In CEH v13 Module 11: Hacking Wireless Networks, WPS (Wi-Fi Protected Setup) is discussed as a vulnerable configuration that can be exploited using tools like Reaver and wash.
wash is a command-line utility used to detect WPS-enabled Access Points.
It provides information about:
Whether WPS is enabled or locked.
Signal strength, BSSID, channel, etc.
Very useful before attempting WPS PIN attacks.
Option Clarifications:
B). ntptrace: Used for querying NTP servers, not wireless networks.
C). macof: Part of dsniff suite; floods network with MAC addresses (DoS tool).
D). net view: Windows command for listing network shares, not for wireless or WPS.
Correct answer is A. wash.
Reference:
Module 11 - Wireless Tools: Reaver and wash
CEH iLabs: Using wash to Scan for WPS-enabled Devices

In CEH v13 Module 06: Malware Threats, a worm is described as a self-replicating piece of malware that spreads independently from one system to another without needing to attach itself to any file or program (unlike viruses).
Key Characteristics of Worms:
Capable of network propagation without human interaction.
Often used in mass attacks (e.g., WannaCry, Conficker).
Can cause significant damage by:
Consuming bandwidth.
Spreading payloads (e.g., ransomware).
Modifying or deleting files.
Option Clarification:
A: Rootkit: Hides presence of malware or attacker activities.
B: Trojan: Disguised as legitimate software; does not replicate.
C: Worm: Correct - self-replicating and spreads automatically.
D: Adware: Primarily shows ads; not typically destructive or self-replicating.
Reference:
Module 06 - Types of Malware # Worms
CEH iLabs: Network Infection with Self-Spreading Worms

In CEH v13 Module 03: Scanning Networks, under the Nmap Host Discovery Techniques, TCP SYN ping scan is explained as one of the methods used to determine whether a host is online by sending SYN packets to specified TCP ports.
When using Nmap:
* -PS specifies a TCP SYN ping scan. It sends SYN packets to a given port (by default port 80, unless specified) to check whether a host is up and whether the port is open.
* The response type to this SYN packet determines the host status:
* If a SYN/ACK is received, it indicates the port is open, and the host is up.
* If RST is received, the port is closed, but the host is still considered online.
* If no response or ICMP unreachable is received, the host may be down or filtered.
Clarification of options:
* A. -pp: This is not a valid Nmap option.
* B. -PO: This sends IP Protocol Ping, used less frequently and not the same as SYN ping.
* C. -PS: Correct. Performs a TCP SYN Ping Scan.
* D. -PA: Sends TCP ACK Ping, used to determine firewall presence but not the same as SYN scan.
Reference from CEH v13 Study Guide and Course Material:
* CEH v13 Official Module 03 - Scanning Networks, Slide: Nmap Host Discovery Techniques
* EC-Council iLabs - Scanning Networks Practical Lab Guide: Section on nmap -sn -PS
* Nmap Official Documentation (also referenced in CEH): https://nmap.org/book/man-host-discovery.
html

CHNTPW (Change NT Password) is a Linux-based utility that allows attackers or administrators to:
Reset Windows user account passwords
Unlock disabled or locked user accounts
Remove password protection without knowing the original password
It works by editing the Windows SAM (Security Account Manager) file located in the Windows system directory.
Reference - CEH v13 Official Study Guide:
Module 5: System Hacking
Quote:
"CHNTPW is a tool that can reset or change passwords on Windows systems by directly editing the SAM database. It is commonly run from a Linux LiveCD." Incorrect Options:
A). John the Ripper is for cracking passwords, not resetting them directly.
B). SET (Social Engineering Toolkit) is for phishing and payloads, not password resets.
D). Cain & Abel is a password recovery tool for Windows but runs on Windows, not Linux.

Passive sniffing refers to listening to or capturing network traffic without sending any packets or altering the communication stream. The attacker's system operates in "promiscuous mode" to monitor all traffic flowing through the network segment. This technique is mostly used in environments like hub-based or unencrypted Wi-Fi networks, where traffic is visible to all systems.
According to the CEH v13 Official Courseware, Module 08: Sniffing, under the subsection "Passive Sniffing", the following capabilities are associated with passive sniffing:
* Capturing unencrypted credentials (usernames and passwords)
* Identifying protocols, services, IP addresses, and hostnames
* Monitoring HTTP sessions, cookies, and other clear-text traffic
* Gathering detailed information for fingerprinting and enumeration
* Exporting traffic to PCAPs for forensic and offline analysis
However, passive sniffing does not involve any active interference with the traffic. Therefore, actions like
"modifying and replaying" packets require an attacker to craft and inject packets into the network - this is considered active sniffing or traffic manipulation, which is out of scope for passive techniques.
Thus:
* Option A: Valid for passive sniffing (host discovery via captured traffic)
* Option B: Invalid for passive sniffing (requires active traffic manipulation)
* Option C: Valid (if data is unencrypted)
* Option D: Valid (captures traffic for offline review)
Reference - CEH v13 Official Courseware:
* Module 08: Sniffing
* Section: "Passive Sniffing vs Active Sniffing"
* Study Guide Pages: Usually found under "Types of Sniffing Techniques"
* CEH iLabs/Engage Scenarios: Packet capture and Wireshark lab modules