Ethical Hacking Interview Questions and Answers

Ethical Hacking is considered to be Legal. So it means, Intruding into the target system WITH THE PERMISSION OF USER. Ethical Hackers work on the hacked machine and repair the hacked features and deliver back the normally working machine to their clients. For detailed information on Ethical Hacking, Please visit our N-SCHOOL Ethical Hacking blog. This blog is a Catalogue on Ethical Hacking Interview Questions and answers. This will definitely help both Freshers as well as Experienced Professional Hackers to refresh their Hacking Knowledge.

1. Tell me about Ethical Hacking.

Ethical Hacking is the process of accessing a targeted computer network with the permission of its respective owner with the intent to solve and furnish the hacked issues. They do not damage the client’s computer system and their intent is the straight opposite of Hackers. Ethical Hackers continue their business with ethics.

2. Mention the types of hackers?

The 3 different types of Hackers are categorized based on their working attitude. They are,

1. White Hat Hackers
2. Black Hat Hackers
3. Grey Hat Hackers

3. Tell us which type of Hacking is considered legal. White Hat Hackers are legally permitted inside the working environment. Because they intend to save the hacked computer system and protect its information. Usually, they know where is the hacking entry point and usually block it and make the system safe. In terms of the Internet, White Hat is considered to be professionally safe.

4. What are the different forms of Hacking?

Hacking is an art of exploitation usually done to cause damage to physical systems, money and bring human stress. Computer machine in its every form is hacked as, – Password Hacking – Website Hacking – Network Hacking – Email Hacking – Ethical Hacking 5. Mention some popular Ethical Hacking tools that Ethical Hackers use in common? – Acunetix – Angry IP Scanner – Burp Suite – Ettercap – GFI LanGuard – Netsparker – SaferVPN – Savvius – John The Ripper The above are the frequently used tools by Ethical Hackers. 6 . Define FootPrinting. Foot Printing is Researching well before starting to Hack. Footprinting is a detailed process of gathering information about the target system before gaining access to a hack. Later upon hacking completion, the hackers must erase and hide all the hacked tracks and uncover them from targeted system owners. 7. Explain the techniques in FootPrinting in detail. Different techniques used in FootPrinting are explained below,

1. Open Source Footprinting – The ways to find administrator contact and login information is discussed well in OpenSource footprinting. This specific information is used later to guess and find out the correct password.
2. Network Enumeration – Here the hacker tries to identify domain names by DNS and identify if any loopholes as in the form of network blocks in the target.
3. Scanning – Soon after Network Identification, the next step is to spy the active IP addresses for identifying the active IP address by using ICMP protocol.
4. Stack Fingerprinting – This is the last stage and technique in footprinting, which maps together with the port and host.

8. Explain in detail about the CIA Triangle. CIA Triangle is a guiding model designed for safety features. It protects company information security policies. CIA stands for –

1. Confidentiality – Protecting the company secrets that are highly confidential.
2. Integrity – Ensuring the information is kept unchanged and stable.
3. Availability – Make sure that the data is kept accessible always by the company authorized members alone. And designing ways to maintain the data accessibly.

9. Explain about SNMP Protocol. SNMP protocol stands for Simple Network Management Protocol. It is used for simple Transmission, to monitor remotely (virtual monitoring), and managing and maintaining the hosts, routers, and other network devices. 10. Tell us about Network Enumeration. Network Enumeration is again a congregation process to collect information about a network. It uses protocols like Internet Control Message Protocol (ICMP) and SNMP for data collection. The main advantage of Network Enumeration is it provides a better view of the data. So it has to undergo methods like fetching information from hosts, connecting devices, and group information. 11. Explain MIB. MIB is the abbreviation of Management Information Base. MIB has all accurate information and knowledge about Network objects and it is structured as a Hierarchical Virtual Database. It is applied in SNMP and Remote MONitoring 1 (RMON1). 12. Explain Sniffing attack A sniffing attack is a malicious attack used by Hackers that is similar to accepting a phone call and hearing the ongoing conversation as a third party without the knowledge of actual callers. Technically, Sniffers block and capture the data packets in ongoing network traffic. They do this theft activity to capture secret information and necessary data. Actually Sniffing is conducted by Sniffers by using a Sniffing Tool. 13. Mention the different Sniffing tools? There are various sniffing tools used by the Sniffers. Out of them, the commonly used ones are

1. Dsniff
2. Ettercap
3. MSN Sniffer
4. NetworkMiner
5. PRTG Network Monitor
6. Steel Central Packet Analyzer
7. WinDump

14. Tell us about the advantages of Ethical Hacking. The superlative Merits of Ethical Hacking are:

1. Helps in protecting our technology and Information Security against cyber terrorism and national security violation.
2. Ethical Hacking takes precautionary methods against hackers.
3. Its main advantage is it helps in preventing security breaches.
4. It doesn’t allow malicious hackers to gain access to targeted machines.
5. Ethical Hackers are greatly helpful in Banking and Government sectors.
6. Ethical Hackers usually know the entry point of any hackers. So their primary work is to close and block that hacking passage.

15. Explain the disadvantages of Ethical Hackers? Some main disadvantages in the Ethical Hacking domain are that,

1. There are chances for an ethical hacker to steal highly sensitive information on the client’s computer system.
2. Many use that data for any malicious use later.
3. From the organizational perspective, any company must pay high for Ethical Hackers depending on their experience.

16. List the different password cracking techniques. The different types of password cracking technique are

1. AttackBrute Forcing
2. AttackRule
3. AttackSyllable
4. AttackHybrid
5. Social Engineering
6. Spidering
7. Guessing
8. Phishing

17. Explain DOS Attack. DOS attack is termed as Denial of Service attack. It’s a process to shut down a machine or a network to make sure that no user can access it. DOS attack is powered by User over consumption of resources that result in flooding servers, systems, and network traffic. 18. Explain the stages in Hacking? The different stages in Hacking are listed below as per order.

1. Gaining Access Escalating
2. Privileges Executing
3. Applications Hiding
4. FilesCovering Tracks

19. Tell us about CoWPAtty CoWPAtty is a software that is built-in C Programming by Joshua Wright. It provides hackers, attackers, and network administrators a way to develop offline dictionary-based attacks against wireless systems like Wi-Fi, Bluetooth. It enables its users to break wireless WPA and WPA2 systems by taking primacy over authentication based on the PSK (PreShared Key) model. 20. Tell us what you know about IP addresses and MAC addresses. IP Address is abbreviated as Internet Protocol Address. The IP address is actually an allocation address to every device on your network. MAC stands for Media Access Control Address. A MAC address has a unique serial number assigned to every network interface on every device. 21. What is SQL Injection We know SQL is a common database. But in the Hacking world, they use SQL Injection as a technique to steal information from organizations. Actually, hackers brought SQL queries into use by finding a fault in the application code. SQL injection is actually carried out when hackers inject/insert any malicious content into a normal and official SQL query string. SQL Injection is done by hackers with the intent to destroy the complete database of an organization. 22.Explain Trojan. A Trojan horse or Trojan is a type of malware developed by hackers and used to gain access to login into the target system of the user. After criminally logged in to the target system, the Trojan horse starts to damage the Routers and other networking devices. Hackers now use it as a chance to re-direct traffic on wifi connected devices and log in to commit CyberCrimes. 23. What is Phishing? Online based Social Engineering attacks are Phishing. Actually, Phishing concentrates to start cybercrime through Mail. Hence, the Phishing technique involves sending fake e-mails and chats to imitate the actual system(without the knowledge of the real system) with an intent to steal Official/Personal information from the original identity or person. 24. List the varieties of Trojan. Some types of malicious Trojan are,

1. Trojan-Downloader
2. Ransomware
3. Trojan-Banker
4. Trojan-Droppers
5. Trojan-Rootkits and
6. Trojan-Backdoor

From the above, hope you have got an idea about important and basic concepts on Ethical Hacking. Now, let’s proceed to some brainstorming questions for tenured professionals. 25. What are the different types of SQL injection? The 3 types of SQL Injection are depicted below,

1. Blind SQL injection
2. Error-based SQL injection
3. Time-based SQL injection

26. List out the types involved in Social Engineering? The varied forms of Social Engineering attacks that in-directly causes threats to society are,

1. Phishing
2. Pretexting
3. Baiting
4. Tailgating
5. Spear phishing
6. Quid pro quo
7. Vishing

27. Describe Penetration Testing. Penetration testing in ethical hacking is the practice to test any computer system, network, or web application to find if it has undergone security breaches that an attacker has intruded on. Penetration testing nowadays could be automated with software applications or sometimes performed manually itself. Some types of Penetration Testing are explained below,

1. Black Box: The Hackers try to gain information on their own try.
2. External Penetration Testing: The hacker will need the help of any public network like an Internet source to exploit data. This is called External Penetration Testing.
3. Internal Penetration Testing: The attacker actually may physically be present inside the network of the company and performs hacking simply with the well-known information.
4. Grey Box: The Ethical hacker will try intruding the data with partial knowledge of the infrastructure gained. For the rest of the information, they will depend on Tools or applications.
5. White Box: Ethical hackers are provided with all the up-to-date information about the infrastructure, network, and physical system of the organization that needs to be penetrated and actually needs to be repaired.

28. Explain Spoofing. Spoofing is a benevolent act that is done by hackers to steal our personal information and money. The spoofing process is initiated by sending a verbal/voice communication from a strange/unauthorized source that is personated as a trusted source. If our common users just attend or click the respective voice and verbal communication, it paves way for the hackers to access their information automatically without the concerned person’s knowledge. So we should be cautious from malicious sources even in mail or call. Because Hackers usually insert infected links or attachments through websites, emails, and phone calls, or even in Address Resolution Protocol (ARP) or Domain Name System (DNS) server. 29. Explain CSRF. CSRF is Cross-Site Request Forgery. CSRF attack becomes successful when the attacker successfully urges the victim user to act on them unintentionally. For example, the CSRF attack includes requests to change the email address for their account, to change their user ID and password, or to transfer monetary funds. Hackers actually fool the users in direct communication and hence many common men fall prey to CSRF. 30. How will you avoid CSRF? To control and stop CSRF Ethical Hackers can attach an uncertain Challenge token to each request and couple them with the user’s forum. So, the developer makes sure that the request received is from a valid and original source. So CSRF is actually identified through a Challenge token. But anyone has to be careful about unknown calls and responses. 31. Tell us about Fingerprinting in Ethical Hacking. Fingerprinting identifies which Operating System(OS) is running on a remote computer. Fingerprinting is also known as Footprinting. It is the art of using the information to co-ordinate data sets to recognize network services, operating system ID and its version, software applications, and databases. The two kinds of Fingerprinting are described below,

1. Active fingerprinting: Specially designed packets are transferred to the target machine. Then, The target OS decides the response based on the collected data.
2. Passive fingerprinting: Based on the sniffer traces of the packets, Ethical Hackers can find out the OS of the remote host machine.

32. List the different Enumeration types. The different kinds of Enumerations in ethical hacking are:

1. DNS enumeration
2. SNMP enumeration
3. SMB enumeration
4. NTP enumeration
5. Linux/Windows enumeration

33. Tell us about Enumeration. Enumeration is the method of extracting machine names, user identity through names and user IDs, network resources, shared services from a system. The Enumeration techniques are conducted under the Intranet Environment. 34. Describe NTP. NTP is Network Time Protocol. Its primary use is to synchronize clocks in Networked computers. Port 123 is used for primary communication. Time is maintained up to 10 milliseconds over the Public Internet. 35. What do you think about the best programming languages for Hacking? Some popularly used programming languages for hacking are our commonly used coding languages. They are,

1. Python
2. SQL
3. C- language
4. JavaScript
5. PHP
6. C++
7. Java
8. Ruby
9. Perl
10. Lisp

36. Who is a Script Kiddie? Some persons will have a below-average range even in basics of computer programming knowledge but could be very innovative in the usage of simple software. They use this software application knowledge to attack a computer. Those techies are identified as Script Kiddie. 37. Tell us about Virus. VIRUS is defined as a piece of code that has the ability to copy and multiply itself which leads to disastrous effects, such as corrupting the entire physical system or causing threats to data. Actually, VIRUS is Vital Information Resource Under Siege. 38. List out some programs used for Hacking. Some software is dedicatedly designed as an application to use for Hacking. Those kind of programs available currently are,

1. Kali Linux penetration software.
2. Cain and Able hacking software
3. Hydra hacking software
4. Nessus vulnerability scanner
5. Metasploit by Rapid7

39. Abbreviate STRIDE

1. Spoofing
2. Tampering,
3. Reputation,
4. Information disclosure,
5. Denial of service
6. Elevation of privilege.

40. What is PGP and where is it used? PGP is Pretty Good Privacy. PGP is a standard encryption system used for both sending encrypted emails and to encrypt sensitive files. It was invented in 1991 by developing in C Programming language. To protect email security, PGP was developed. 41. Define Encryption. The Human Readable Content is converted into unreadable symbolic junk values that humans couldn’t read and understand. This process of conversion is called Encryption. 42. Explain Mailfinder Trojan This variety of Trojan finds the emails that are stored anywhere, in any luke and corner in your computer even through the keyloggers. They steal the mail information to sell those email ids outside to digital marketers or spammers. 43. Explain Brute Force Attack. A brute force attack is commonly used at the very first attempt by all to start the hacking process. Guessing the username or password by trying with all possible combinations of alphabets, numbers, and special characters are called a Brute Force Attack. 44. Tell me about Bot A Bot is a script or software created mainly to attack the network faster and damage it to the core. A Bot is a program that automates a repetitive action performed at a much higher rate for several periods of time more than a human operator could do it. 45. Explain Botnet? A Botnet is a network of Bots. It is also termed as a zombie army, where a group of computers is controlled without their respective owners’ knowledge. Botnets are made to work by sending spam emails or to make denial of service attacks. 46. List the types of Spoofing. Some various kinds of Spoofing are,

1. IP Spoofing Attack.
2. DNS Spoofing Attack.
3. Media Access Control (MAC)
4. ARP Spoofing Attack.

47. Mention the Top 5 Cybercrimes that you know. The topped cybercrimes are ordered below,

1. Phishing scams
2. Website Spoofing
3. Ransomware attacks
4. Malware
5. IoT Hacking

48. Can a satellite be hacked? Of course, Yes. Modern Tech Brains paves the way to hack any network. Even hacking Satellites are a simpler task for hackers nowadays. As we know, Satellites are controlled from Ground stations. If this ground station computer network is hacked, then the entire satellite network will come under the Hacker’s control. Then, they start sending malicious commands to satellites that become a big safety threat to the whole nation. 49. Which programming language you think is the best fit for hacking? I feel JavaScript is the best language to hack. Because this scripting code is mostly used in client-side programming and also it is the best programming language for web designing and development and hence it becomes best for hacking web applications too. Nowadays, hackers feel it is the best programming language for efficient hacking and also for developing cross-site scripting hacking programs. 50. Which country has the pool of Hackers? The Republic of China has the hub of Hackers. China is the Homeplace to the largest number of hackers on Earth. The majority of its Youth have Cyber Literacy because China promoted Cyber Security as its culture. This led to the birth of many cybercriminals too. As per several estimates, nearly 45% of the global cyber attacks have their source root in China. CONCLUSION: From the above queries, the significance of Ethical Hacking is clearly brought into the picture. Saving our National and International Information security is also considered a National Duty. As said clearly in our previous Ethical Hacking blog, any graduates are eligible to continue a course in Ethical Hacking. So be an Ethical Hacking expert by going through the above queries and check our N-SCHOOL course list to enroll yourself for cybersafety!.