NetBIOS over TCP/IP allows files and/or printers to be shared over the network. You are trying to
intercept the traffic from a victim machine to a corporate network printer. You are attempting to
hijack the printer network connection from your laptop by sniffing the wire. Which port does SMB
over TCP/IP use?

You have retrieved the raw hash values from a Windows 2000 Domain Controller. Using social
engineering, you come to know that they are enforcing strong passwords. You understand that all
users are required to use passwords that are at least 8 characters in length. All passwords must
also use 3 of the 4 following categories: lower case letters, capital letters, numbers and special
characters.
With your existing knowledge of users, likely user account names and the possibility that they will
choose the easiest passwords possible, what would be the fastest type of password cracking
attack you can run against these hash values and still get results?

Charlie is the network administrator for his company. Charlie just received a new Cisco router and
wants to test its capabilities out and to see if it might be susceptible to a DoS attack resulting in its
locking up. The IP address of the Cisco switch is 172.16.0.45. What command can Charlie use to
attempt this task?

One of the ways to map a targeted network for live hosts is by sending an ICMP ECHO request to
the broadcast or the network address. The request would be broadcasted to all hosts on the
targeted network. The live hosts will send an ICMP ECHO Reply to the attacker’s source IP
address.

You send a ping request to the broadcast address 192.168.5.255.

There are 40 computers up and running on the target network. Only 13 hosts send a reply while
others do not. Why?

An attacker runs netcat tool to transfer a secret file between two hosts.
Machine A: netcat -l -p 1234 < secretfile
Machine B: netcat 192.168.3.4 > 1234
He is worried about information being sniffed on the network. How would the attacker use netcat to
encrypt the information before transmitting onto the wire?

What type of encryption does WPA2 use?

What is GINA?

Attackers send an ACK probe packet with random sequence number, no response means port is
filtered (Stateful firewall is present) and RST response means the port is not filtered. What type of
Port Scanning is this?

Fingerprinting an Operating System helps a cracker because:

What is the command used to create a binary log file using tcpdump?