eJPT Network Attacks 3 — Questions and Answers
Question 1: What does the Responder tool primarily exploit on Windows networks?
- SMB signing misconfigurations
- LLMNR and NBT-NS name resolution broadcasts (Correct answer)
- Kerberos ticket weaknesses
- NTLM relay via HTTP
Correct answer: LLMNR and NBT-NS name resolution broadcasts
Responder listens for LLMNR and NBT-NS broadcast queries and responds with the attacker's IP to capture NTLMv2 hashes.
Question 2: In a network capture, you see repeated ICMP Type 3 Code 3 messages. What do these indicate?
- Host unreachable
- Network unreachable
- Port unreachable (Correct answer)
- Time to live exceeded
Correct answer: Port unreachable
ICMP Type 3 Code 3 means 'Destination Port Unreachable,' typically seen when a UDP packet hits a closed port.
Question 3: Which attack technique involves sending a large number of UDP packets to random ports on a target to consume resources?
- Smurf attack
- UDP flood (Correct answer)
- Teardrop attack
- Fraggle attack
Correct answer: UDP flood
A UDP flood overwhelms a target by forcing it to process and respond with ICMP port-unreachable messages for each unexpected UDP packet received.
Question 4: When using Wireshark to analyze traffic during an ARP spoofing attack, what is the key indicator in the ARP packets?
- Duplicate IP addresses in ARP replies
- Two different IPs sharing the same MAC address (Correct answer)
- A MAC address appearing in both sender and target fields
- ARP requests with no corresponding replies
Correct answer: Two different IPs sharing the same MAC address
ARP spoofing is revealed when two different IP addresses are mapped to the same MAC address in ARP reply packets.
Question 5: What is CAM table overflow and which tool is commonly used to execute it?
- Flooding a switch with fake MACs to force hub behavior; macof (Correct answer)
- Corrupting DNS cache with false entries; dnsmasq
- Exhausting ARP cache with fake IPs; arpspoof
- Filling routing tables with bogus routes; scapy
Correct answer: Flooding a switch with fake MACs to force hub behavior; macof
macof sends thousands of frames with random MACs, filling the switch CAM table so the switch falls back to flooding all traffic to every port.
Question 6: Which Metasploit auxiliary module is used to scan for hosts running SMB on port 445?
- auxiliary/scanner/smb/smb_version (Correct answer)
- auxiliary/scanner/portscan/tcp
- auxiliary/scanner/smb/smb_login
- auxiliary/scanner/http/title
Correct answer: auxiliary/scanner/smb/smb_version
The smb_version auxiliary module probes port 445 on target hosts and reports the SMB version and OS details.
Question 7: What type of scan does Nmap use by default when run without the -s flag as a non-root user?
- SYN scan
- FIN scan
- TCP connect scan (Correct answer)
- UDP scan
Correct answer: TCP connect scan
Non-root users cannot craft raw packets, so Nmap falls back to a full TCP connect scan using the OS's connect() system call.
eJPT Network Attacks 3
What does the Responder tool primarily exploit on Windows networks?