not.

Specifically reject or deny hex-encoded path characters (%2e, %2f, etc.)

Option A directly mitigates this by preventing the server from decoding and processing hex-encoded directory traversal attempts.

From CEH v13 Courseware:

Module 10: Web Application Hacking

Topic: Directory Traversal and Input Validation

Incorrect Options:

B: IDS can alert, but it’s reactive rather than preventative.

C: SSL encrypts communication but does not prevent path traversal.

D: Active script detection is unrelated to path traversal attacks.

DNS spoofing (also known as DNS cache poisoning) occurs when an attacker intercepts or falsifies DNS responses to redirect traffic or exfiltrate data. The appropriate way to prevent such attacks includes:

Implementing DNS anti-spoofing techniques

Using DNSSEC (DNS Security Extensions)

Ensuring proper DNS configurations and validation of responses

From CEH v13:

Module 3: Scanning Networks

Topic: DNS Poisoning and Spoofing Attacks

Defensive Measures: DNS Hardening

CEH v13 Study Guide states:

“To prevent DNS spoofing and cache poisoning, organizations should use DNSSEC, configure anti-spoofing protections, and restrict zone transfers. DNS Anti-spoofing solutions validate responses and ensure data integrity.”

Incorrect Options:

A: Logging may detect but not prevent.

B: Disabling DNS timeouts is unrelated and harmful.

D: Prevents zone transfers, not spoofing specifically.

In CEH v13 Module 13: Hacking Web Applications, this exact payload is an example of an XXE (XML External Entity) Attack.

XXE Attack:

Exploits the way XML parsers process DOCTYPE declarations.

The payload references a local file (/etc/passwd), allowing local file inclusion.

Can result in sensitive file disclosure, SSRF, or Denial of Service (DoS).

Option Clarification:

A. XXE: Correct – targets vulnerable XML parsers.

B. SQLi: Targets SQL databases with ' OR '1'='1-type injections.

C. IDOR: Insecure Direct Object Reference, not related to XML.

D. XSS: Cross-site scripting; this is XML-based, not JavaScript injection.

Windows TTL 128, Linux TTL 64, OpenBSD 255 ... https://subinsb.com/default-device-ttl-values/

Time to Live (TTL) represents to number of 'hops' a packet can take before it is considered invalid. For Windows/Windows Phone, this value is 128. This value is 64 for Linux/Android.

File system permissions

Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.

File created by Bash, a Unix-based shell program commonly used on Mac OS X and Linux operating systems; stores a history of user commands entered at the command prompt; used for viewing old commands that are executed.

BASH_HISTORY files are hidden files with no filename prefix. They always use the filename .bash_history.

NOTE: Bash is that the shell program employed by Apple Terminal.

Our goal is to assist you understand what a file with a *.bash_history suffix is and the way to open it.

The Bash History file type, file format description, and Mac and Linux programs listed on this page are individually researched and verified by the FileInfo team. we attempt for 100% accuracy and only publish information about file formats that we’ve tested and validated.

A hybrid attack is a method that combines the dictionary attack with brute-force techniques. It starts with a list of known words (like in a dictionary attack) and then mutates them by:

Appending or prepending numbers (e.g., password1, 123hello)

Adding special characters (e.g., P@ssword!, admin#123)

Varying letter casing or leetspeak (e.g., h@x0r)

From CEH v13 Courseware:

Module 6: Malware Threats → Password Cracking Methods

Incorrect Options:

B: Linear is not a password cracking method.

C: Symmetric refers to encryption, not password cracking.

D: Brute-force tries every possible combination but does not start with a word list.

Pharming is a cyberattack technique in which malicious code is used to redirect a website’s traffic to a fraudulent or malicious website without the user's knowledge. This redirection typically occurs through:

DNS poisoning or host file modification

Exploitation of vulnerabilities in DNS servers or user machines

Pharming aims to collect sensitive data (like usernames, passwords, credit card details) by making users believe they are interacting with a legitimate website when, in fact, they are on a fake one.

As per CEH v13 Official Courseware:

Pharming is a server-side or client-side attack that manipulates how URLs are resolved.

It differs from phishing in that it does not rely on fake emails or social engineering but rather on redirecting web traffic via compromised DNS infrastructure or local configuration.

Incorrect Options:

A. Spimming is the use of spam over instant messaging.

C. Phishing involves tricking users through fake emails or messages.

D. Spear-phishing is a targeted version of phishing directed at specific individuals or roles.

Reference – CEH v13 Official Courseware:

Module 09: Social Engineering

Section: “Phishing and Pharming Attacks”

Subsection: “Differences Between Phishing and Pharming”