Sherlock is the correct choice because it is specifically designed for OSINT-style username enumeration across a very large number of websites. In CEH-aligned reconnaissance, one common task is "alias correlation," where the tester checks whether the same username exists across multiple social networks, forums, and content platforms. Sherlock automates this by querying many supported sites and reporting where an account with a given username appears to exist. This directly matches the question's requirement: "cross- platform username correlation by scanning hundreds of social networking sites." The prompt also specifies what the tool does not do: it "does not natively support geolocation tracking or visualizing identity relationships." That limitation aligns with Sherlock's role as a focused username discovery tool rather than an analysis platform. By comparison, Creepy is associated with geolocation- focused OSINT, particularly collecting and correlating location metadata from social media posts and images, which is the opposite of the stated limitation. Maltego is well known for relationship analysis and link visualization, allowing investigators to build graphs of people, emails, domains, and social entities-again contradicting the "does not visualize identity relationships" constraint. Social Searcher is more oriented toward searching and monitoring public social media content and mentions, not primarily high-volume username existence checking across hundreds of sites in the same manner.
In CEH reconnaissance workflows, Sherlock fits early-stage enumeration to expand a target's footprint, after which analysts may pivot into tools like Maltego for link analysis or geolocation tools when location exposure is part of the assessment.

The correct answer is D. Ciphertext-Only Attack.
A ciphertext-only attack occurs when the attacker has access only to encrypted data and does not have the corresponding plaintext or the ability to choose plaintext/ciphertext pairs. That exactly matches the scenario:
the attacker has encrypted database backups but no keys and no known plaintext records.
CEH-aligned cryptography material defines a ciphertext-only attack as a cryptographic attack where the cryptanalyst has access to ciphertext but does not have access to the corresponding plaintext. The attacker attempts to recover plaintext or infer the key from encrypted output alone .
Option A. Chosen-Ciphertext Attack is incorrect because the attacker would need to choose ciphertexts and observe their decrypted plaintexts.
Option B. Known-Plaintext Attack is incorrect because the attacker would need both plaintext and corresponding ciphertext.
Option C. Chosen-Plaintext Attack is incorrect because the attacker would need the ability to choose plaintexts and obtain their ciphertexts.
Option D. Ciphertext-Only Attack is correct because the attacker only possesses encrypted data.
Therefore, the best answer is D. Ciphertext-Only Attack.

Colasoft Packet Builder is specifically designed for creating and editing custom packets, making it the best match for a scenario where the tester "crafts custom network packets" and "carefully designs their headers" to test or evade firewall filtering. In CEH methodology, packet crafting is a common technique used to validate how filtering devices respond to unusual or borderline traffic patterns, including altered TCP flags, manipulated fragmentation behavior, spoofed fields, and protocol edge cases. A packet builder tool enables precise control over Layer 2 through Layer 4 fields and, in many cases, supports building application payloads as well. This supports testing for weaknesses such as overly permissive rules, inconsistent state handling, improper reassembly, and inadequate normalization that could allow malicious traffic to pass.
Metasploit is primarily an exploitation framework used to deliver payloads and run modules after targets and weaknesses are identified. While it can generate traffic, it is not the most direct tool for low-level, manual header crafting as described. Nmap is mainly used for host discovery, port scanning, service detection, and scripting-based enumeration; it can manipulate some packet characteristics, but its core purpose is not interactive custom packet construction. Traffic IQ Professional is typically associated with network analysis and traffic monitoring rather than crafting bespoke packets to probe firewall rule behavior.
Therefore, the tool most aligned with CEH-style custom packet creation for firewall evasion testing is Colasoft Packet Builder.

This scenario describes Linear Cryptanalysis, a technique detailed in CEH v13 Cryptography. Linear cryptanalysis involves finding linear approximations that relate plaintext bits, ciphertext bits, and key bits using XOR operations. By analyzing a large number of known plaintext-ciphertext pairs, attackers can identify statistical biases that reveal information about the secret key.
CEH v13 explains that linear cryptanalysis differs from differential cryptanalysis in its approach. While differential cryptanalysis studies how differences in plaintext affect differences in ciphertext, linear cryptanalysis focuses on linear relationships and probability distributions.
The mention of XOR combinations and statistical analysis of plaintext-ciphertext pairs directly aligns with linear cryptanalysis. Brute-force attacks attempt all keys without analysis. Differential cryptanalysis focuses on input differences, not linear equations. Side-channel attacks exploit physical characteristics such as power consumption or timing.
Modern block ciphers like AES are designed to resist linear cryptanalysis by ensuring that linear approximations occur with probabilities close to random. CEH v13 highlights linear cryptanalysis as a foundational attack method used to evaluate cipher strength.
Therefore, Option C is correct.

According to the Certified Ethical Hacker (CEH) attack methodology, once reconnaissance, footprinting, and website mirroring have been completed, the attacker proceeds cautiously to exploitation while maintaining stealth. CEH documentation emphasizes that low-noise, application-layer attacks are preferable when the objective is to minimize detection.
Option B, attempting SQL Injection, aligns directly with CEH's Web Application Hacking module. SQL Injection is a server-side attack that can often be executed through normal-looking HTTP requests, making it less likely to trigger intrusion detection systems (IDS) or security alerts. CEH materials highlight SQL injection as a common and effective technique for extracting sensitive data such as usernames, passwords, and business-critical information without disrupting server operations.
Option A is incorrect because immediately modifying server configuration files after session hijacking significantly increases the risk of detection. CEH guidelines stress post-exploitation restraint, especially during red team operations.
Option C is not ideal at this stage because automated vulnerability scanners generate substantial traffic and are highly detectable. CEH explicitly notes that vulnerability scanning is noisy and often logged.
Option D is the least stealthy option. Brute-force attacks generate numerous failed authentication attempts, triggering security alerts and account lockouts. CEH classifies brute-force attacks as high-risk and easily detectable.
Therefore, SQL Injection represents the most effective and stealthy next step in accordance with CEH's structured attack lifecycle.