Certified Ethical Hacker (CEH) Network Attacks, Sniffing, and Perimeter Evasion Flashcards

24 sample cards from the Network Attacks, Sniffing, and Perimeter Evasion deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What are the three broad categories of DDoS attacks by target?

   1) Volumetric attacks (exhaust bandwidth, e.g., UDP/ICMP floods, amplification). 2) Protocol/state-exhaustion attacks (exhaust device tables, e.g., SYN flood). 3) Application-layer attacks (Layer 7, e.g., HTTP GET/POST floods, slowloris).

2. List three techniques used to detect DoS/DDoS attacks.

   Activity profiling (monitoring average packet rate of network flows), sequential change-point detection (isolating traffic spikes from a baseline), and wavelet-based signal analysis of traffic spectral components.

3. Name three countermeasures/mitigation techniques against DDoS attacks.

   Ingress/egress filtering and anti-spoofing (BCP38), rate limiting and traffic scrubbing/black-hole or sinkhole routing, and using upstream/cloud DDoS protection services with load balancing and redundancy.

4. What is session hijacking?

   An attack in which the attacker takes over an established, authenticated session between two hosts by stealing or predicting the session identifier, gaining the victim's authenticated access without needing credentials.

5. What are the typical phases of a session hijacking attack?

   1) Sniff/place yourself in the traffic path (MITM). 2) Monitor the session. 3) Desynchronize the connection. 4) Predict/steal the session token. 5) Inject packets / take over the session.

6. What is the difference between active and passive session hijacking?

   In active hijacking the attacker takes over the session, often forcing the legitimate user offline, and interacts directly. In passive hijacking the attacker only monitors and records the session traffic without altering it.

7. What is application-level session hijacking?

   Hijacking that targets the session token/ID at the application layer (e.g., a web session cookie) to gain or impersonate a valid session, rather than manipulating TCP sequence numbers.

8. List four techniques used in application-level session hijacking.

   Session sniffing (stealing the token from traffic), session fixation (forcing a known session ID on the victim), cross-site scripting (XSS) to steal cookies, and session ID prediction/brute forcing of weak tokens.

9. What is session fixation?

   An attack where the attacker sets or supplies a known session ID to the victim before they authenticate; when the victim logs in with that fixed ID, the attacker reuses it to access the authenticated session.

10. What is network-level session hijacking and what does it manipulate?

    Hijacking of the TCP/IP session by manipulating transport/network protocols — it relies on predicting or capturing TCP sequence and acknowledgment numbers to inject packets and take over the connection.

11. Why are TCP sequence numbers central to network-level session hijacking?

    TCP uses sequence/acknowledgment numbers to order and validate packets. To inject data into an established session, the attacker must use the correct next sequence number; predicting it allows spoofed packets to be accepted as legitimate.

12. What is TCP/IP session hijacking via desynchronization?

    The attacker forces both endpoints into a desynchronized state (their sequence numbers no longer match) — often by injecting data or a reset — then supplies correctly sequenced packets so only the attacker can continue the session.

13. List three countermeasures against session hijacking.

    Use encryption (TLS/HTTPS, IPsec, SSH) end-to-end; use strong, random, regenerated session IDs (regenerate ID after login, set HttpOnly/Secure cookie flags); and use timeouts plus re-authentication and unpredictable initial sequence numbers.

14. What is the difference between an IDS and an IPS?

    An IDS (Intrusion Detection System) passively monitors and alerts on suspicious activity out-of-band. An IPS (Intrusion Prevention System) sits inline and can actively block or drop malicious traffic in real time.

15. What is the difference between signature-based and anomaly-based detection?

    Signature-based (misuse) detection matches traffic against a database of known attack patterns — low false positives but misses zero-days. Anomaly-based detection flags deviations from a learned baseline of normal behavior — can catch new attacks but produces more false positives.

16. What is the difference between a HIDS and a NIDS?

    A HIDS (host-based IDS) monitors a single host's logs, files, and activity. A NIDS (network-based IDS) monitors traffic across a network segment from a sensor/tap.

17. What are the four main firewall types/generations by inspection method?

    Packet-filtering (Layer 3/4, by IP/port), stateful inspection (tracks connection state), circuit-level gateway (Layer 5, monitors TCP handshakes/sessions), and application-level gateway/proxy (Layer 7, inspects content).

18. What is a honeypot, and what is the difference between low- and high-interaction honeypots?

    A honeypot is a decoy system designed to attract and study attackers. Low-interaction honeypots emulate limited services (low risk, less data); high-interaction honeypots run real services/OS (more realistic data but higher risk if compromised).

19. Name three IDS/IPS evasion techniques.

    Insertion/evasion attacks (sending packets the IDS and host interpret differently), fragmentation (splitting attack payloads across fragments), and obfuscation/encoding (Unicode, polymorphism, encryption) plus session splicing to break signatures across packets.

20. What is session splicing as an IDS evasion technique?

    Splitting the attack payload across many small TCP packets/segments so that no single packet matches an IDS signature, while the target reassembles them into the full malicious request.

21. Name three firewall evasion techniques.

    IP address spoofing and source routing, using tunneling/encapsulation (e.g., HTTP, ICMP, or DNS tunneling and covert channels), and port scanning evasion via fragmentation, decoys, or using allowed ports/proxies to bypass rules.

22. How can an attacker detect and defeat a honeypot?

    Detect via fingerprinting artifacts (e.g., known emulation signatures, missing/abnormal services, virtualization indicators, predictable responses, or tools like Send-Safe Honeypot Hunter). Defeat by avoiding/disabling it or fingerprinting decoy services so real attack traffic is steered away from the trap.

23. What is a bastion host in firewall architecture?

    A hardened, highly secured host placed on the network perimeter (often in the DMZ) that is exposed to untrusted networks and runs minimal services to reduce attack surface while mediating traffic.

24. What is a DMZ (demilitarized zone) in network perimeter design?

    A perimeter network segment that sits between the internal trusted network and the untrusted internet, hosting public-facing servers so that a compromise there does not directly expose the internal network.

What this deck covers

Network Attacks, Sniffing, and Perimeter Evasion flashcards FAQ