ECCouncil Updated 312-50v13 Exam Questions and Answers by ren

https://en.wikipedia.org/wiki/Web_application_firewall

A web application firewall (WAF) is a specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service. By inspecting HTTP traffic, it can prevent attacks exploiting a web application's known vulnerabilities, such as SQL injection, cross-site scripting (XSS), file inclusion, and improper system configuration.

“Clearing tracks” is a post-exploitation phase in the ethical hacking methodology in which the attacker removes or alters system evidence to hide their activities and avoid detection. This may include:

Deleting or modifying event logs

Clearing bash history or command history

Removing malware traces

Disabling auditing

From CEH v13:

Corrupting or erasing event logs ensures that system administrators or forensic investigators cannot trace the intrusion or determine how the system was compromised.

Incorrect Options:

A. Creating a backdoor is part of the "Maintaining Access" phase, not "Clearing Tracks."

B. Injecting a rootkit is part of the "Gaining or Maintaining Access" stage.

C. Exploiting a vulnerability is part of the "Gaining Access" phase.

Reference – CEH v13 Official Courseware:

Module 05: System Hacking

Section: “Clearing Logs and Erasing Evidence”

Subsection: “Track-Clearing Techniques”

Lab: Log Manipulation and Covering Tracks

This log clearly shows an HTTP GET request attempting to exploit a web server using a directory traversal attack with Unicode encoding:

The URL contains:/msadc/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:

%c0%af is a known Unicode-encoded sequence used to bypass input validation filters.It translates to the forward slash character “/” when interpreted by vulnerable versions of Microsoft IIS (specifically IIS 4.0 and 5.0).

This type of attack attempts to:

Traverse out of the web root directory (via encoded ../ sequences)

Access cmd.exe in the Windows system32 directory

Execute operating system commands such as dir c: (list contents of drive C)

From CEH v13 Official Courseware:

Module 14: Hacking Web Servers

Topic: Unicode Directory Traversal Vulnerability (IIS-specific)

CEH v13 Study Guide states:

“A Unicode Directory Traversal Attack takes advantage of improper input sanitization by encoding traversal characters (../) as Unicode (e.g., %c0%af). This bypasses input filters and accesses restricted directories such as system32.”

Incorrect Options:

A. Hexcode Attack: Not a formal classification; here Unicode encoding is used.

B. Cross-Site Scripting: Involves injecting scripts into a web page, unrelated to filesystem traversal.

C. Multiple Domain Traversal: Not a valid or recognized attack type.

Comprehensive and Detailed Explanation:

SIEM (Security Information and Event Management) systems aggregate logs and alerts from across the network—servers, routers, firewalls, IDS/IPS, and applications—and correlate that data to identify suspicious or malicious activity.

They provide:

Real-time alerting

Long-term log storage

Compliance reporting

Incident response facilitation

From CEH v13 Courseware:

Module 12: Evading IDS, Firewalls, and Honeypots → SIEM Tools