1. Differentiate between public IP and private IP addresses.
● Public IP: Assigned by the Internet Service Provider (ISP) and is reachable directly on
the internet. It identifies a device globally.
● Private IP: Used within a local network (e.g., home or office) to identify devices internally
(e.g., 192.168.x.x). It is not reachable from the internet without a router.
2. Identify any two examples of malware.
● Trojan: A program disguised as useful software that is secretly harmful.
● Worm: Standalone malware that replicates itself and spreads automatically across
networks without user action. (Other examples include Viruses and Ransomware).
3. Identify why hackers clear logs during attacks.
Hackers clear logs (known as "Covering Tracks") to prevent detection of the attack and to
remove evidence of their presence on the system, making it difficult for administrators to trace
the breach back to them.
4. Show how weak authentication can lead to brute-force attacks on admin
panels.
Weak authentication, such as allowing unlimited login attempts and using simple, predictable
passwords (e.g., admin123), enables attackers to use automated tools to try every possible
combination of characters until they find the correct credentials. Without a lockout mechanism or
MFA, the system is defenseless against these high-speed guesses.
5. Apply DHCP starvation attack scenario.
In a DHCP starvation attack, an attacker sends thousands of DHCP requests using fake MAC
addresses. This exhausts the DHCP server's pool of available IP addresses. Once the pool is
empty, legitimate users cannot obtain an IP address, leading to a Denial of Service (DoS) for the
network.
6. Apply flow analysis to detect DDoS attack.
Flow analysis monitors metadata like traffic volume, duration, and IP patterns rather than
individual packet content. A DDoS attack is detected when the flow collector identifies a sudden,
massive spike in traffic volume or an abnormal number of simultaneous connections from
multiple sources to a single destination port.
7. Apply ethical guidelines for using sniffers in academic lab.
● Authorization: The student must have explicit written permission from the instructor or
lab administrator.
● Scope: Monitoring should be restricted only to devices/traffic within the designated lab
environment.
● Confidentiality: Any sensitive data captured during the exercise must remain private
and must not be shared or used for personal gain.
8. Illustrate how encrypted traffic affects IDS.
Since encryption (like HTTPS or VPNs) jumbles the data payload, a standard IDS cannot
inspect the content for malicious signatures. This allows attackers to hide exploits or malware
within the encrypted stream, rendering signature-based detection ineffective unless the IDS has
SSL/TLS inspection capabilities.
9. Why is 3DES more secure than DES?
3DES is more secure because it applies the DES algorithm three times to each data block
(usually in an Encrypt-Decrypt-Encrypt sequence). This effectively increases the key length (up
to 168 bits), making it significantly harder to break via brute-force compared to the original 56-bit
DES key.
10. Explain the role of HMAC in API security.
HMAC (Hash-based Message Authentication Code) is used to ensure both the integrity and
authenticity of API requests. It involves a cryptographic hash function combined with a secret
key shared between the client and server. If the calculated HMAC on the server side doesn't
match the one sent by the client, the request is rejected as tampered with or unauthorized.
Advanced Ethical Hacking & Cryptography
Study Guide
1. Importance of Ethical Hacking in Preventing Cyber Attacks
Ethical hacking is a proactive security measure that allows organizations to stay ahead of
malicious actors. Its importance is rooted in:
● Vulnerability Identification: It uncovers "hidden" weaknesses in software, physical
security, and human processes (social engineering) that automated tools might miss.
● Risk Mitigation: By simulating real-world attacks, organizations can prioritize patching
based on the actual exploitability of a bug rather than just its theoretical severity.
● Compliance and Trust: Many industries (finance, healthcare) require penetration
testing to meet regulatory standards (like PCI-DSS or HIPAA), building customer trust.
● Incident Response Testing: It evaluates how well an organization’s security team
detects and responds to an active breach, allowing them to fine-tune their alerts.
● Cost-Effectiveness: Preventing a breach through ethical hacking is significantly
cheaper than the legal fees and reputational damage following a successful attack.
2. Subnetting: Division and Benefits
Scenario: Divide the network [Link]/24 into 4 subnets.
● Calculation: To get 4 subnets, we need to borrow 2 bits ($2^2 = 4$). The new subnet
mask becomes /26 (or [Link]).
● Subnets:
○ [Link] to .63
○ [Link] to .127
○ [Link] to .191
○ [Link] to .255
● Benefits:
○ Reduced Congestion: Limits broadcast traffic to smaller groups, improving
speed.
○ Enhanced Security: Isolation prevents a breach in one department (e.g., Guest
Wi-Fi) from easily spreading to another (e.g., HR Servers).
○ Efficient IP Management: Organizes the network logically by department or
floor.
3. TCP Handshake Steps to Establish a Connection
The TCP connection is established using three specific packets:
1. SYN (Synchronize): The client sends a packet with a random sequence number $X$ to
the server to initiate the connection.
2. SYN-ACK (Synchronize-Acknowledge): The server responds, acknowledging the
client's request ($X+1$) and sending its own sequence number $Y$.
3. ACK (Acknowledge): The client sends a final packet acknowledging the server's
sequence number ($Y+1$). The connection is now open.
4. The Role of an Attack Vector
An attack vector is the path or means by which a hacker gains access to a computer or
network server in order to deliver a payload or malicious outcome. Understanding vectors (such
as unpatched software, phishing emails, or open ports) is essential for defenders because it
identifies the "entry points" that need to be secured.
5. Apply TCP Three-Way Handshake for a Reliable Connection
The three-way handshake ensures reliability by synchronizing sequence numbers between the
two parties. This synchronization allows both the sender and receiver to track which packets
have been received and which need to be retransmitted if lost. Without this initial handshake,
there would be no way to guarantee that data arrives in the correct order or at all.
Module 2: System Hacking
6. Vulnerability Chaining with a Real-World Example
Vulnerability chaining involves combining multiple low-severity bugs to achieve a high-impact
exploit.
● Example: An attacker finds a Directory Traversal bug that allows them to read a
hidden configuration file. That file contains a hardcoded database password. The
attacker then uses those credentials to log into the database and perform a SQL
Injection to gain administrative control over the entire web application.
7. The Role of Kali Linux in Ethical Hacking
Kali Linux is the industry-standard OS for security professionals because it provides a stable,
pre-configured environment with over 600 specialized tools (such as Nmap, Metasploit, and
Wireshark). It allows ethical hackers to perform every stage of a penetration test—from
information gathering to exploitation—using a single platform.
Module 3: Web Application Hacking
8. How CSRF Exploits User Authentication Mechanisms
CSRF (Cross-Site Request Forgery) exploits the browser's "Ambient Authority." Browsers are
designed to automatically include authentication cookies with every request sent to a specific
domain. An attacker exploits this by triggering a request from a victim's browser to a site where
they are already logged in; the server accepts the request as legitimate because the valid
session cookie is attached.
9. Explain Cross-Site Request Forgery (CSRF) Attack
A CSRF attack is a malicious exploit where a user is tricked into performing actions they did not
intend to do on a different website. For example, while browsing a forum, a user might click a
link that, in the background, sends a request to their bank's website to "Transfer Funds."
Because the user is logged into their bank in another tab, the bank processes the forged
transfer request.
Module 4: Network Sniffers & MITM
10. MITM Attacks using ARP Poisoning
Attackers perform a Man-In-The-Middle (MITM) attack by sending spoofed ARP (Address
Resolution Protocol) messages to a LAN. By telling the victim that the attacker's MAC address
belongs to the Gateway (Router), and telling the Router that the attacker's MAC belongs to the
victim, all traffic between the two passes through the attacker first, allowing for sniffing or data
modification.
11. Recommended Defense Strategy for University Campus Network
For a large campus environment, the best strategy is a Layered Defense:
● VLAN Segmentation: Separate student Wi-Fi from administrative and faculty networks.
● DHCP Snooping & DAI: Implement Dynamic ARP Inspection (DAI) on switches to block
spoofed ARP packets and stop MITM attacks.
● Port Security: Limit the number of MAC addresses allowed per physical port to prevent
rogue devices.
Module 5: Evading IDS, Firewalls & Honeypots
12. Challenges in Detecting Zero-Day Attacks
Zero-day attacks are difficult to detect because they have no known signature. Traditional
IDS/Firewalls look for specific "fingerprints" of known malware. Since a zero-day is brand new, it
bypasses these filters. Detecting them requires advanced Behavioral Analysis, which looks for
anomalies in how a system or user acts.
13. Effectiveness of AI-Powered Honeypots over Traditional Honeypots
● Traditional Honeypots: Static and easy for experienced hackers to identify as "fakes"
due to predictable responses.
● AI-Powered Honeypots: These use machine learning to adapt their "personality" and
responses in real-time based on the attacker's behavior. This makes them much more
convincing, keeping the attacker trapped longer and providing better forensic data.
Module 6: Cryptography
14. Secure Hash Algorithm (SHA): Merit and Demerit
● Merit: SHA provides high collision resistance (it is nearly impossible to find two different
inputs with the same hash) and is the global standard for verifying data integrity.
● Demerit: It is computationally more expensive than older algorithms like MD5. Older
versions (SHA-1) are now considered cryptographically broken and vulnerable to
collision attacks.
15. RSA Encryption/Decryption Calculation
Given: Message $M = 2$, Public Key $(n=33, e=7)$.
Encryption (Ciphertext $C$): $C = M^e \mod n$ $C = 2^7 \mod 33 = 128 \mod 33$ $128 \div
33 = 3$ with a remainder of $29$. $C = 29$
Decryption (Retrieve $M$):
1. Find $\phi(n)$: Since $n=33$, the prime factors are $p=3$ and $q=11$. $\phi(n) = (3-1)
\times (11-1) = 2 \times 10 = 20$.
2. Find Private Key ($d$): $(e \times d) \mod 20 = 1 \implies (7 \times 3) = 21 \equiv 1
\mod 20$. So, $d = 3$.
3. Perform Decryption: $M = C^d \mod n$ $M = 29^3 \mod 33$ Note: $29 \equiv -4 \mod
33$. $M = (-4)^3 \mod 33 = -64 \mod 33$. $-64 \div 33 = -2$ with a remainder of $2$. $M
= 2$
Ethical Hacking & Cryptography Solutions
(3 Marks)
1. Apply port addressing concepts to differentiate between HTTP and SSH
services.
Port addressing uses unique numbers to direct network traffic to specific services on a server.
● HTTP (Hypertext Transfer Protocol): Operates on Port 80. It is used for transferring
unencrypted web page data. When a browser requests a website, it targets this port.
● SSH (Secure Shell): Operates on Port 22. It is used for secure, encrypted remote login
and command execution.
● Difference: While both run over TCP, the port number tells the OS whether the incoming
packet is a request for a public web page (80) or a secure administrative session (22).
2. Apply the five stages of system hacking to test a vulnerable login
system.
To test a login system, an ethical hacker follows these stages:
1. Reconnaissance: Gathering info (e.g., finding the login URL and server type).
2. Scanning: Using Nmap to find open ports (like 80/443) and service versions.
3. Gaining Access: Attempting to bypass the login using Brute Force, Dictionary attacks,
or SQL Injection (e.g., ' OR '1'='1).
4. Maintaining Access: If successful, creating a "backdoor" or a fake admin account to
stay in the system.
5. Covering Tracks: Deleting server logs and history files to hide the testing activity.
3. Explain the Web server and Types of Web server attacks.
A Web Server is software/hardware that stores and delivers website content to users via
HTTP/HTTPS (e.g., Apache, Nginx). Types of Attacks:
● DoS/DDoS: Flooding the server with traffic to make it crash.
● Directory Traversal: Accessing files outside the web root folder (e.g.,
../../etc/passwd).
● Misconfiguration Attack: Exploiting default passwords or unpatched vulnerabilities in
the server software.
4. Show how encrypted protocols prevent password theft.
In unencrypted protocols (like HTTP or Telnet), data is sent in Plaintext. If an attacker sniffs the
network, they can see the password directly. Encrypted protocols (like HTTPS/SSL or SSH)
convert the password into Ciphertext using a key before transmission. Even if an attacker
captures the packet, they only see garbled data that is useless without the decryption key.
5. Demonstrate how CSRF can perform unauthorized money transfer in an
online banking system.
1. Requirement: The victim must be logged into their bank ([Link]) in one browser
tab.
2. The Forgery: An attacker sends a malicious link or hides a script on a website the victim
visits.
3. Execution: The script contains a hidden request: POST
[Link]/transfer?to=Attacker&amount=5000.
4. Success: The browser automatically attaches the victim's session cookies to the
request. The bank's server sees the valid cookie and processes the transfer without the
victim's consent.
6. Apply MAC flooding attack steps.
1. Identify Target: Attacker connects to a network switch.
2. Flood CAM Table: Using a tool like macof, the attacker sends thousands of Ethernet
frames with different fake source MAC addresses.
3. Force "Fail-Open": The switch's CAM (Content Addressable Memory) table fills up and
can no longer store real addresses.
4. Sniff Traffic: The switch begins acting like a "hub," broadcasting all incoming traffic to
every port. The attacker can now see everyone's data.
7. Compare IDS and IPS with a suitable scenario.
● IDS (Intrusion Detection System): Like a security camera. It monitors and alerts but
does not stop the attack.
○ Scenario: An attacker tries 100 passwords; IDS sends an email to the admin.
● IPS (Intrusion Prevention System): Like a security guard. It monitors and blocks the
threat in real-time.
○ Scenario: The IPS detects the 100 failed logins and automatically drops all future
packets from that attacker's IP address.
8. Demonstrate how fragmentation affects IDS reassembly.
Attackers use IP Fragmentation to evade an IDS. They break a malicious signature (e.g.,
"ATTACK") into small pieces across multiple packets.
● The Issue: If the IDS has a small timeout or limited memory, it might miss some
fragments or discard them before they are reassembled.
● The Result: The IDS sees harmless data fragments, while the target server
reassembles them back into the original "ATTACK" payload, allowing the exploit to pass
through undetected.
9. Apply RSA encryption using p=3, q=11, e=3 for message M=5.
1. Calculate n: $n = p \times q = 3 \times 11 = 33$.
2. Calculate $\phi(n)$: $\phi(n) = (3-1)(11-1) = 2 \times 10 = 20$.
3. Public Key: $(e, n) = (3, 33)$.
4. Encryption: $C = M^e \mod n$
○ $C = 5^3 \mod 33$
○ $C = 125 \mod 33$
○ $125 = (33 \times 3) + 26$.
○ Ciphertext $C = 26$.
10. Apply IP spoofing example in packet filtering firewall.
A packet filtering firewall often trusts internal IP addresses (e.g., [Link]).
● Scenario: An attacker outside the network sends a packet with the source IP manually
set to [Link] instead of their real external IP.
● Effect: If the firewall only checks the source IP and doesn't verify if that IP should be
coming from the "external" interface, it will allow the malicious packet into the internal
network, thinking it is from a trusted local machine.