312-50 Question 317
Single answer▪ Attack Authentication MechanismDuring an authorized internal assessment, you discover that a legacy web application uses HTTP Basic authentication over HTTPS and is integrated with the corporate Active Directory. The client wants to know which attack path is most realistic if an attacker gains temporary access to a user's workstation while the user is logged in and the browser has stored credentials for the application. Which technique would most directly target the authentication mechanism in this scenario?
- A
Extracting saved browser credentials or session artifacts from the workstation to reuse the authenticated access
- B
Performing a Smurf attack against the web server to force the application into bypassing authentication
- C
Using DNS zone transfer to retrieve the application's password database from the domain controller
- D
Launching an SQL injection attack against the login page to capture plaintext passwords from TLS packets
Show answer and explanation
Correct answer: A
Explanation
This question focuses on attacking an authentication mechanism through the most realistic and direct path available in the scenario. In a CEH context, authentication attacks are not limited to password guessing; they also include credential theft, session hijacking, abuse of cached secrets, and replay of authenticated state. When an attacker has temporary access to a logged-in user's workstation, the highest-probability path is often to reuse what is already trusted by the application: stored credentials, session cookies, browser password stores, or integrated authentication artifacts. This aligns with real-world attacker behavior documented in guidance from OWASP on session management and credential handling, as well as common enterprise security recommendations from Microsoft and browser vendors regarding credential storage and session protection. The other options are distractors because they either target availability rather than authentication, misuse reconnaissance concepts, or combine valid attack names with incorrect technical outcomes.
- A. Correct.
Correct. If a workstation is temporarily accessible and the user is already logged in, one of the most practical attacks against the authentication mechanism is harvesting stored browser credentials, cached authentication data, cookies, or active session artifacts. In real environments, attackers often abuse saved credentials or hijack an existing authenticated session rather than breaking the authentication protocol itself. This is especially relevant when the application relies on browser-stored secrets or reusable session tokens.
- B. Incorrect.
Incorrect. A Smurf attack is a denial-of-service technique using ICMP amplification. It does not directly target or bypass an authentication mechanism. A candidate might choose this if they confuse service disruption with authentication compromise, but taking a system offline does not provide authenticated access.
- C. Incorrect.
Incorrect. DNS zone transfer is related to DNS reconnaissance and misconfiguration, not credential extraction from Active Directory or web applications. Even if a zone transfer were allowed, it would expose DNS records, not the application's password database. This distractor reflects a common mistake of assuming any infrastructure weakness leads directly to authentication compromise.
- D. Incorrect.
Incorrect. SQL injection can, in some cases, bypass authentication or extract credential data from a vulnerable application, but the option is specifically flawed because TLS traffic is encrypted in transit and SQL injection does not allow an attacker to capture plaintext passwords from TLS packets. The wording combines two unrelated concepts. A candidate might select it because SQL injection is commonly associated with login pages, but the stated method is technically inaccurate.