312-50 Question 7
Single answer▪ Hacking ConceptsDuring an authorized internal assessment, a CEH tester is reviewing a web-based HR application that uses HTTPS for all logins. The tester observes that some employees access the application from a shared office network through an unmanaged switch. Management asks whether encrypted transport alone fully prevents credential theft on the local network. Which attack remains a realistic risk if the tester can place a malicious system on the same subnet and users do not verify certificate warnings?
- A
Performing a man-in-the-middle attack using ARP spoofing and presenting a fraudulent certificate to intercept credentials
- B
Recovering the original password directly from the server's stored TLS session keys captured on the network
- C
Using a SYN flood to force the browser to reveal cached usernames and passwords in cleartext
- D
Sniffing the HTTPS packets and reading usernames and passwords directly without modifying traffic
Show answer and explanation
Correct answer: A
Explanation
The best answer is the ARP spoofing-based man-in-the-middle attack combined with user acceptance of an invalid or fraudulent certificate. In CEH-relevant hacking concepts, HTTPS protects confidentiality and integrity in transit, but it depends on proper certificate validation. If an attacker gains a position in the traffic path on a local network, such as through ARP poisoning on IPv4, they can intercept and relay traffic. Modern TLS is designed to prevent simple eavesdropping, so passive sniffing alone is not enough. However, if users ignore certificate warnings, the attacker can terminate and re-encrypt sessions, effectively defeating the protection from the user's perspective. This aligns with common security guidance from browser vendors, OWASP Transport Layer Protection recommendations, and general TLS best practices: encryption is only trustworthy when endpoint identity is verified and certificate warnings are treated as security failures.
- A. Correct.
Correct. On a local subnet, an attacker can use ARP spoofing/poisoning to position themselves between the victim and gateway, enabling a man-in-the-middle attack. HTTPS normally protects credentials, but if the attacker presents a fraudulent certificate and the user ignores or accepts the certificate warning, the browser may establish a session through the attacker, allowing credential interception. This is a classic practical risk in local network attacks and demonstrates that encryption is only effective when certificate validation is enforced.
- B. Incorrect.
Incorrect. Capturing network traffic does not allow an attacker to recover passwords from 'server-stored TLS session keys.' TLS session keys are negotiated between endpoints and are not exposed on the wire in a way that would let an attacker simply derive the original password. This option reflects a misunderstanding of how TLS protects session data.
- C. Incorrect.
Incorrect. A SYN flood is a denial-of-service technique intended to exhaust resources by sending large numbers of half-open TCP connection requests. It does not cause browsers to disclose cached credentials in cleartext. This distractor confuses availability attacks with credential interception techniques.
- D. Incorrect.
Incorrect. Passive packet sniffing alone is not sufficient to read credentials sent over properly implemented HTTPS because the application data is encrypted. Without breaking TLS, compromising an endpoint, or successfully inserting into the connection with certificate abuse, the attacker cannot directly read usernames and passwords from captured packets.