Examkin

Soru

Zorluk: OrtaNetwork and Wireless Attack Indicators

A security analyst reviews network traffic captures following reports of credential leakage on an internal subnet. The analyst observes frequent UDP port 5355 multicast traffic where an unauthenticated endpoint rapidly responds to failed host name resolution requests from legitimate clients, prompting those clients to attempt NTLMv2 authentication against the endpoint. Which of the following attack types is most directly indicated by this activity?

  1. Link-Local Multicast Name Resolution (LLMNR) poisoningCevap
  2. B
    ARP cache poisoning
  3. C
    DNS cache poisoning
  4. D
    Rogue DHCP server deployment

Cevap

The network activity indicates Link-Local Multicast Name Resolution (LLMNR) poisoning, where an attacker responds to fallback local hostname resolution requests over UDP port 5355 to capture user authentication hashes.
The correct answer identifies Link-Local Multicast Name Resolution (LLMNR) poisoning. LLMNR uses UDP port 5355 to resolve hostnames on the local subnet when primary DNS resolution fails. Attackers run tools to listen for these multicast requests and spoof replies, convincing victim machines to attempt NTLMv2 authentication against the attacker's machine, thereby capturing authentication hashes.

Adım Adım Çözüm

1
Analyze the network protocol and port observed in the traffic captures
The traffic relies on UDP port 5355, which is the standard port for Link-Local Multicast Name Resolution (LLMNR).
Identifying the transport protocol and port establishes the target service mechanism being exploited.
2
Examine the client-server interaction behavior and payload handling
The endpoint responds to failed hostname queries, causing clients to transmit NTLMv2 authentication credentials to the attacker.
LLMNR fallback occurs when DNS fails, allowing an attacker to spoof the destination identity and harvest authentication hashes.
3
Differentiate LLMNR poisoning from other layer 2/3 redirection attacks
Unlike ARP or DNS poisoning, LLMNR poisoning explicitly exploits local fallback multicast queries when primary name resolution fails.
Distinguishing the specific indicator (UDP 5355 + hostname fallback + NTLMv2 capture) confirms LLMNR poisoning as the correct diagnosis.

Anahtar Kavram

LLMNR/NBT-NS Poisoning Indicators
Bu soruyu puanla

Konular

Network and Wireless Attack Indicators

Bu konudan daha fazla soru