nerdexam
GIAC

GPEN · Question #302

John works as a professional Ethical Hacker. He has been assigned the project of testing the and observes that the server crashes. Which of the following is the most likely cause of the server crash?

The correct answer is D. The we-are-secure server cannot handle the overlapping data fragments.. The server crash is caused by a Teardrop attack, which sends malformed overlapping IP fragments that vulnerable Windows systems cannot reassemble.

Exploitation & Post-Exploitation Techniques

Question

John works as a professional Ethical Hacker. He has been assigned the project of testing the and observes that the server crashes. Which of the following is the most likely cause of the server crash?

Options

  • AThe ICMP packet is larger than 65,536 bytes.
  • BPing requests at the server are too high.
  • CThe spoofed TCP SYN packet containing the IP address of the target is filled in both the
  • DThe we-are-secure server cannot handle the overlapping data fragments.

How the community answered

(42 responses)
  • A
    2% (1)
  • B
    7% (3)
  • C
    14% (6)
  • D
    76% (32)

Why each option

The server crash is caused by a Teardrop attack, which sends malformed overlapping IP fragments that vulnerable Windows systems cannot reassemble.

AThe ICMP packet is larger than 65,536 bytes.

An ICMP packet exceeding 65,536 bytes describes the Ping of Death attack, a separate vulnerability that does not involve overlapping fragment offsets.

BPing requests at the server are too high.

Excessive ping requests describe an ICMP flood DDoS attack, which overwhelms bandwidth or CPU rather than exploiting fragmentation reassembly logic.

CThe spoofed TCP SYN packet containing the IP address of the target is filled in both the

A spoofed TCP SYN packet containing the target's own IP address in both source and destination fields describes the Land attack, which is a distinct exploit unrelated to IP fragmentation.

DThe we-are-secure server cannot handle the overlapping data fragments.Correct

The Teardrop attack sends IP fragments with deliberately overlapping offset values, causing vulnerable operating systems to crash during the reassembly process. Windows NT and 2000 were historically susceptible because the kernel would fail when attempting to reconstruct contradictory fragment data, resulting in a Blue Screen of Death. This is a classic denial-of-service exploit targeting the IP fragment reassembly vulnerability in legacy Windows kernels.

Concept tested: Teardrop attack exploiting IP fragmentation reassembly

Topics

#Teardrop attack#IP fragmentation#overlapping fragments#DoS

Community Discussion

No community discussion yet for this question.

Full GPEN Practice