EC-COUNCIL EC-COUNCIL Certifications 312-50 Questions & Answers

• Question 351:

  Kevin has been asked to write a short program to gather user input for a web application. He likes to keep his code neat and simple. He chooses to use printf(str) where he should have ideally used printf(? s? str). What attack will his program expose the web application to?

  A. Cross Site Scripting

  B. SQL injection Attack

  C. Format String Attack

  D. Unicode Traversal Attack

  Correct Answer: C

  Format string attacks are a new class of software vulnerability discovered around 1999, previously thought harmless. Format string attacks can be used to crash a program or to execute harmful code. The problem stems from the use of unfiltered user input as the format string parameter in certain C functions that perform formatting, such as printf(). A malicious user may use the %s and %x format tokens, among others, to print data from the stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the %n format token, which commands printf() and similar functions to write back the number of bytes formatted to the same argument to printf(), assuming that the corresponding argument exists, and is of type int * .

• Question 352:

  While testing web applications, you attempt to insert the following test script into the search area on the company's web site:

  Afterwards, when you press the search button, a pop up box appears on your screen with the text "Testing Testing Testing". What vulnerability is detected in the web application here?

  A. A hybrid attack

  B. A buffer overflow

  C. Password attacks

  D. Cross Site Scripting

  Correct Answer: D

  Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such code include HTML code and client-side scripts. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy.

• Question 353:

  Liza has forgotten her password to an online bookstore. The web application asks her to key in her email so that they can send her the password. Liza enters her email [email protected]'. The application displays server error. What is wrong with the web application?

  A. The email is not valid

  B. User input is not sanitized

  C. The web server may be down

  D. The ISP connection is not reliable

  Correct Answer: B

  All input from web browsers, such as user data from HTML forms and cookies, must be stripped of special characters and HTML tags as described in the following CERT advisories: http://www.cert.org/advisories/CA-1997-25.html http://www.cert.org/advisories/CA-2000-02.html

• Question 354:

  Bret is a web application administrator and has just read that there are a number of surprisingly common web application vulnerabilities that can be exploited by unsophisticated attackers with easily available tools on the Internet.

  He has also read that when an organization deploys a web application, they invite the world to send HTTP requests. Attacks buried in these requests sail past firewalls, filters, platform hardening, SSL, and IDS without notice because they are inside legal HTTP requests. Bret is determined to weed out any vulnerabilities. What are some common vulnerabilities in web applications that he should be concerned about?

  A. Non-validated parameters, broken access control, broken account and session management, cross- side scripting and buffer overflows are just a few common vulnerabilities

  B. No IDS configured, anonymous user account set as default, missing latest security patch, no firewall filters set and visible clear text passwords are just a few common vulnerabilities

  C. Visible clear text passwords, anonymous user account set as default, missing latest security patch, no firewall filters set and no SSL configured are just a few common vulnerabilities

  D. No SSL configured, anonymous user account set as default, missing latest security patch, no firewall filters set and an inattentive system administrator are just a few common vulnerabilities

  Correct Answer: A

• Question 355:

  Bryan notices the error on the web page and asks Liza to enter liza' or '1'='1 in the email field. They are greeted with a message "Your login information has been mailed to [email protected]". What do you think has occurred?

  A. The web application picked up a record at random

  B. The web application returned the first record it found

  C. The server error has caused the application to malfunction

  D. The web application emailed the administrator about the error

  Correct Answer: B

  The web application sends a query to an SQL database and by giving it the criteria 1=1, which always will be true, it will return the first value it finds.

• Question 356:

  What does black box testing mean?

  A. You have full knowledge of the environment

  B. You have no knowledge of the environment

  C. You have partial knowledge of the environment

  Correct Answer: B

  Black box testing is conducted when you have no knowledge of the environment. It is more time consuming and expensive.

• Question 357:

  You have just received an assignment for an assessment at a company site. Company's management is concerned about external threat and wants to take appropriate steps to insure security is in place. Anyway the management is also worried about possible threats coming from inside the site, specifically from employees belonging to different Departments. What kind of assessment will you be performing ?

  A. Black box testing

  B. Black hat testing

  C. Gray box testing

  D. Gray hat testing

  E. White box testing

  F. White hat testing

  Correct Answer: C

  Internal Testing is also referred to as Gray-box testing.

• Question 358:

  Jim is having no luck performing a penetration test in company's network. He is running the tests from home and has downloaded every security scanner that he could lay his hands on. Despite knowing the IP range of all the systems, and the exact network configuration, Jim is unable to get any useful results.

  Why is Jim having these problems?

  A. Security scanners are not designed to do testing through a firewall.

  B. Security scanners cannot perform vulnerability linkage.

  C. Security scanners are only as smart as their database and cannot find unpublished vulnerabilities.

  D. All of the above.

  Correct Answer: D

  The Security scanners available online are often to "outdated" to perform a live pentest against a victim.

• Question 359:

  Scanning for services is an easy job for Bob as there are so many tools available from the Internet. In order for him to check the vulnerability of company, he went through a few scanners that are currently available. Here are the scanners that

  he uses:

  However, there are many other alternative ways to make sure that the services that have been scanned will be more accurate and detailed for Bob.

  What would be the best method to accurately identify the services running on a victim host?

  A. Using Cheops-ng to identify the devices of company.

  B. Using the manual method of telnet to each of the open ports of company.

  C. Using a vulnerability scanner to try to probe each port to verify or figure out which service is running for company.

  D. Using the default port and OS to make a best guess of what services are running on each port for company.

  Correct Answer: B

  By running a telnet connection to the open ports you will receive banners that tells you what service is answering on that specific port.

• Question 360:

  Clive has been hired to perform a Black-Box test by one of his clients.

  How much information will Clive obtain from the client before commencing his test?

  A. IP Range, OS, and patches installed.

  B. Only the IP address range.

  C. Nothing but corporate name.

  D. All that is available from the client site.

  Correct Answer: C

  Penetration tests can be conducted in one of two ways: black-box (with no prior knowledge the infrastructure to be tested) or white-box (with complete knowledge of the infrastructure to be tested). As you might expect, there are conflicting opinions about this choice and the value that either approach will bring to a project.