"Boolean based" we mean that it is based on Boolean values, that is, true or false / true and false. AND Time- based SQL Injection is an inferential SQL Injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time (in seconds) before responding. The response time will indicate to the attacker whether the result of the query is TRUE or FALSE.
Boolean-based (content-based) Blind SQLi
Boolean-based SQL Injection is an inferential SQL Injection technique that relies on sending an SQL query to the database which forces the application to return a different result depending on whether the query returns a TRUE or FALSE result.
Depending on the result, the content within the HTTP response will change, or remain the same. This allows an attacker to infer if the payload used returned true or false, even though no data from the database is returned. This attack is typically slow (especially on large databases) since an attacker would need to enumerate a database, character by character.
Time-based Blind SQLi
Time-based SQL Injection is an inferential SQL Injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time (in seconds) before responding.
The response time will indicate to the attacker whether the result of the query is TRUE or FALSE.
Depending on the result, an HTTP response will be returned with a delay, or returned immediately. This allows an attacker to infer if the payload used returned true or false, even though no data from the database is returned. This attack is typically slow (especially on large databases) since an attacker would need to enumerate a database character by character.
https://www.acunetix.com/websitesecurity/sql-injection2/

Windows 2000 and newer systems use Kerberos as their default authentication protocol rather than NTLM or LM challenge/response over SMB. Kerberos is encrypted and does not rely on the older SMB logon exchange methods that L0phtCrack can sniff.
From CEH v13 Courseware:
* Module 6: Malware and Password Attacks
* Module 4: Enumeration
CEH v13 Study Guide states:
"Kerberos is the default authentication protocol in Windows 2000 and newer systems. It encrypts communication and is not vulnerable to the same sniffing attacks that work against LM/NTLM challenge- response mechanisms." Incorrect Options:
* A: While a NIDS may detect traffic, it doesn't prevent sniffing.
* C: Logons can be sniffed in older systems using NTLM.
* D: L0phtCrack does not sniff web logons-it targets SMB and Windows logins.
Reference:CEH v13 Study Guide - Module 6: Password Sniffing TechniquesMicrosoft TechNet - Overview of Kerberos Authentication

Social engineering is a non-technical attack that manipulates human behavior to gain access to systems or data. It often involves deception (e.g., phishing, pretexting, baiting) and requires no technical expertise or tools, making it a low-tech yet highly effective method.
Reference - CEH v13 Official Study Guide:
Module 9: Social Engineering
Quote:
"Social engineering exploits human psychology and trust to gain unauthorized access. It is considered a low- tech method because it does not require technical means." Incorrect Options Explained:
B: Eavesdropping may require technical tools to intercept data.
C: Scanning involves active use of tools to find vulnerabilities.
D: Sniffing is technical and requires tools to capture network traffic.

In CEH v13 Module 03: Scanning Networks, Nmap's evasion techniques are discussed for bypassing or confusing Intrusion Detection Systems (IDS) and firewalls.
The -D option in Nmap is used to enable decoy scanning. It inserts false IP addresses in the scan to obfuscate the true origin of the scan.
This technique helps in masking the attacker's IP and can confuse IDS logs.
Option Clarification:
A: -n/-R: Disables DNS resolution (-n) or uses reverse DNS (-R), does not evade detection.
B: -0N/-0X/-0G: Output formats (normal, XML, grepable), not related to evasion.
C: -T: Controls timing (e.g., -T0 is stealthy, -T5 is aggressive), but not explicitly for IDS evasion.
D: Correct. Used for IDS/firewall evasion by using decoy IPs.
Reference:
Module 03 - Scanning with Evasion Options
Nmap Official Docs: https://nmap.org/book/man-bypass-firewalls-ids.html

The honey trap is a technique where an attacker targets a person online by pretending to be an attractive person and then begins a fake online relationship to obtain confidential information about the target company.
In this technique, the victim is an insider who possesses critical information about the target organization.
Baiting is a technique in which attackers offer end users something alluring in exchange for important information such as login details and other sensitive data. This technique relies on the curiosity and greed of the end-users. Attackers perform this technique by leaving a physical device such as a USB flash drive containing malicious files in locations where people can easily find them, such as parking lots, elevators, and bathrooms. This physical device is labeled with a legitimate company's logo, thereby tricking end-users into trusting it and opening it on their systems. Once the victim connects and opens the device, a malicious file downloads. It infects the system and allows the attacker to take control.
For example, an attacker leaves some bait in the form of a USB drive in the elevator with the label "Employee Salary Information 2019" and a legitimate company's logo. Out of curiosity and greed, the victim picks up the device and opens it up on their system, which downloads the bait. Once the bait is downloaded, a piece of malicious software installs on the victim's system, giving the attacker access.