Eccouncil 312-50 Exam - Topic 3 Question 73 Discussion

Actual exam question for Eccouncil's 312-50 exam

Question #: 73
Topic #: 3

Stella, a professional hacker, performs an attack on web services by exploiting a vulnerability that provides additional routing information in the SOAP header to support asynchronous communication. This further allows the transmission of web-service requests and response messages using different TCP connections. Which of the following attack techniques is used by Stella to compromise the web services?

AXML injection

BWS-Address spoofing

CSOAPAction spoofing

DWeb services parsing attacks

Show Suggested Answer

Suggested Answer: C

by Lorrine at Aug 10, 2023, 07:16 PM

Limited Time Offer

25%

Off

Get Premium 312-50 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Chan

9 months ago

I'm leaning towards SOAPAction spoofing.

upvoted 0 times

...

Harrison

10 months ago

Wait, can you really exploit SOAP headers like that?

upvoted 0 times

...

Justine

10 months ago

Definitely not Web services parsing attacks!

upvoted 0 times

...

Aide

10 months ago

I think it's XML injection, though.

upvoted 0 times

...

Galen

10 months ago

Sounds like WS-Address spoofing to me.

upvoted 0 times

...

Ryan

11 months ago

I keep mixing up SOAPAction spoofing and WS-Address spoofing. I feel like both could be involved, but I lean towards WS-Address for this scenario.

upvoted 0 times

...

Francesco

11 months ago

This question feels similar to one we practiced in class about SOAP vulnerabilities. I think WS-Address spoofing is the best fit.

upvoted 0 times

...

Ressie

11 months ago

I'm not entirely sure, but I think XML injection could also be relevant here since it deals with manipulating XML data.

upvoted 0 times

...

Leota

11 months ago

I remember studying about WS-Address spoofing and how it can manipulate routing information in SOAP headers. That might be the right answer.

upvoted 0 times

...

Gwen

11 months ago

Okay, I think I've got this. The key is to identify the process that converts the sales and operations plan into specific resource requirements. I'm leaning towards Capacity Requirements Planning.

upvoted 0 times

...

Brandon

11 months ago

This is straightforward, I just need to simulate the stack and keep track of the top element after the final operation.

upvoted 0 times

...

Emogene

11 months ago

Okay, let me think this through. The question is asking about a requirement to disconnect the session after 10 minutes of inactivity. So I'm thinking the answer has to be related to some kind of timeout or idle time setting.

upvoted 0 times

...

Pamela

11 months ago

I remember something about one for each business domain, but wasn't there a case where two sufficed?

upvoted 0 times

...

Gregg

1 year ago

Wow, these web service attacks sound like something out of a spy movie. I bet Stella has a lair with a bunch of hacking equipment and a cat named 'Meowster Hacker.'

upvoted 0 times

Ashleigh

1 year ago

C) SOAPAction spoofing

upvoted 0 times

...

Cassie

1 year ago

B) WS-Address spoofing

upvoted 0 times

...

Herschel

1 year ago

A) XML injection

upvoted 0 times

...

Michel

1 year ago

D) Web services parsing attacks makes the most sense to me. If the attacker is exploiting a vulnerability in the way the web service handles the SOAP header, that's probably a parsing-related issue.

upvoted 0 times

...

Carmen

1 year ago

I'm going with C) SOAPAction spoofing. It sounds like the attacker is manipulating the SOAP header, and that's a classic SOAPAction spoofing attack, right?

upvoted 0 times

Charlena

1 year ago

Actually, it's C) SOAPAction spoofing. The attacker is indeed manipulating the SOAP header to compromise the web services.

upvoted 0 times

...

Mari

1 year ago

I think it could also be WS-Address spoofing, where the attacker manipulates the WS-Address to redirect requests.

upvoted 0 times

...

Erasmo

1 year ago

Yes, you're correct! SOAPAction spoofing involves manipulating the SOAP header to deceive the web service.

upvoted 0 times

...

Eden

1 year ago

I'm not sure about this one. The question seems a bit too specific for a certification exam. Maybe they're trying to trick us with all these obscure web service attack techniques.

upvoted 0 times

Jackie

1 year ago

D) Web services parsing attacks

upvoted 0 times

...

Gwen

1 year ago

C) SOAPAction spoofing

upvoted 0 times

...

Darell

1 year ago

B) WS-Address spoofing

upvoted 0 times

...

Cherilyn

1 year ago

A) XML injection

upvoted 0 times

...

Osvaldo

1 year ago

D) Web services parsing attacks

upvoted 0 times

...

Alfreda

1 year ago

C) SOAPAction spoofing

upvoted 0 times

...

Cory

1 year ago

B) WS-Address spoofing

upvoted 0 times

...

Dorsey

1 year ago

A) XML injection

upvoted 0 times

...

Frank

1 year ago

Based on the information provided, I believe the correct answer is B) WS-Address spoofing. The description mentions the attacker exploiting a vulnerability that allows for asynchronous communication, which points to the WS-Addressing protocol.

upvoted 0 times

...