PDF 312-50v13 Study Guide

Web Application Threats - Watering Hole Attack In a watering hole attack, the attacker identifies the kinds of websites a target company/individual frequently surfs and tests those particular websites to identify any possible vulnerabilities. Attacker injects malicious script/code into the web application that can redirect the webpage and download malware onto the victim machine. (P.1797/1781)

The main purpose of a rootkit is to hide malicious activity by modifying or replacing legitimate system binaries (e.g., ls, ps, netstat) so they no longer show the presence of malicious files, users, or processes. This enables attackers to maintain persistent and stealthy access.

From CEH v13 Official Courseware:

Module 6: Malware Threats → Rootkits

CEH v13 Study Guide states:

“Rootkits are stealthy programs designed to conceal the existence of other malicious processes or programs by replacing legitimate operating system utilities and binaries. This makes detection and removal extremely difficult.”

Incorrect Options:

A: This is a backdoor’s behavior.

B: A buffer overflow is a method of exploitation, not the rootkit’s purpose.

D: Refers to a backdoor or vulnerability, not a rootkit’s core function.

Comprehensive and Detailed Explanation From CEH v13 Guide:

R-U-Dead-Yet? (RUDY) is a DoS tool that targets web applications by sending slow HTTP POST requests with large Content-Length headers. This consumes server resources, leading to a denial of service.

CEH v13 Reference:

Module 9: Denial-of-Service – DoS Tools

“R-U-Dead-Yet? (RUDY) sends long-form POST requests to consume server-side sessions and exhaust resources without completing the transaction.”

In CEH v13 Module 03: Scanning Networks, stealth scanning refers to a method of scanning that avoids detection by not completing the TCP handshake.

-sS = TCP SYN scan (Stealth scan)

Sends SYN packet.

If SYN-ACK is returned, the port is open; then a RST is sent back instead of completing handshake.

Harder to detect via IDS/IPS.

Option Analysis:

A. -sM: TCP Maimon scan (rarely used).

B. -sU: UDP scan.

C. -sS: Stealth SYN scan.

D. -sT: TCP Connect scan (not stealthy).