CEH Day 10 Sniffing, Sessions Hijacking and Evading IDS, Firewalls & Honeypots

What is passive sniffing?

Observing network traffic without actively manipulating it

What is active sniffing?

Using techniques to manipulate or influence network traffic to gain visibility, especially on switched networks.

What is promiscuous mode?

NIC mode that accepts frames beyond those addressed to its own MAC

What is Wi-Fi monitor mode?

Mode that captures wireless frames without ordinary client association

What is SPAN port mirroring?

A switch feature that copies selected traffic to a monitoring port

What is a network TAP?

A dedicated device that provides access to network traffic

Which tool provides GUI packet analysis?

Wireshark

Which tool is a command-line packet analyzer?

tcpdump

Which tcpdump option selects an interface?

-i

Which tcpdump option writes packets to a file?

-w

Which tcpdump option reads packets from a file?

-r

What is session hijacking?

Obtaining and using a valid session token

What is session fixation?

Causing a victim to authenticate using an attacker-known session ID

What is a replay attack?

Retransmitting captured valid data or authentication material

What is CSRF?

Tricking an authenticated victim's browser into submitting an unwanted request

What is a bearer token?

A token whose possession can grant access to the associated session or resource

What does the Secure cookie attribute do?

Sends the cookie only over HTTPS

What does HttpOnly do?

Prevents ordinary client-side JavaScript from accessing the cookie; it does not prevent XSS itself.

What does SameSite help mitigate?

Helps mitigate CSRF by restricting when cookies are sent with cross-site requests.

What is the key mitigation for session fixation?

Regenerate the session ID after authentication

Why invalidate sessions server-side at logout?

To make copied session tokens unusable

What is an IDS?

A system that detects suspicious activity and alerts

What is an IPS?

A system that detects and can block suspicious traffic

What is a NIDS?

An IDS that monitors network traffic

What is a HIDS?

An IDS that monitors activity on an individual host

What is signature-based detection?

Detection by matching known attack patterns

What is anomaly-based detection?

Detection based on deviations from an established baseline

What is stateful inspection?

Firewall inspection that tracks active connection state

What is stateless packet filtering?

Filtering packets using rules without tracking connection state

What is an application proxy firewall?

An intermediary firewall capable of application-layer inspection

What is a honeypot?

A decoy system or resource designed to attract and observe attackers

What is a honeynet?

A network of decoy systems

What is a high-interaction honeypot?

A realistic functional decoy environment

What is IP spoofing?

Falsifying the source IP address

What is IP fragmentation?

Splitting an IP packet into smaller fragments

What is tunneling?

Encapsulating one protocol inside another

What is source routing?

A technique that attempts to influence the route packets take

What does Nmap -sS perform?

TCP SYN scan

What does Nmap -sT perform?

TCP connect scan

What does Nmap -sA perform?

TCP ACK scan

What does Nmap -sF perform?

TCP FIN scan

What does Nmap -sU perform?

UDP scan

What does Nmap -sV perform?

Service and version detection

What does Nmap -O perform?

OS detection

What does Nmap -sn perform?

Host discovery only; disables the port scan.

What does Nmap -Pn do?

Skips host discovery and treats targets as online for scanning.

What is the main difference between a hub and a switch for sniffing?

A hub repeats traffic to all ports while a switch normally forwards frames only to the relevant port

What is MAC flooding?

Overwhelming a switch's MAC address table to potentially cause it to flood traffic

What is ARP poisoning?

Sending forged ARP messages to associate an IP address with an attacker's MAC address

What is a common purpose of ARP poisoning?

Positioning an attacker for man-in-the-middle interception

What is a limitation of sniffing encrypted TLS traffic?

Packet capture may reveal metadata but not protected application content without suitable decryption access

Which tools can be used for active sniffing or MITM techniques?

Ettercap and Bettercap

What is a Wireshark display filter used for?

Filtering captured packets for analysis

What does tcpdump -i eth0 do?

Captures packets on interface eth0

What should an application do to the session ID after login?

Regenerate it to prevent session fixation

What is the difference between session hijacking and session fixation?

Hijacking uses a stolen valid session token while fixation makes the victim authenticate using a session ID known to the attacker

Why should session IDs be unpredictable?

To make guessing or predicting valid sessions difficult

What is an idle session timeout?

A session expires after a period of inactivity

What is an absolute session timeout?

A session expires after a maximum lifetime regardless of activity

Why is deleting a session cookie not always sufficient for logout?

The server-side session may remain valid unless it is invalidated

What is the purpose of the Secure cookie attribute?

Restricts cookie transmission to HTTPS connections

What is the purpose of the HttpOnly cookie attribute?

Restricts ordinary JavaScript access to the cookie

What is the key operational difference between an IDS and an IPS?

An IDS primarily detects and alerts while an IPS can actively block traffic

Where is an IPS commonly deployed?

Inline with network traffic so it can block packets

What is the difference between NIDS and HIDS?

NIDS monitors network activity while HIDS monitors activity on an individual host

What does a circuit-level gateway examine?

Session establishment and connection-level information

What is a low-interaction honeypot?

A limited or simulated decoy service with relatively little attacker interaction

What is a high-interaction honeypot?

A realistic functional decoy environment that allows more extensive interaction

What is a honeynet?

A network of decoy systems designed to attract and observe attackers

Why might an attacker use IP fragmentation?

To split packets into smaller fragments that may affect how security devices inspect traffic

What is a limitation of IP fragmentation as an evasion technique?

Security devices may reassemble fragments or detect suspicious fragmentation

What does Nmap -sA help determine?

Firewall filtering behavior based on TCP ACK probe responses and it does not identify open ports

What does Nmap -Pn do?

Skips host discovery and treats targets as online for scanning

What does Nmap -sn perform?

Host discovery only without a port scan

What is the difference between Nmap -Pn and -sn?

-Pn skips host discovery and proceeds as if targets are up while -sn performs host discovery without a port scan