Discuss GAQM CPEH-001 Exam Topic 4 Question 14

Eric notices repeated probes to port 1080. He learns that the protocol being used is designed to allow a host outside of a firewall to connect transparently and securely through the firewall. He wonders if his firewall has been breached. What would be your inference?

AEric network has been penetrated by a firewall breach

BThe attacker is using the ICMP protocol to have a covert channel

CEric has a Wingate package providing FTP redirection on his network

DSomebody is using SOCKS on the network to communicate through the firewall

Suggested Answer: D

Port Description:

SOCKS. SOCKS port, used to support outbound tcp services (FTP, HTTP, etc). Vulnerable similar to FTP Bounce, in that attacker can connect to this port and bounce out to another internal host. Done to either reach a protected internal host or mask true source of attack. Listen for connection attempts to this port -- good sign of port scans, SOCKS-probes, or bounce attacks. Also a means to access restricted resources. Example: Bouncing off a MILNET gateway SOCKS port allows attacker to access web sites, etc. that were restricted only to.mil domain hosts.

Get Premium CPEH-001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Galen 12 months ago

Wait, are we sure it's not something else?

Charisse 12 months ago

Nah, it's probably just a misconfigured proxy.

Rodrigo 12 months ago

I think it could be a breach, though.

Bobbye 1 year ago

Definitely sounds like a SOCKS issue.

Carmen 1 year ago

Port 1080 is commonly used for SOCKS.

Maynard 1 year ago

I vaguely remember something about Wingate and FTP redirection, but I can't recall the details. Option C doesn't seem likely, though.

Marleen 1 year ago

I feel like if Eric is seeing repeated probes, it could indicate a breach, but I don't want to jump to conclusions. Option A seems too definitive for me.

Dong 1 year ago

I think I came across a practice question about covert channels using ICMP, but I don't recall the specifics. Option B might be a possibility, but it feels a bit off.

Junita 1 year ago

I remember studying about port 1080 being associated with SOCKS, so option D seems plausible, but I'm not entirely sure if that's the only explanation.

Chuck 1 year ago

Okay, let me think this through. The question is asking about restricting the number of subdirectories, so it's probably not -s or -n, which are more general options. I'm leaning towards -maxdepth, but I'll double-check the man page just to be sure.

Flo 1 year ago

I think I've got a good handle on this. The trick is to work backwards from the loss on sale to find the proceeds. As long as I double-check my work, I should be able to nail this question.

Lenna 1 year ago

Ah, this is a good one! The key here is remembering that /etc/passwd is the standard file that contains user account information, including the home directory and login shell. I'm pretty sure that's the right answer.

GAQM CPEH-001 Exam - Topic 4 Question 14 Discussion