In CEH v13 Module 05: System Hacking, once an attacker gains access to hashed passwords, cracking tools are employed to reverse or brute-force them.
Tool Breakdown:
John the Ripper: A powerful password cracking tool that supports many hash formats.
Hashcat: GPU-based, extremely fast password hash cracking tool.
THC-Hydra: Used for online attacks (e.g., SSH, FTP brute force).
Netcat: Not a password cracking tool - it's a network utility used for:
Remote shell connections
Banner grabbing
File transfers
Port scanning
Therefore:
C). Netcat is the correct answer - it is not used for password cracking.
Reference:
Module 05 - Password Cracking Techniques and Tools
CEH Labs: Using Hashcat and John the Ripper on Extracted Hashes

In a man-in-the-middle (MITM) attack, an attacker intercepts communication between two parties and can read, alter, or inject data without either party knowing. Susan's actions - intercepting and modifying her boss's session data before relaying it to the server - is the classic MITM pattern.
From CEH v13 Official Courseware:
* Module 8: Sniffing
* Module 11: Session Hijacking
CEH v13 Study Guide states:
"In a MITM attack, the attacker positions themselves between two communicating parties, relaying and possibly altering communications while maintaining the illusion that the parties are communicating directly." Incorrect Options:
* A: Sniffing only involves passive listening.
* B: Spoofing may involve impersonation but not necessarily interception and relay.
* D: DoS is about service disruption, not data interception.
Reference:CEH v13 Study Guide - Module 8: MITM AttacksRFC 4949 - Internet Security Glossary

The longer an adversary has this level of access, the greater the impact. Defenders must detect this stage as quickly as possible and deploy tools which can enable them to gather forensic evidence. One example would come with network packet captures, for damage assessment. Only now, after progressing through the primary six phases, can intruders take actions to realize their original objectives. Typically, the target of knowledge exfiltration involves collecting, encrypting and extracting information from the victim(s) environment; violations of knowledge integrity or availability are potential objectives also . Alternatively, and most ordinarily , the intruder may only desire access to the initial victim box to be used as a hop point to compromise additional systems and move laterally inside the network. Once this stage is identified within an environment, the implementation of prepared reaction plans must be initiated. At a minimum, the plan should include a comprehensive communication plan, detailed evidence must be elevated to the very best ranking official or board , the deployment of end-point security tools to dam data loss and preparation for briefing a CIRT Team. Having these resources well established beforehand may be a "MUST" in today's quickly evolving landscape of cybersecurity threats