nerdexam
EC-Council

312-50V11 · Question #95

Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a…

The correct answer is D. Fred can send an IP packet to the switch with the ACK bit and the source address of his machine. This question tests understanding of TCP session spoofing using the ACK flag to make a network device believe an established session already exists.

Session Hijacking

Question

Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a session with his computer. How can Fred accomplish this?

Options

  • AFred can accomplish this by sending an IP packet with the RST/SIN bit and the source address of his
  • BHe can send an IP packet with the SYN bit and the source address of his computer.
  • CFred can send an IP packet with the ACK bit set to zero and the source address of the switch.
  • DFred can send an IP packet to the switch with the ACK bit and the source address of his machine.

How the community answered

(43 responses)
  • A
    12% (5)
  • B
    5% (2)
  • C
    5% (2)
  • D
    79% (34)

Why each option

This question tests understanding of TCP session spoofing using the ACK flag to make a network device believe an established session already exists.

AFred can accomplish this by sending an IP packet with the RST/SIN bit and the source address of his

The RST flag terminates existing connections rather than simulating one, and 'SIN' is not a valid TCP control flag, making this option technically incoherent.

BHe can send an IP packet with the SYN bit and the source address of his computer.

The SYN flag signals the start of a new three-way handshake, which initiates a fresh connection rather than impersonating an already-established session.

CFred can send an IP packet with the ACK bit set to zero and the source address of the switch.

A packet with ACK set to zero resembles the initial SYN of a new connection, not an established session, and spoofing the switch's own IP as the source address would not represent an external host attempting the trick.

DFred can send an IP packet to the switch with the ACK bit and the source address of his machine.Correct

In a standard TCP connection, the ACK flag is set on every packet exchanged after the initial SYN handshake, signaling that both sides have an established session. By sending a packet with the ACK bit set and his own external source address, Fred presents the switch with a packet that resembles mid-session traffic rather than a new connection attempt. Some switches and stateful devices that do not fully validate session state can be tricked into accepting this as part of an existing flow.

Concept tested: TCP ACK spoofing to simulate established sessions

Source: https://www.rfc-editor.org/rfc/rfc793

Topics

#TCP ACK scanning#session spoofing#packet crafting#switch security

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice