ECCouncil Updated 312-50v13 Exam Questions and Answers by cassian

https://nmap.org/book/man-port-specification.html

NOTE: In my opinion, this is an absolutely wrong statement of the question. But you may come across a question with a similar wording on the exam. What does "fast" mean? If we want to increase the speed and intensity of the scan we can select the mode using the -T flag (0/1/2/3/4/5). At high -T values, we will sacrifice stealth and gain speed, but we will not limit functionality.

«nmap -T4 -F 10.10.0.0/24» This option is "correct" because of the -F flag.

-F (Fast (limited port) scan)

Specifies that you wish to scan fewer ports than the default. Normally Nmap scans the most common 1,000 ports for each scanned protocol. With -F, this is reduced to 100.

Technically, scanning will be faster, but just because we have reduced the number of ports by 10 times, we are just doing 10 times less work, not faster.

In CEH v13 Module 09: Social Engineering, scareware is defined as a malicious tactic that uses fear, panic, or urgency to trick users into performing harmful actions such as downloading fake software or clicking malicious links.

Common Scareware Example:

A pop-up warns the user: “Your system is infected! Install this antivirus now!”

Victim downloads malware disguised as a solution.

Often used to deliver spyware, ransomware, or trojans.

Option Review:

A. Free cruise: Classic example of baiting, not scareware.

B. Account locked: Closer to phishing or credential harvesting.

C. Delivery delay: Another phishing variation.

D. Pop-up about infection: True scareware tactic.

This question is about web link enumeration using Linux CLI tools — a common initial step during information gathering in penetration testing, covered in CEH v13 Module 02: Footprinting and Reconnaissance.

Objective:

Extract all hyperlinks (i.e., ) from the homepage of a target site to collect subpages, links, or external URLs.

Let’s analyze each component of Option B:

=

=

curl -s https://site.com | grep '

curl -s https://site.com: Silently fetches the HTML source of the main page.

grep '

grep "site.com": Further filters those that point to site.com.

cut -d "v" -f 2: Cuts the line based on the delimiter v to isolate part of the URL — though not perfect, it attempts to extract the visible link.

While not perfectly formed (due to slightly inconsistent quote usage), Option B demonstrates the correct logic chain for web link enumeration using pipes in Linux: fetching, filtering, and extracting.

Why Other Options Are Incorrect:

A. dirb https://site.com | grep "site"

❌ dirb is used for brute-forcing directories, not grabbing links from HTML.

C. wget https://site.com | grep "

❌ Incorrect. wget will download the entire content (including binary files by default), and piping it directly to grep without -O - or -q -O - makes it ineffective.

D. wget https://site.com | cut -d "http"

❌ Incorrect. Syntax error (cut -d"http" is invalid without correct delimiter formatting), and again wget needs to be directed to stdout using -O -.

Corrected Optimal Syntax for Real-World Use:

bash

CopyEdit

curl -s https://site.com | grep -oP 'href="\Khttp[^"]+' | grep "site.com"

This uses -oP with Perl-compatible regex to extract only URLs and is a method recommended in CEH iLabs and demonstrations.

Reference from CEH v13 Study Materials:

Module 02 – Footprinting and Reconnaissance, Section: Website Footprinting and Web Crawling

CEH iLabs – Website Information Gathering Lab

CEH Engage Range: Passive and Active Footprinting Phase – Linux Scripting Tasks

Btlejack is a tool used for attacking Bluetooth Low Energy (BLE) connections, including sniffing, jamming, and hijacking.

The -f option specifies the access address of the BLE connection.

The -j option is used to hijack an active BLE connection.

Therefore, the correct syntax to hijack a BLE connection is:

btlejack -f [access_address] -j

This matches Option A: btlejack -f 0x129f3244 -j

Incorrect Options:

B. -c any is used for sniffing any advertising packet but not for hijacking.

C. -d specifies device paths; -s starts a scan but does not hijack.

D. This is likely a malformed or unrelated command in the context of hijacking.

Reference – CEH v13 Official Courseware:

Module 18: IoT and OT Hacking

Section: “Bluetooth Low Energy (BLE) Attacks”

Tool Focus: “Btlejack Command Usage”

CEH iLab: Btlejacking with micro:bit