CEH flashcards

Completes the full three-way handshake on each port. Reliable and needs no special privileges, but every connection can land in the target's logs.

A SYN/ACK reply means open, a RST means closed. The scanner never finishes the handshake, so fewer application logs record it; also called a stealth scan.

Probes without a SYN. Under the TCP standard a closed port answers RST and an open one stays silent. Windows hosts answer RST either way, so results there cannot be trusted.

Infers port state from a third host's IP ID counter, so the target only ever sees the zombie's address. Hosts with randomized IP IDs make useless zombies.

Maps firewall filtering: an unfiltered port answers RST, a filtered one stays silent or returns an ICMP error. It cannot tell open from closed.

No handshake to read. An ICMP port-unreachable reply means closed; silence means open or filtered. Slow, because silence means waiting out timeouts.

Ports 137–139 (name, datagram and session services). Exposes computer names, workgroups and shares. Defense: turn off NetBIOS over TCP/IP where nothing needs it.

UDP 161, traps on 162. Default community strings let anyone read device and account data. Defense: change the defaults, move to SNMPv3.

TCP 389, or 636 for LDAPS. Anonymous binds expose users, groups and directory structure. Defense: block anonymous binds, require LDAPS.

UDP 123. A time server can reveal the hosts that sync with it. Defense: restrict who may query it.

TCP 25. The VRFY and EXPN verbs confirm which mailboxes exist. Defense: disable both and answer valid and invalid users the same way.

TCP 53. An unrestricted transfer hands over the whole zone, every host name at once. Defense: allow transfers only to your own secondary servers.

Fills a switch's CAM table with fake addresses until it floods frames out of every port. Defense: port security, capping MAC addresses per port.

Forged ARP replies tie the attacker's MAC to another host's IP, putting the attacker in the middle. Defense: Dynamic ARP Inspection, checked against DHCP snooping bindings.

Drains the address pool with fake requests, often to make room for a rogue DHCP server. Defense: DHCP snooping with trusted ports, plus port security.

Precomputed hash-to-password lookups for offline cracking. Defense: a unique salt per password makes the precomputation worthless.

One or two common passwords tried across many accounts, staying under lockout thresholds. Defense: MFA and alerts on failures spread across accounts.

Username and password pairs leaked from one site replayed on another. Defense: MFA and screening new passwords against breached-password lists.

The attacker plants a known session ID before the victim logs in, then reuses it. Defense: issue a fresh session ID at authentication.

User input changes the structure of a database query. Primary defense: parameterized queries, backed by input validation and least-privilege database accounts.

A virus attaches to a host file and spreads when that file runs. A worm copies itself across networks with no host file and no user action.

Malware disguised as something the user wants. It does not replicate; the victim installs it.

Hides itself and other malware by modifying the operating system, sometimes the kernel. A scan from trusted, offline media is the reliable way to spot it.

Runs in memory and through legitimate system tools, leaving little on disk for signature scanners. Behavior monitoring is the countermeasure.

Polymorphic: encrypted body and a mutating decryptor around the same core code. Metamorphic: rewrites its entire code each generation.

Symmetric: one shared key, fast, for bulk data (AES). Asymmetric: a public and private key pair, slower, for key exchange and signatures (RSA, ECC).

A one-way, fixed-length digest that proves integrity. SHA-256 is current; MD5 and SHA-1 are broken for collisions.

A hash signed with the sender's private key and checked with their public key. Integrity, authentication and non-repudiation, with no confidentiality.

Both report revoked certificates. A CRL is a list the CA publishes periodically; OCSP answers a live query about one certificate.

Steganography hides that a message exists; cryptography hides what it says. Steganalysis is detecting the hidden message.