A TCP/IP hijack is an attack that spoofs a server into thinking it's talking with a sound client, once actually it' s communication with an assaulter that has condemned (or hijacked) the tcp session. Assume that the client has administrator-level privileges, which the attacker needs to steal that authority so as to form a brand new account with root-level access of the server to be used afterward. A tcp Hijacking is sort of a two-phased man- in-the-middle attack. The man-in-the-middle assaulter lurks within the circuit between a shopper and a server so as to work out what port and sequence numbers are being employed for the conversation.
First, the attacker knocks out the client with an attack, like Ping of Death, or ties it up with some reasonably ICMP storm. This renders the client unable to transmit any packets to the server. Then, with the client crashed, the attacker assumes the client's identity so as to talk with the server. By this suggests, the attacker gains administrator-level access to the server.
One of the most effective means of preventing a hijack attack is to want a secret, that's a shared secret between the shopper and also the server. looking on the strength of security desired, the key may be used for random exchanges. this is often once a client and server periodically challenge each other, or it will occur with each exchange, like Kerberos.

The scenario describes a situation where a hacker infects an internet-facing server and leverages it to perform malicious activities such as sending spam emails, participating in distributed denial-of-service (DDoS) attacks, or hosting spam content. This behavior is characteristic of a Botnet Trojan.
According to the CEH v13 Official Courseware and Study Guide:
* A Botnet Trojan is a type of malware that transforms infected machines into bots (also called zombies), which can be remotely controlled by an attacker (bot herder or bot master).
* These bots become part of a botnet - a network of compromised machines used for coordinated cyberattacks including:
* Sending unsolicited spam emails (junk mail)
* Participating in DDoS attacks
* Hosting or distributing malware and phishing content
* The infected machine can receive commands from a command-and-control (C&C) server and act in concert with other infected machines to amplify attacks or spread malware.
Incorrect Options:
* B. Banking Trojans are designed specifically to steal financial data such as online banking credentials.
* C. Turtle Trojans is not a valid classification in CEH v13 or cybersecurity literature (may be a distractor).
* D. Ransomware Trojans encrypt data and demand a ransom for decryption, not typically used for junk mail or botnet activities.
Reference - CEH v13 Official Courseware:
* Module 06: Malware Threats
* Section: "Types of Trojans"
* Subsection: "Botnet Trojans"
* CEH v13 eBook or Study Guide - usually found under "Trojan Classifications by Payload" Practical labs in CEH Engage and iLabs also demonstrate botnet functionality using tools like Zeus and Emotet in real-world botnet infection scenarios.

TCP port 21 is used by the File Transfer Protocol (FTP), which is an unencrypted protocol. To detect if unencrypted file transfers are taking place, you can apply the Wireshark display filter:
tcp.port == 21
This will show all traffic to and from FTP servers. Since FTP transmits usernames, passwords, and data in clear text, its use would violate the company's policy.
CEH v13 states:
"FTP (Port 21) is a cleartext protocol vulnerable to sniffing. To enforce secure communication, companies often transition to SFTP (over SSH, port 22) or FTPS (FTP over TLS/SSL)." Incorrect Options:
* B. Port 23 is used for Telnet, not FTP.
* C. Combining FTP (21) and SSH/SFTP (22) would include encrypted traffic, which is not what you're trying to isolate.
* D. tcp.port != 21 filters out FTP traffic, which is the opposite of the intended goal.
Reference - CEH v13 Guide:
Module 01: Introduction to Ethical Hacking
Subsection: Sniffing and Cleartext Protocols
Wireshark iLab: Identifying FTP Traffic

Cloud-based antivirus relies on data collected from endpoint devices and sends that data to cloud servers for real-time malware analysis. This allows rapid updates and detection of new threats without waiting for local signature updates.
# Reference - CEH v13 Official Study Guide, Module 20: Cryptography and Malware
"Cloud-based detection systems analyze suspicious files and behaviors in the provider's environment, enabling faster response and reduced endpoint resource usage."
# Incorrect options:
A). Behavioral-based detection monitors live activity locally.
B). Heuristic-based detection uses rules or behavior patterns locally.
C). Honeypots are decoys for detecting attackers, not antivirus methods.

The hacker could have used the technique of manipulating white spaces in SQL queries to bypass signature detection. This technique involves inserting, removing, or replacing white spaces in SQL queries with other characters or symbols that are either ignored or interpreted as white spaces by the SQL engine, but not by the signature-based IDS. This way, the hacker can alter the appearance of the query and evade the pattern matching of the IDS, while preserving the functionality and logic of the query. For example, the hacker could replace the space character with a tab character, a newline character, a comment symbol, or a URL-encoded value, such as %2012.
The other options are not correct for the following reasons:
* A. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing: This option is not feasible because the char encoding function is not supported by all SQL engines, and it may not be able to convert all hexadecimal and decimal values into valid characters. Moreover, the char encoding function may not be able to bypass the signature detection of the IDS, as it may still match the keywords or syntax of the SQL query3.
* B. Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form:
This option is not effective because the URL encoding method is not applicable to SQL queries, as it is designed for encoding special characters in URLs. The URL encoding method may not be able to replace all characters with their ASCII codes, and it may not be able to preserve the functionality and logic of the SQL query. Furthermore, the URL encoding method may not be able to evade the signature detection of the IDS, as it may still match the keywords or syntax of the SQL query4.
* C. Implementing sophisticated matches such as "OR 'john' = john" in place of classical matches like
"OR 1-1": This option is not advanced because it is a common and basic SQL injection technique that does not involve any evasion or obfuscation. This technique involves injecting a logical expression that is always true, such as "OR 'john' = john" or "OR 1-1", to bypass the authentication or authorization checks of the SQL query. However, this technique may not be able to bypass the signature detection of the IDS, as it may easily match the keywords or syntax of the SQL query.
References:
1: SQL Injection Evasion Detection - F5
2: Mastering SQL Injection with SQLmap: A Comprehensive Evasion Techniques Cheatsheet
3: SQL Injection Prevention - OWASP Cheat Sheet Series
4: URL Encoding - W3Schools
5: SQL Injection - OWASP Foundation