Web server footprinting is part of the reconnaissance phase in ethical hacking. It involves gathering detailed information about a web server's structure, external links, available directories, scripts, and technologies in use.
Techniques include:
* Spidering the site to map all accessible URLs and file paths
* Identifying hidden directories or backup files
* Analyzing page structures and URL patterns
This information helps attackers identify areas to target for further scanning or exploitation.
Incorrect Options:
* A. Vulnerability scanning is active testing, not passive footprinting.
* C. System-level data is gathered in OS or network footprinting.
* D. Brute-force attacks are exploitation techniques, not reconnaissance.
Reference - CEH v13 Official Courseware:
Module 02: Footprinting and Reconnaissance
Section: "Web Server Footprinting Techniques"
Tool Reference: HTTrack, Burp Spider, OWASP ZAP

In CEH v13 Module 06: Malware Threats, the Cyber Kill Chain is broken down into its seven stages:
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control
Actions on Objectives
Step 3 - Delivery:
Refers to the transmission of the malicious payload to the victim.
Can occur through email, web downloads, USB drives, etc.
Correct Example:
A). "An intruder sends a malicious attachment via email to a target" - This is delivery.
Other Options:
B). Weaponization
C). Exploitation
D). Installation
Reference:
Module 06 - Malware and Cyber Kill Chain Model
CEH Labs: Simulating Cyber Kill Chain Stages

Sniffing attacks are a type of network attack that involves intercepting and analyzing data packets as they travel over a network. Sniffing attacks can be used to steal sensitive information, such as usernames, passwords, credit card numbers, etc. Sniffing attacks can also be used to perform reconnaissance, spoofing, or man-in-the-middle attacks.
The IT department of the company has implemented some security measures to prevent or mitigate sniffing attacks, such as:
Adding the MAC address of the gateway to the ARP cache: This prevents ARP spoofing, which is a technique that allows an attacker to redirect network traffic to their own device by sending fake ARP messages that associate their MAC address with the IP address of the gateway.
Switching to IPv6 instead of IPv4: This reduces the risk of IP spoofing, which is a technique that allows an attacker to send packets with a forged source IP address, pretending to be another device on the network.
Using encrypted sessions such as SSH instead of Telnet, and Secure File Transfer Protocol instead of FTP:
This protects the data from being read or modified by an attacker who can capture the packets, as the data is encrypted and authenticated using cryptographic protocols.
However, these measures are not enough to completely eliminate the threat of sniffing, as an attacker can still use other techniques, such as:
Passive sniffing: This involves monitoring the network traffic without injecting any packets or altering the data. Passive sniffing can be done on a shared network, such as a hub, or on a switched network, using techniques such as MAC flooding, port mirroring, or VLAN hopping.
Active sniffing: This involves injecting packets or modifying the data to manipulate the network behavior or gain access to more traffic. Active sniffing can be done using techniques such as DHCP spoofing, DNS poisoning, ICMP redirection, or TCP session hijacking.
Therefore, the next step to enhance network security is to implement network scanning and monitoring tools, which can help detect and prevent sniffing attacks by:
* Scanning the network for unauthorized devices, such as rogue access points, hubs, or sniffers, and removing them or isolating them from the network.
* Monitoring the network for abnormal traffic patterns, such as excessive ARP requests, DNS queries, ICMP messages, or TCP connections, and alerting the network administrators or blocking the suspicious sources.
* Analyzing the network traffic for malicious content, such as malware, phishing, or exfiltration, and filtering or quarantining the infected or compromised devices.
References:
CEHv12 Module 05: Sniffing
Sniffing attacks - Types, Examples & Preventing it
How to Prevent and Detect Packet Sniffing Attacks
Understanding Sniffing in Cybersecurity and How to Prevent It

Blind SQL Injection is a type of SQL injection attack where no error messages or data are directly returned to the attacker. Instead, the attacker sends specially crafted SQL queries that result in true or false responses.
Based on how the application responds (such as redirecting to a different page or loading time), the attacker infers information about the backend database.
According to CEH v13:
* Blind SQLi is used when standard SQL injection yields no visible output.
* It comes in two forms:
* Boolean-based: Infers information based on application behavior.
* Time-based: Infers information based on server response time delays.
Incorrect Options:
* A. Time-based SQLi is a sub-type of Blind SQLi, but the question describes Boolean-based behavior.
* B. Union SQL injection uses the UNION keyword to fetch additional rows; requires visible output.
* C. Error-based SQL injection relies on database error messages.
Reference - CEH v13 Official Courseware:
Module 14: Hacking Web Applications
Section: "Types of SQL Injection"
Subsection: "Blind SQL Injection (Boolean and Time-Based)"

-A: Perform an aggressive scan which select most of the commonly used options within nmap
-Pn: Means Don't ping
-p:scan specific ports
-sT: TCP Connect scan
-O: Operating system detection
-T0: timing template (extremely slow- evade FW)0