Detailed Explanations for Questions 351-375
Q351, Q352, Q353. What tool would you use to conduct banner grabbing?
- A. aescrypt
- B. Ettercap
- C. netstat
- D. Telnet ✓
Why D is correct: The Telnet client can connect to any TCP port regardless of the protocol running on that port. When you connect to a service (e.g., telnet target.com 80), Many services automatically send a banner containing software name, version, and configuration details. For example, connecting to an SMTP server might return “220 mail.example.com ESMTP Postfix”, revealing the mail server software. This makes Telnet a simple, universal tool for banner grabbing without requiring specialized software.
Why others are incorrect:
- A: aescrypt is a file encryption utility used to encrypt/decrypt files, not a network reconnaissance tool
- B: Ettercap is designed for man-in-the-middle attacks, ARP spoofing, and network sniffing—not for connecting to services to grab banners
- C: netstat displays local network connection statistics, listening ports, and routing tables on the local machine; it cannot connect to remote services to retrieve banners
Q354, Q355. As part of hardening a server, which of the following would the administrator want to configure prior to putting it into the DMZ?
- A. Disable unnecessary ports ✓
- B. Open all ports
- C. Disable all accounts
- D. Reduce file restrictions
Why A is correct: Server hardening follows the principle of least functionality—enabling only what is strictly necessary. Disabling unnecessary ports reduces the attack surface by closing potential entry points that attackers could exploit. A server in the DMZ is exposed to untrusted networks, so minimizing exposed services is critical for security.
Why others are incorrect:
- B: Opening all ports would dramatically increase the attack surface, exposing every possible service to potential exploitation—the exact opposite of hardening
- C: Disabling all accounts would render the server unusable; proper hardening involves disabling unnecessary accounts while enforcing strong authentication and least privilege on required accounts
- D: Reducing file restrictions would weaken security controls; hardening involves tightening file permissions, not loosening them
Q356, Q357, Q360. What tool could you use if you wanted to identify directories that did not show up in the spider of a website?
- A. Wireshark
- B. DIRB ✓
- C. Kismet
- D. Setoolkit
Why B is correct: DIRB is a web content scanner that performs brute-force directory and file enumeration against web servers. It uses wordlists to try common directory names (e.g., /admin, /backup, /config) and reports which ones return valid HTTP responses. This is essential for finding hidden resources that aren’t linked from the main site and therefore wouldn’t be discovered by a standard web spider/crawler.
Why others are incorrect:
- A: Wireshark is a packet analyzer for capturing and inspecting network traffic at the packet level; it cannot brute-force web directories
- C: Kismet is a wireless network detector, sniffer, and intrusion detection system for 802.11 networks—not a web application testing tool
- D: Setoolkit (Social Engineer Toolkit) is designed for social engineering attacks like phishing campaigns and credential harvesting, not web directory enumeration
Q358, Q359. You are trying to black box test a web application, but it’s being resistant to attack because of an authentication page at the top. What tool would you not use to find some direct access pages?
- A. Metasploit
- B. hping3 ✓
- C. dirb
- D. Burp Suite
Why B is correct: hping3 is a packet crafting and network-level testing tool used for port scanning, firewall rule testing, and custom packet generation. It operates at the network/transport layer and lacks web application-specific functionality like HTTP request manipulation, directory brute-forcing, or session handling. It cannot effectively discover hidden web pages or bypass authentication mechanisms at the application layer.
Why others are incorrect:
- A: Metasploit includes web application scanning modules (e.g.,
auxiliary/scanner/http) that can enumerate directories, test for vulnerabilities, and potentially find direct access pages even behind authentication - C: dirb is specifically designed for brute-forcing web directories and would be highly effective at finding hidden pages that bypass the authentication gate
- D: Burp Suite is a comprehensive web application security testing platform with proxy, spider, intruder (brute-force), and scanner modules specifically designed for this type of testing
Q361-Q375. Which of the following tools can be used to DDoS a target system?
- A. LOIC ✓
- B. SIMM
- C. Cain & Abel
- D. AOL Punter
Why A is correct: LOIC (Low Orbit Ion Cannon) is a network stress testing application that can flood a target with high volumes of TCP, UDP, or HTTP requests. While it has legitimate uses for load testing, it’s widely known for its role in DDoS attacks because it can be operated manually or coordinated with other instances via “hive mind” mode to amplify attack traffic from multiple sources.
Why others are incorrect:
- B: SIMM (Single In-line Memory Module) is a type of computer RAM hardware, not a software tool—this is a distractor answer
- C: Cain & Abel is a Windows-based password recovery and network sniffing tool used for credential harvesting and ARP spoofing, not for generating DDoS traffic
- D: AOL Punter is not a recognized security, networking, or DDoS tool—this appears to be a fabricated distractor
Key Takeaways for Module 13: Hacking Web Servers
- Banner Grabbing: Use Telnet, Netcat, or Nmap (
-sV) to connect to open ports and retrieve service banners that reveal software versions and configurations. - Server Hardening: Always disable unnecessary ports, services, and accounts before deploying to a DMZ. Follow the principle of least functionality.
- Web Directory Enumeration: Tools like DIRB, Gobuster, or Dirbuster brute-force common directory names to find hidden resources not linked from the main site.
- Web Application Testing: Use application-layer tools (Burp Suite, OWASP ZAP, Metasploit web modules) for web testing—not network-level tools like hping3.
- DDoS Tools: LOIC is a known DDoS tool; understand its capabilities and how defenders can detect/mitigate such attacks.
- Tool Selection: Match the tool to the task—packet analyzers (Wireshark) for traffic inspection, web scanners (DIRB) for directory enumeration, social engineering tools (SET) for phishing.
