ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ42

VerifiedPenetration Testing Essential Concepts

Joe, an ECSA-certified professional, is conducting a penetration-testing engagement for one of his SME clients. He found the following entry in the hosts file on one Windows machine:

213.65.172.55 microsoft.com

After carrying out a Whois lookup, Joe determined that the IP address does not belong to Microsoft.com. The network administrator denied changing the hosts files.

Which type of attack is represented by this scenario?

Explanation

DNS poisoning redirects a domain name to an incorrect IP address. A malicious hosts-file mapping can override normal name resolution and send requests for microsoft.com to an attacker-controlled or otherwise fraudulent address.

Community Discussion

No comments yet. Be the first to start the discussion!