GPEN · Question #302
John works as a professional Ethical Hacker. He has been assigned the project of testing the and observes that the server crashes. Which of the following is the most likely cause of the server crash?
The correct answer is D. The we-are-secure server cannot handle the overlapping data fragments.. The server crash is caused by a Teardrop attack, which sends malformed overlapping IP fragments that vulnerable Windows systems cannot reassemble.
Question
John works as a professional Ethical Hacker. He has been assigned the project of testing the and observes that the server crashes. Which of the following is the most likely cause of the server crash?
Options
- AThe ICMP packet is larger than 65,536 bytes.
- BPing requests at the server are too high.
- CThe spoofed TCP SYN packet containing the IP address of the target is filled in both the
- DThe we-are-secure server cannot handle the overlapping data fragments.
How the community answered
(42 responses)- A2% (1)
- B7% (3)
- C14% (6)
- D76% (32)
Why each option
The server crash is caused by a Teardrop attack, which sends malformed overlapping IP fragments that vulnerable Windows systems cannot reassemble.
An ICMP packet exceeding 65,536 bytes describes the Ping of Death attack, a separate vulnerability that does not involve overlapping fragment offsets.
Excessive ping requests describe an ICMP flood DDoS attack, which overwhelms bandwidth or CPU rather than exploiting fragmentation reassembly logic.
A spoofed TCP SYN packet containing the target's own IP address in both source and destination fields describes the Land attack, which is a distinct exploit unrelated to IP fragmentation.
The Teardrop attack sends IP fragments with deliberately overlapping offset values, causing vulnerable operating systems to crash during the reassembly process. Windows NT and 2000 were historically susceptible because the kernel would fail when attempting to reconstruct contradictory fragment data, resulting in a Blue Screen of Death. This is a classic denial-of-service exploit targeting the IP fragment reassembly vulnerability in legacy Windows kernels.
Concept tested: Teardrop attack exploiting IP fragmentation reassembly
Topics
Community Discussion
No community discussion yet for this question.