312-50 Question 101
Single answer▪ Other Enumeration Techniques (IPsec, VoIP, RPC,During an authorized internal assessment, you identify a Linux-based VPN gateway that appears to support IKE/IPsec. The client wants to know whether the gateway is using a weak pre-shared key configuration that could be targeted offline, but they do not want you to perform password guessing against production services. Which action is the most appropriate enumeration technique to validate this risk with minimal impact?
- A
Use ike-scan against the gateway to enumerate IKE transforms and capture the handshake material needed to test for aggressive-mode PSK weakness offline
- B
Run SNMP community string brute-forcing against the gateway to extract the configured IPsec pre-shared key directly from the device
- C
Use rpcinfo to enumerate registered RPC programs on the gateway and identify the IKE version and pre-shared key policy
- D
Send SIP OPTIONS and REGISTER requests to the gateway to determine whether the VPN concentrator reuses VoIP credentials for IPsec authentication
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use ike-scan to enumerate the IKE/IPsec service. In a CEH-relevant assessment scenario, the goal is to gather actionable security information while minimizing operational impact. ike-scan can safely identify IKE parameters such as supported transforms and vendor IDs, and it is particularly useful for detecting IKEv1 aggressive mode. Aggressive mode is important because it exposes enough information in the exchange to enable offline analysis of PSK strength when PSK authentication is used. That makes it a more appropriate validation method than online guessing against the production gateway.
The other options are plausible because they reference legitimate enumeration domains covered in CEH: SNMP, RPC, and VoIP/SIP. However, they do not match the objective. SNMP brute-forcing tests management exposure, rpcinfo targets RPC services rather than IKE/IPsec, and SIP methods apply to VoIP infrastructure rather than VPN negotiation. Best practice is to select the enumeration technique that directly corresponds to the protocol under test and supports low-impact evidence collection. References include the ike-scan tool documentation and standard guidance on IKEv1 aggressive mode risks in IPsec deployments, as well as general vendor hardening recommendations to prefer IKEv2 or avoid aggressive mode with PSKs where possible.
- A. Correct.
Correct. ike-scan is a well-known enumeration tool for IKE/IPsec that can identify supported security associations, vendor identifiers, and whether a responder supports aggressive mode. In environments using IKEv1 aggressive mode with PSK authentication, captured handshake data can be analyzed offline to assess weak PSK exposure without repeatedly guessing against the live service. This is aligned with a low-impact enumeration approach during an authorized assessment.
- B. Incorrect.
Incorrect. SNMP may expose useful configuration information if it is enabled and misconfigured, but brute-forcing SNMP community strings is a different attack path and does not directly validate whether the IPsec service itself is vulnerable to offline PSK attacks. In many cases, the VPN gateway will not expose the pre-shared key via SNMP even if SNMP is accessible. This option confuses management-plane weaknesses with IPsec enumeration.
- C. Incorrect.
Incorrect. rpcinfo is used to query RPC services, typically on Unix-like systems running portmapper/rpcbind, to enumerate registered RPC programs and versions. It has no role in identifying IKE transforms, aggressive mode behavior, or PSK policy on an IPsec gateway. This distractor reflects confusion between RPC enumeration and IPsec enumeration techniques.
- D. Incorrect.
Incorrect. SIP OPTIONS and REGISTER are VoIP-related methods used to enumerate SIP endpoints, user agents, or registrar behavior. They do not provide reliable evidence about IPsec pre-shared key strength or IKE negotiation settings. This option incorrectly mixes VoIP enumeration techniques with VPN/IPsec assessment objectives.