🔐 CEH Interview Preparation

The CIA triad consists of:

• Confidentiality: Measures taken to prevent disclosure of information to unauthorized individuals or systems
• Integrity: Methods to protect information from unauthorized alteration, ensuring data arrives unchanged
• Availability: Ensuring communications systems and data are ready for use when legitimate users need them

This triangle represents a fundamental security principle: as security increases, functionality and ease of use decrease. Organizations must balance these three elements - making a system more secure typically makes it less functional and harder to use.

• Ethical Hacker: Works with explicit written permission and approval from a customer to improve security
• Cracker (Malicious Hacker): Uses skills for personal gain or destructive purposes without permission and outside the interest of the system owner

• White Hats: Ethical hackers hired to test and improve security with permission
• Black Hats: Crackers who illegally use skills for personal gain or malicious intent
• Gray Hats: Neither good nor bad - curious about techniques or believe it's their duty to demonstrate flaws, but work without explicit permission

1. Reconnaissance: Gathering information about targets (passive and active)
2. Scanning and Enumeration: Actively applying tools to gather in-depth information
3. Gaining Access: Launching actual attacks against enumerated targets
4. Maintaining Access: Ensuring continued access through backdoors, trojans, etc.
5. Covering Tracks: Concealing success and avoiding detection

1. Preparation: Contract negotiation, scope definition, team assignment
2. Assessment (Security Evaluation): Actual security control testing
3. Conclusion (Post-Assessment): Final report preparation with findings and recommendations

• DES: 56 bits (with 8 bits parity)
• 3DES: 168 bits
• AES: 128, 192, or 256 bits

• Stream Ciphers: Encrypt data as continuous stream, one bit at a time using XOR operations - very fast
• Block Ciphers: Split data into blocks (usually 64 bits) and encrypt each block - slower but use substitution and transposition

A hash algorithm is a one-way mathematical function that produces a fixed-length output based on input data arrangement.

Primary Purpose: To verify data integrity - any change in input produces a completely different hash value.

A collision attack occurs when two or more different inputs produce the same hash output. This shouldn't happen and can allow attackers to pass off fake files as originals.

Steganography is the practice of concealing messages inside another medium (like images or files) so that only sender and recipient know of its existence - unlike encryption where everyone knows secret communication is occurring.

PKI (Public Key Infrastructure) is a framework for creating, managing, storing, distributing, and revoking keys and digital certificates.

Main Components:

• Certificate Authority (CA): Creates and issues digital certificates
• Certificate Revocation List (CRL): Tracks problematic certificates
• Registration Authorities (RAs): Intermediate CAs in hierarchical systems

• Version
• Serial Number
• Subject
• Algorithm ID
• Issuer
• Valid From/To dates
• Key Usage
• Subject's Public Key
• Optional fields like Subject Alternative Name

• ARIN: North/South America and sub-Saharan Africa
• APNIC: Asia and Pacific
• RIPE: Europe, Middle East, and parts of Central Asia/Northern Africa
• LACNIC: Latin America and Caribbean
• AfriNIC: Africa

A zone transfer replicates all DNS records from one server to another.

Significance: If unrestricted, it provides attackers with a complete network map showing all internal servers and their purposes.

Google hacking uses advanced search operators to find vulnerabilities.

Key Operators:

1. Identify live systems (ping sweeps)
2. Discover open ports (port scanning)
3. Identify OS and services (banner grabbing, OS fingerprinting)
4. Scan for vulnerabilities

1. SYN: Client sends synchronization request with sequence number
2. SYN-ACK: Server responds with SYN-ACK, acknowledging client's sequence number
3. ACK: Client acknowledges server's sequence number, establishing connection

• SYN: Synchronize - initial connection establishment
• ACK: Acknowledgment - confirms receipt
• FIN: Finish - ordered connection close
• RST: Reset - immediate connection termination
• PSH: Push - forces immediate data delivery
• URG: Urgent - out-of-band data

Banner grabbing captures service banners to identify software versions and potential vulnerabilities.

Methods:

• SID: Identifies user, group, and computer accounts in specific format
• RID: Portion of SID identifying specific user/computer
• Important RIDs:
  • Administrator RID = 500
  • Guest = 501
  • Users start at 1000

A null session logs into a system with no user ID or password.

Requirements: Ports 135, 137, 139, and 445

Note: Largely eliminated in Windows XP and later

SNMP community strings act as passwords:

• Public: Default read-only string
• Private: Default read-write string
• Security Issue: Transmitted in clear text in SNMPv1 and v2

Promiscuous mode configures a NIC to capture all frames passing on the medium, regardless of destination address, rather than only frames addressed to that specific NIC.

Necessity: Essential for network sniffing to capture all traffic, not just traffic destined for the monitoring interface.

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on local networks.

ARP Poisoning Process:

1. Attacker sends false ARP replies
2. Associates attacker's MAC with victim's IP
3. Redirects traffic through the attacker
4. Enables man-in-the-middle attacks

How switches limit sniffing: Switches create individual collision domains per port, limiting sniffing capabilities.

Bypass Techniques:

• ARP Poisoning: Redirect traffic through attacker
• MAC Flooding: Overflow CAM table to make switch act like hub
• MAC Spoofing: Impersonate other devices

Snort Rule Format:

Example:

This rule alerts on any TCP traffic from external networks to internal Telnet servers containing "admin".

• Timestamp
• Source/destination MAC addresses
• IP addresses
• Port numbers
• TCP flags
• Sequence numbers
• Packet payload in hex format

• Slow Scanning: Stay under detection thresholds
• Fragmentation: Split payloads across multiple packets
• Flooding: Overwhelm with alerts to hide real attacks
• Encryption: Hide malicious traffic in encrypted channels
• Unicode Encoding: Obfuscate attack strings

Firewalking systematically tests each port on a firewall to determine which ports/protocols pass through.

Tools for Firewalking:

• nmap
• Firewalk
• Custom scripts

A honeypot is a decoy system designed to attract and study attackers.

Placement Considerations:

• Must appear legitimate but be isolated from real network
• Inside DMZ is more believable than outside firewall
• Should be monitored but not trusted
• Needs to blend with legitimate infrastructure

1. Operating System Attacks: Target default configurations and unpatched vulnerabilities
2. Application-level Attacks: Target programming flaws in applications
3. Shrink-wrap Code Attacks: Exploit default scripts and code in off-the-shelf applications
4. Misconfiguration Attacks: Take advantage of improperly configured systems

War dialing systematically dials phone numbers looking for modems that could provide backdoor access.

Tools:

• ToneLoc
• THC-Scan
• WarVOX
• PAWS
• TeleSweep

War driving searches for wireless access points by moving around with wireless-enabled devices.

Tools:

• Silica
• AirMagnet
• AirCheck
• Various WiFi scanners

• Proxy Servers: Route traffic through intermediate systems
• IP Spoofing: Falsify source IP addresses
• Source Routing: Specify packet routing path
• Anonymizers: Web-based proxy services
• Tor: Onion routing for anonymous communication

• -sS: SYN scan (stealth)
• -T1: Slow timing
• -f: Fragment packets

Signs include:

• Filtered ports in nmap scans
• ICMP Type 3 Code 13 responses
• Consistent timeouts on traceroute
• Selective port blocking patterns

• Executive summary with business impact
• Methodology and scope
• Detailed findings with risk ratings
• Proof of concept screenshots
• Remediation recommendations
• Timeline and effort estimates

• Must have explicit written permission
• Stay within defined scope
• Maintain confidentiality through NDAs
• Understand relevant laws (18 U.S.C. § 1030, CFAA, etc.)
• Ensure all activities are authorized

Documentation is crucial because it:

• Provides evidence of findings
• Supports recommendations
• Demonstrates due diligence
• Enables knowledge transfer
• Protects both hacker and client legally

• Written contract with clear scope
• Non-disclosure agreements
• Specific testing windows
• Emergency contact procedures
• Legal liability limitations

1. Stop accessing the content immediately
2. Document the discovery carefully
3. Report through proper legal channels
4. Consult with legal counsel
5. Follow mandatory reporting requirements

• Minimize data collection
• Secure storage of evidence
• Encrypt sensitive findings
• Limit access to authorized personnel
• Proper data destruction after testing

Potential Blocks:

• Outbound firewall rules
• NAT configuration issues
• IDS/IPS detection
• Application-layer filtering

Troubleshooting:

• Try different ports and protocols
• Use tunneling techniques
• Leverage established connections

• Slow down scan timing
• Use decoy IPs (nmap -D)
• Fragment packets
• Use source port spoofing
• Scan through proxies
• Space out activities over time

• Active Directory database
• Group Policy configurations
• DNS zone information
• User account information
• Trust relationships