ECCouncil Updated 312-50v13 Exam Questions and Answers by camille

The ethical hacker conducted Test 1, which is a TCP/IP stack fingerprinting technique that uses the SYN and ECN-Echo flags to determine the OS of the target system. The SYN flag is used to initiate a TCP connection, and the ECN-Echo flag is used to indicate that the sender supports Explicit Congestion Notification (ECN), which is a mechanism to reduce network congestion. Different OSes have different implementations and responses to these flags, which can reveal their identity. For example, Windows XP and 2000 will reply with SYN and ECN-Echo flags set, while Linux will reply with only SYN flag set. By sending a TCP packet with these flags enabled to an open TCP port and observing the reply, the ethical hacker can probe the nature of the response and subsequently determine the OS fingerprint.

The ethical hacker adopted this specific approach because it is an advanced and stealthy technique that can evade some firewalls and intrusion detection systems (IDS) that may block or alert other types of packets, such as NULL, FIN, or Xmas packets. Moreover, this technique can provide more accurate and reliable results than other techniques, such as banner grabbing or passive analysis, that may depend on the availability or validity of the information provided by the target system.

The other options are not correct, as they describe different tests and reasons. Test 3 is a TCP/IP stack fingerprinting technique that uses the URG, PSH, SYN, and FIN flags to determine the OS of the target system. Test 2 is a TCP/IP stack fingerprinting technique that uses a NULL packet, which is a TCP packet with no flags enabled, to determine the OS of the target system. Test 6 is a TCP/IP stack fingerprinting technique that uses the ACK flag, which is used to acknowledge the receipt of a TCP segment, to determine the OS of the target system. References:

OS and Application Fingerprinting | SANS Institute

Operating System Fingerprinting | SpringerLink

OS and Application Fingerprinting - community.akamai.com

What is OS Fingerprinting and Techniques - Zerosuniverse

Comprehensive and Detailed Explanation:

LDAP (Lightweight Directory Access Protocol) uses:

TCP/UDP port 389 for standard LDAP communication.

TCP/UDP port 636 for secure LDAP over SSL (LDAPS).

From CEH v13 Courseware:

Module 3: Scanning Networks → Common Ports and Protocols

Incorrect Options:

A: Port 110 = POP3

C: Port 464 = Kerberos change/set password

D: Port 445 = SMB over TCP/IP (used for file sharing)

WPA2-PSK networks authenticate users using a pre-shared key derived from a passphrase. After capturing the 4-way handshake, CEH teaches that the standard and most effective method to recover the key is to perform an offline dictionary attack, where wordlist entries are hashed and compared against the captured handshake values. Offline cracking avoids detection and is significantly faster than brute-force attempts.

L0phtCrack is a password auditing and recovery tool. It can:

Capture password hashes over the network (e.g., via SMB).

Crack password hashes using dictionary, brute-force, or hybrid attacks.

It’s particularly effective when used on SMB-based challenge-response authentication (NTLM/LM) captured via packet sniffing.

From CEH v13 Courseware:

Module 4: Enumeration

Module 6: Malware Threats

CEH v13 Study Guide states:

“L0phtCrack can sniff SMB authentication exchanges from network traffic and extract NTLM password hashes to crack them offline.”

Incorrect Options:

A: This is possible (hence A is wrong).

B: Netbus is a backdoor/trojan tool.

C: NTFSDOS is used to read NTFS partitions under DOS, not for password cracking.