So welcome everyone to this section.
And this section is going to be one of the most important section as here we are going to solve the
sample question paper.
So this is the part, one of the video where we are going to solve questions from 1 to 10 and in the
next part will solve from 11 to 20.
As you know that in the practical exam there are a total of 20 questions and you get about six hours
to complete the exam.
So we will start with the question number one.
But before that, let me tell you something.
These questions are almost 100% accurate that come in the exam.
So while you are doing this question, make sure that you are also making your notes.
And if you don't want to make notes, at least write in a notebook like some important stuff which you
feel when you are preparing for the exam or before exams, you can revise something.
Otherwise there is no need because we have the GitHub repository.
So it is going to be very easy for you in the exam.
Let's start with the first question.
So the first question is, after discovering that a website hosted on a server was vulnerable to blind
SQL injection during a security assessment, it was determined that the database management system underlying
underlying the site was MySQL.
Can you identify the operating system of the machine hosting the database?
So this question is trying to confuse you by saying that this is vulnerable to blind SQL injection,
this and that, but in simple it is just asking you to identify the operating system of the machine
hosting the database, which means you are said to identify the IP or you are set to identify the port
in which the MySQL is open.
So you have to just see.
So first of all, what you are going to do.
You are going to use this command that is Nmap SV and this would be the subnet.
Don't worry, you would be given the subnet in your question paper only that what is the subnet?
Subnet?
So after you know that this is your subnet slash 24 and then you start scanning the IP addresses.
So within it after scanning is complete, it will show that how much host are up and those host which
are up, it will show the version details because we have SV this is the command.
It will show the version details it will show what are the service that are running and which are the
ports that are open.
So for example 172 dot 16 .0.0 if this contains like 255 IP addresses.
So it will say that, for example, six IP addresses are alive right now or six hosts are up.
So out of those six shows, one host must be there, which contains like which contains an open SQL
port.
And if you look at the GitHub repository repository, then you know that MySQL port number is 3306.
So you have to find out a an IP address which has port 3306 open and the service you will see beside
it is like MySQL.
So you know that this is the particular IP address that has MySQL port open.
Now that is our target IP.
After that you are going to use command Nmap minus O and then the IP address and hit enter.
Then it will tell you that what is the operating system of the hosting database?
If you don't want to follow all these complex steps, simply do the aggressive scan.
But this is going to take some time because aggressive scan is going to do all the scan it will scan
like what are the services that are running in particular ports?
What are the ports that are open?
What are the hosts that are alive?
And it will even tell you the operating system.
So that is why aggressive scan is going to take some time.
So it is better that you first find out the IP, which has 3306 port open and then scan the IP with
hyphen o command because hyphen o command tells you the operating system.
For more information, visit the GitHub repository and you can easily solve the question.
Now, let's talk about the second command.
Second question.
In an organization's network security assessment, a peculiar domain user account was discovered to
have been added to a machine with the IP address.
192.168.1. ten.
The following user accounts were found to be secure.
John Doe, Sarah Connor, Neo, Oracle and Sherlock.
What is the username of the suspicious account?
Please provide the username only and exclude the domain name.
Simply you have to use RTP to login.
Remember in the video where I have explained RTP, I have shown you an example of how you can solve
this type of question.
I have exactly solved this question in front of you so simply you have to use RTP to login.
I have explained you how to login using RTP.
After logging in you have to open CMD in the now logged in computer inside the RTP, then in the CMD
type the net user command.
After you type it, it will list out all the users that are present.
So from those list you have to like see John Doe, Sarah Connor, Neo, Oracle and Sherlock.
Except all these accounts, the remaining account which is shown, that is the account of the attacker.
So that is how the second question is solved.
Now, the third question, John, the network administrator was performing a routine security scan when
he noticed that the machine on the network had a port open for establishing Windows Remote Desktop Connection.
He needs to identify the IP address of the machine in question.
Can you assist John in locating the IP address of the machine?
So simply you have to find out the machine which has 3389 port open or which has RDP open.
So first of all, in question number one, you have to look at.
You have to look at the result of question number one, where you have scanned it, scanned the whole
subnet.
There.
You have found like you have found all the version and all the ports that are running and all the hosts
that are alive.
So out of those, find out the IP address, which has 3389 port open.
So that particular IP address is for RDP or the second one could be you can directly use Nmap hyphen
P and if you don't, if you are not using the first method, which means if in the first question,
if you didn't scan and map network, then you can use the second method in which you will type nmap
hyphen p n.
Remember I told you why we use p n and the next is port number hyphen P and then V that is service version
and then port three three, eight nine and then the IP.
So how are you going to know which IP it is?
Well, after you scan the subnet in question number one, you will find out like six IP address that
are up 6 or 7 IP address because in generally in exam only 6 or 7 IP address would be given.
So you can type each and every IP and check whether three three, eight nine is open or not.
It will take like 4 or 5 seconds for each IP to scan a particular port and then after within seconds
you will find out if you have not done the scan, which I mentioned in question number one, if you
have not completed that scan, then you have to do this particular scan to solve the question.
Number three.
The next is the ethical hacker.
One machine has a file called cri s ECB ftp IP dot exe containing encrypted credentials to connect to
an FTP server.
The files encryption code is ds ECB to proceed, the file needs to be decrypted to obtain the FTP credentials
afterward.
Use this FTP credentials hacker as the username to connect to the FTP server and retrieve the file called
flag one dot txt.
Can you decrypt the file and provide the contents of flag one dot txt as the answer?
Okay, so this is very simple question because in the crypt section remember I told you like how we
use Cryptool in that section.
In the video I have explained how to crack the dot exe file.
So here you simply know that this is a.
ECB like this is a ECB encrypted file.
So simply we are going to click on this button.
After opening the crypto, we will click on this button.
After clicking on this button, we will pick out the file in the ethical hacker one machine so we will
know it will mention us that where the file is stored like in this.
The file might be on the desktop or in the question.
It will tell you that.
See if in the question like it doesn't have mentioned that, where is the file?
That means the file is definitely on the desktop.
So you will directly click on here and then select the file from the desktop.
The file will show something like this ECP FTP.
After that, you will click on Encrypt, Decrypt, and then select the symmetric model.
And then the method of decryption like D is because see here is ECB.
When you after you click on it, then you will click on Decrypt and then the message would be decrypted.
That would be the particular FTP credential, which means we already know the hacker that is the username.
Next after decrypting it, we will get the password.
So when we get the password we will open CMD on our computer.
We'll type FTP and the particular IP address of the machine and then we will hit enter.
Then it will ask us the like, it will ask us the username.
So the username would be hacker and the password will be would be which you derive from this one.
The script tool.
And after that when you are logged in successfully to ftp simply type get file dot txt, get flag one
dot txt or get flag dot txt whatever the question answer.
So here it is.
Flag one dot txt here it will type flag one dot txt.
I just by mistake typed file dot txt.
Okay.
So question number five is also very easy.
It is asking you that in an organization it has been discovered that an employee stole critical bank
details and concealed them within a file called Secret Accounts dot txt using steganography.
Fortunately, the email attachment there containing the file was seized and saved onto the ethical hacker.
One machine.
Your task is to decipher the concealed information in the file and locate the account number the file
is stored in.
This is the place where the file is stored in and the password requires required to access the file
is magic.
Please enter only the numeric account number in your response.
Exactly.
I have solved this exact question in the snow video Snow tool video.
So just watch it.
It is just 4 or 5 minutes video.
Just watch it and if you have already watched it, then you can easily solve this question.
It is no like rocket science, just simply one command you will use and then it would be easily solved.
And that one command is it is in the GitHub repository or you can find it in the previous video.
Then comes question number six.
You are working as an ethical hacker for an organization and one of the employees, Sara, has reported
being locked out of her WordPress account at this is the URL for the WordPress account.
So she suspects foul play and has asked you for your help in retrieving her account password from the
WordPress database.
Your task is to identify the password associated with the user ID Sara and resolve the issue to allow
her to access her account.
Again, remember I told you that we are going to get a question related to WP scan or Metasploit?
Well, that is this question.
So you can directly enter this URL in the WordPress page and you can see that the WordPress, this is
a WordPress site.
Now we need to use the tool called WP scan.
We have been given the user ID that is Sarah, but we need a password.
So in order to get the password we will simply type WP scan, URL http, that is the website which we
have given.
URL which we have given you is for username.
Sarah and then P is for password.
We will use capital P because we are going to use the password list.
So remember you would be given a password list in the ethical hacker machine one in the desktop.
So you will be given two files that is username and password dot txt.
So in that you will have like 20 to 30 username and 20 to 30 passwords in the password file.
So you these are the lists that are given to you for brute forcing so you can use those lists and then
you can easily solve this question with the first command.
But most of the time WP scan doesn't work on the machines, so that is why for that you need to simply
use MSF console if you don't want to waste your time.
So you simply MSF console type MSF console in the parrot machine and then write use auxiliary scanner,
just copy it.
I have mentioned it in the GitHub repository, so just directly copy it and keep on copying.
And here you will set the password file to the text, like to the to the password text that is stored
in the ethical hacker machine.
Then set our host equal to the IP here.
Sorry, here I have given the IP like I have directly cut it from the GitHub repository from my GitHub
repository so I couldn't change it.
But here set to the particular IP address.
So here IP address is 192.168.1.0.
So just put it here then.
The port is 8080 so we'll put the port is here 800.
Then you have to set the target http 8080 and then you have to set the username to admin.
Sorry, not admin username to Sarah.
And when you click on Sarah and then hit enter after you do that, after you complete that, it will
start doing brute forcing in MSF console and then it will give you the password.
Oh, sorry, one more thing.
Set target here 8080 and you have to put here, I also forgot to add here because this you have to put
the exact URL here and then it will start doing the brute forcing and it will tell you the answer within
seconds.
Next is question number seven.
A file called Secret hash dot txt has been uploaded via dvwa.
At this IP, the file is located at the following path.
Okay.
Your task is to crack the MD5 hash present in the file and reveal the original message.
You can access the file by logging into using the provided credential.
Superuser password Superman.
So first thing we have been given the URL.
So we simply click on URL and when we click on this URL, we are asked, we are asked with this prompt
like we have to sign in.
So username and password is also given in the question we will use superuser and password is Superman.
So after doing that hit login and when you do that now you can.
Right now it is saying that the pass the secret hash dot txt is in the uploads directory.
So first dvwa dvwa.
Then hackable folder they are saying hackable folder, then the next is uploads.
So after you hit enter you will be shown a directory listing where you will find the secret hash dot
txt file hit enter and it will be downloaded.
After you download it, just double click on it and then you copy the hash inside it and then paste
it on hashes.com to crack it or you can paste it on crack station.org or crack station dot net.
Pretty simple, isn't it?
So the next is eighth question.
That is an ethical hacker working for a company you have been tasked with retrieving a critical file
named Secret dot txt that has been concealed with the server within the server 2019 machine.
The file is located at the following path.
The user's Dell documents confidential.
You will need to use a backdoor installed in the server to access the file.
Your objective is to find the secret number hidden inside the file and provide it as your answer.
So simply they are trying to complicate things for you and they are trying to make you feel nervous
because they have used words like words like backdoor installed in the server 2019 machine so that you
will become more and more flustered.
But in reality it's just a window machine and you don't need to do backdoor.
You just simply use credentials of RDP that you found in question two.
Remember in question two we found RDP like RDP login details.
So simply just use that RDP login details to log in to a computer and then browse to this particular
directory.
Okay.
After you do that, you will find the file called secret dot txt.
And when you find it, just open it and copy the number inside it.
It won't be encrypted.
It would be simply a number like it would say the secret code is one, two, three, four, five, 6
or 7 389.
They will simply show you that number.
Just copy that number and paste it in the answer tab.
That's it.
You will simply solve it.
So these questions are scenario based so as to make you more and more confused.
During a security assessment, it was discovered that a machine on a network was targeted by denial
of service attack.
A network session named Dos Dot Pcap was recorded and saved in the document.
Folders of the Ethical Hacker One Machine.
Your task is to identify the IP address of the attacker's machine.
Simply watch the Wireshark video.
In that whole Wireshark section, I have explained every question regarding Wireshark and I have solved
it.
So just simply watch it, watch it.
And if you have watched it, then there is no need to worry.
You can easily solve these questions.
So there would be three questions on Wireshark.
You will get easily three marks and this is the 10th question where they will ask you to analyze and
determine the number of machines that were used in the DDoS attack.
And they would have saved a file called Dos Dot Pcap.
So simply use the way which I have explained in the Wireshark section.
So our first part of this video is completed and now you have scored ten marks.
If you solved all these ten questions without my help, then it's a great thing and you are going to
ace the exam.
And if you needed some or if you needed a few help in these questions, then no need to worry because
you have to revise once more and you have to practice a little bit more, otherwise you would be easily
able to pass it.
We are not talking about passing here.
We want I want you to ace the exam.
I want you all to get 19 or 20 out of 20 in the exam.
I don't want you to just pass the exam because you will easily pass after you get 14 marks and you can
easily get 14 marks after completing this course.
But I want you all to ace the exam.
So in the next part, I'll explain the remaining 11 to 20 questions.