ECCouncil Updated 312-50v13 Exam Questions and Answers by bruce

This scenario is a classic session fixation attack. In session fixation, the attacker sets or “fixes” a known session identifier (session ID) for the victim before the victim authenticates. The attacker then persuades the victim to use that predetermined session—often by embedding the session ID into a URL, link, or cookie setting mechanism. Once the victim logs in, the application incorrectly continues using the same session ID (rather than issuing a new one upon authentication). As a result, the attacker can reuse that known session ID to access the victim’s authenticated session context.

The described sequence matches session fixation exactly: James first crafts a session and obtains a session ID, then shares it with the victim via a link, the victim clicks and logs in, and “their activity is bound to the attacker’s pre-assigned session.” Later, James accesses the session and retrieves the victim’s input—demonstrating that authentication was tied to an attacker-controlled session token.

Why the other options do not fit:

Session replay (B) involves capturing a valid session token (e.g., via sniffing, XSS, or leakage) and replaying it, but it does not require pre-setting the token before the victim logs in.

Session prediction (C) is about guessing or calculating valid session IDs due to weak randomness. Here the attacker does not guess; he deliberately provides a session ID he already controls.

“Session donation (A)” is not the standard classification for this well-known web session weakness in CEH-style taxonomy; the described behavior aligns with fixation.

Therefore, the correct answer is D. Session Fixation Attack.

The correct answer is B, Reconnaissance. In CEH methodology, reconnaissance is the initial information-gathering phase where an attacker or ethical hacker collects as much data as possible about a target before deeper technical testing or attack activity. The retrieved CEH-related material describes reconnaissance as gathering information about the target using active or passive means, and it specifically includes collecting initial information about the target system or organization. Visiting an organization’s public website to collect employee names, email addresses, and phone numbers is passive information gathering because the tester is using publicly available sources rather than directly probing systems. Footprinting, which is part of reconnaissance, can include gathering employee information, phone numbers, and emails. Fingerprinting is more specific to identifying systems, services, or operating systems. Scanning and enumeration involve actively probing hosts, ports, and services. Gaining access occurs later, when vulnerabilities are exploited. Therefore, this activity corresponds to reconnaissance.

The correct answer is B, Clickjacking Attack. Clickjacking is a web application attack in which an attacker tricks a victim into clicking on a hidden or disguised element different from what the victim perceives on the screen. The most common technique involves placing a transparent or invisible iframe over legitimate-looking content. When the victim clicks the visible button, image, or link, the click is actually directed to the hidden iframe controlled by the attacker.

In CEH web application hacking topics, clickjacking is considered a user-interface redress attack because it manipulates the user’s perception of the web page. Attackers use this technique to force users to perform unintended actions such as changing account settings, authorizing transactions, enabling webcams, downloading malware, or granting permissions on trusted websites while remaining unaware of the action being performed.

HTTP Parameter Pollution involves manipulating application parameters, HTML Injection inserts malicious HTML into a web page, and Session Fixation forces a user to use a predefined session identifier. Since the scenario specifically describes a transparent iframe tricking the victim into clicking hidden content, the attack is Clickjacking.

Answer: B QUESTION NO: 25 [Malware Threats]

What kind of detection technique is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it ' s made on the provider ' s environment?

A. Heuristics based

B. Honeypot based

C. Behavioral based

D. Cloud based

Answer: D

The correct answer is D. Cloud based because the question describes an antivirus architecture where suspicious files, metadata, reputation information, and threat intelligence are collected from multiple protected endpoints and analyzed within the vendor’s cloud infrastructure rather than exclusively on the local machine. In CEH malware defense concepts, cloud-based detection leverages centralized analysis engines, reputation services, machine learning models, and global threat intelligence gathered from many endpoints. This approach enables rapid identification of emerging malware and zero-day threats because intelligence learned from one protected system can immediately benefit all other protected systems.

Heuristic-based detection focuses on identifying suspicious code characteristics and malware-like patterns. Behavioral-based detection monitors how a program behaves on a system, such as unauthorized registry changes, process injection, or unusual network activity. Honeypot-based solutions use decoy systems to attract and study attackers. None of these specifically describe offloading analysis to the antivirus provider’s environment. The key phrase in the question is that malware analysis is performed in the provider’s environment using information collected from many protected systems, which is the defining characteristic of cloud-based malware detection. Therefore, option D is the most accurate CEH-aligned answer.

The correct answer is B, Path traversal. A file download feature that accepts a user-controlled path is vulnerable when the application does not properly validate, normalize, or restrict the requested file location. In CEH web application and web server attack concepts, directory or path traversal allows an attacker to access restricted directories outside the intended web root by using sequences such as ../, encoded characters, or manipulated URL/path values. CEH material describes directory traversal as an attack where the attacker attempts to access restricted directories and execute commands outside intended web server directories, also known as dot-dot-slash, directory climbing, or backtracking. CEH web server material also states that attackers may use dots and slash sequences to access directories outside the root directory and reveal sensitive system information. SQLi targets database queries, XSS injects scripts, and CSRF abuses authenticated browser requests. Here, the vulnerable input is a file path, so the attack is path traversal.