Test: Module 01 — Introduction to Ethical Hacking¶

Instructions: Answer all questions. Write your answers directly below each question. Bonus questions are optional and can raise your score above 100%.

Total Points: 37 pts (Easy: 5 + Medium: 10 + Hard: 12 + Expert: 10) Bonus Available: 5 pts

Section 1: Easy Questions (1 pt each)¶

Q1. What is the single most important difference between an ethical hacker and a malicious attacker?

Q2. What does "CFAA" stand for, and what does it prohibit?

Q3. List the five phases of the penetration testing methodology in order.

Q4. Name three intentionally vulnerable practice environments where you can legally practice security testing skills.

Q5. What does the abbreviation "CVE" stand for, and who maintains the CVE database?

Section 2: Medium Questions (2 pts each)¶

Q6. Explain the "CIA triad" in cybersecurity. Give one real-world example of an attack that primarily violates each of the three properties.

Q7. A security researcher finds a vulnerability in a company's website that was not on the bug bounty program's in-scope list. They decide to test it anyway because "it's a serious issue and I'll report it for free." Explain why this is problematic from a legal and professional standpoint, and what the researcher should do instead.

Q8. Compare and contrast passive reconnaissance and active reconnaissance. Give two examples of each type.

Q9. What is the purpose of the "post-exploitation" phase in a penetration test? Why is it not sufficient to simply demonstrate that a vulnerability is exploitable?

Q10. Explain what a "trust boundary" is in the context of an attacker's threat model, and give two examples of trust boundaries in a typical web application.

Section 3: Hard Questions (3 pts each)¶

Q11. You are performing an authorized penetration test against a web application. During your testing, you follow a redirect and realize you have navigated to a system that is clearly not owned by your client. You have made one HTTP GET request to this external system.

What should you do immediately? What should you include in your final report about this incident? What does this scenario illustrate about scope management?

Q12. Examine the following login form HTML. Identify at least four potential security vulnerabilities or testing areas, explain what each one is, and describe how a developer should fix each one.

<form action="http://login.example.com/auth" method="GET">
  <input type="text" name="username" placeholder="Username">
  <input type="password" name="password" placeholder="Password">
  <input type="hidden" name="redirect" value="/dashboard">
  <input type="hidden" name="role" value="user">
  <button type="submit">Login</button>
</form>

Q13. Write a Python script (15–25 lines) that reads a list of common usernames from a file called usernames.txt and checks each one against a login endpoint — BUT intentionally designed to demonstrate responsible testing practices. Your script must include: - A clear comment at the top stating it is for authorized testing only - A hard-coded rate limit of 1 request per 2 seconds - A check that the target URL starts with http://localhost or http://192.168 before running - A log of all requests with timestamps

# Your code here

Q14. The Morris Worm (1988) and the WannaCry ransomware attack (2017) both caused massive disruption. Compare these two incidents in terms of: (a) the vulnerability class exploited, (b) the attacker's apparent intent, © the impact, and (d) what defensive lessons we can draw from each.

Section 4: Expert Questions (5 pts each)¶

Q15. Design a threat model for the following system: a company has deployed a web application that allows employees to submit expense reports. The application is accessible from the internet, requires employee login with username/password, allows file attachments (PDFs, images), stores data in a MySQL database, and sends email notifications to managers for approval.

Your threat model should include: (a) a list of all assets, (b) all trust boundaries, © at least 8 potential entry points with associated vulnerability classes, and (d) a prioritized list of the top 3 threats based on likelihood and impact.

Q16. Write an essay (200–300 words) on the responsible disclosure debate. Some researchers advocate for immediate full disclosure of vulnerabilities (to maximize pressure on vendors to patch quickly), while others argue for coordinated disclosure with a 90-day window. Synthesize the arguments for both positions and defend your own view on what the right policy is for a security researcher finding a critical vulnerability in a widely used open-source library.

Bonus Question (+5 pts)¶

Bonus 1. The OWASP Top 10 is updated periodically based on real-world vulnerability data. The 2021 version moved "Broken Access Control" to the #1 position (it was #5 in 2017). Based on your understanding of how web applications work and the historical context from this module, propose a hypothesis for why Broken Access Control has become more prevalent. Consider changes in web architecture (APIs, SPAs, microservices) that might contribute to this trend.