eJPT Network Attacks 3

Question 1

What does the Responder tool primarily exploit on Windows networks?

Accepted Answer

LLMNR and NBT-NS name resolution broadcasts

Answer

Responder listens for LLMNR and NBT-NS broadcast queries and responds with the attacker's IP to capture NTLMv2 hashes.

Question 2

In a network capture, you see repeated ICMP Type 3 Code 3 messages. What do these indicate?

Accepted Answer

Port unreachable

Answer

ICMP Type 3 Code 3 means 'Destination Port Unreachable,' typically seen when a UDP packet hits a closed port.

Question 3

Which attack technique involves sending a large number of UDP packets to random ports on a target to consume resources?

Accepted Answer

UDP flood

Answer

A UDP flood overwhelms a target by forcing it to process and respond with ICMP port-unreachable messages for each unexpected UDP packet received.

Question 4

When using Wireshark to analyze traffic during an ARP spoofing attack, what is the key indicator in the ARP packets?

Accepted Answer

Two different IPs sharing the same MAC address

Answer

ARP spoofing is revealed when two different IP addresses are mapped to the same MAC address in ARP reply packets.

Question 5

What is CAM table overflow and which tool is commonly used to execute it?

Accepted Answer

Flooding a switch with fake MACs to force hub behavior; macof

Answer

macof sends thousands of frames with random MACs, filling the switch CAM table so the switch falls back to flooding all traffic to every port.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test