nerdexam
EC-Council

312-50V13 · Question #38

An attacker has installed a RAT on a host. The attacker wants to ensure that when a user Which file does the attacker need to modify?

The correct answer is D. Hosts. The attacker wants to redirect a user to a different website when a legitimate URL is typed, which is achieved by modifying the host-to-IP mapping on the local machine.

Submitted by anjalisingh· Mar 6, 2026System Hacking

Question

An attacker has installed a RAT on a host. The attacker wants to ensure that when a user Which file does the attacker need to modify?

Options

  • ABoot.ini
  • BSudoers
  • CNetworks
  • DHosts

How the community answered

(38 responses)
  • A
    8% (3)
  • B
    5% (2)
  • C
    16% (6)
  • D
    71% (27)

Why each option

The attacker wants to redirect a user to a different website when a legitimate URL is typed, which is achieved by modifying the host-to-IP mapping on the local machine.

ABoot.ini

`Boot.ini` is a legacy file used in older Windows versions to configure boot options and has no role in hostname resolution or URL redirection.

BSudoers

`Sudoers` is a configuration file found on Unix-like operating systems (e.g., Linux) that defines user permissions for executing commands as another user, and is irrelevant to Windows hostname resolution.

CNetworks

`Networks` is typically a Unix/Linux configuration file (`/etc/networks`) that lists network names and their associated IP addresses, not a Windows file for hostname redirection.

DHostsCorrect

The `hosts` file (on Windows, located at `%SystemRoot%\System32\drivers\etc\hosts`) is a local plain text file that maps hostnames to IP addresses. By modifying this file, an attacker can redirect legitimate domain names to a malicious IP address, causing the user's browser to connect to the attacker's server instead of the intended site.

Concept tested: Hosts file for hostname redirection

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-hosts-file-not-working

Topics

#Hosts file#DNS Spoofing#RAT#System persistence

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice