Ethical Hacking Interview Questions and Answers

Ethical Hacking is the authorized process of identifying and validating security vulnerabilities in systems, networks, applications and cloud environments using attacker-like techniques. It covers:

• Reconnaissance: Gathering target information.
• Scanning & Enumeration: Identifying hosts, services and vulnerabilities.
• Exploitation: Validating security vulnerabilities.
• Post-Exploitation: Assessing the impact of compromise.
• Reporting & Remediation: Documenting findings and security fixes.

1. What is a network sniffer?

A network sniffer (also called a packet sniffer) is a tool that captures and analyzes data packets traveling across a network. It is used to monitor network traffic, troubleshoot connectivity issues, detect security threats and analyze network protocols. Examples: Wireshark, tcpdump, Tshark.

2. How can you avoid ARP poisoning?

ARP poisoning can be prevented by implementing multiple security measures, including:

• Implement Port Security: Restricts unauthorized devices from connecting to switch ports.
• Network Segmentation: Isolates sensitive systems using VLANs to reduce the attack surface.
• Use Encrypted Protocols: Employ HTTPS, SSH and VPNs to protect data even if ARP poisoning occurs.
• Monitor the Network: Use IDS/IPS and ARP monitoring tools to detect suspicious ARP activity.

3. What are the phases of hacking a system?

The hacking process generally consists of the following phases:

• Reconnaissance: Gathering information about the target using passive or active techniques.
• Scanning and Enumeration: Identifying live hosts, open ports, services, operating systems and potential vulnerabilities.
• Gaining Access: Exploiting identified vulnerabilities to obtain unauthorized access to the target system.
• Maintaining Access: Establishing persistence to retain access for future use, often through backdoors or other persistence mechanisms.
• Covering Tracks: Removing or altering logs, deleting evidence and hiding activities to avoid detection.

4. What are the different ethical hacking tools?

Some of the most commonly used ethical hacking tools include:

• Nmap: Network scanning and port discovery.
• Nessus: Vulnerability assessment and security auditing.
• Nikto: Web server vulnerability scanner.
• Kismet: Wireless network detection and analysis.
• NetStumbler: Wireless network discovery (Windows).

5. Why is Python utilized for hacking?

Python is widely used in ethical hacking because it is simple, powerful and highly versatile. It enables security professionals to automate repetitive tasks, develop custom security tools, analyze vulnerabilities, perform network scanning, interact with APIs and write exploit or proof-of-concept (PoC) scripts.

6. What are Pharming and Defacement?

• Pharming: A cyberattack that redirects users from a legitimate website to a fake one by manipulating DNS records, DNS servers or the hosts file to steal sensitive information.
• Website Defacement: An attack in which an attacker gains unauthorized access to a website and modifies its content or homepage to display unauthorized messages, images or other content.

7. Different types of buffer overflows and methods of detection?

Types of Buffer Overflows:

• Stack-based Buffer Overflow: Occurs when excessive data overwrites memory on the stack, potentially allowing arbitrary code execution.
• Heap-based Buffer Overflow: Occurs when data exceeds the allocated heap memory, leading to memory corruption or application compromise.
• Format String Vulnerability: Happens when untrusted user input is passed directly to format functions (e.g., printf()), allowing attackers to read or write memory.

Detection Methods:

• SAST: Analyzes source code to identify buffer overflow vulnerabilities before execution.
• DAST: Detects vulnerabilities by testing the running application.
• Fuzz Testing: Sends unexpected or malformed inputs to uncover crashes and memory errors.
• Code Reviews: Examines source code for unsafe memory operations and insecure functions.

8. What is Burp Suite? 

Burp Suite is an integrated web application security testing platform developed by PortSwigger. It is widely used by penetration testers to identify and exploit web application vulnerabilities through features such as proxying, scanning, crawling, request manipulation and automated security testing.

9. Define the term Script kiddies?

Script Kiddies are inexperienced attackers who use pre-built hacking tools, scripts or exploits created by others instead of developing their own techniques. They generally have limited technical knowledge and often target systems for curiosity, recognition or disruption rather than sophisticated attacks.

10. Explain the function of Directory Traversal Attack?

A Directory Traversal (also known as Path Traversal) attack is a vulnerability that allows an attacker to access files and directories outside the application's intended directory by manipulating file path inputs (e.g., ../). It can expose sensitive files such as configuration files, application source code, passwords or operating system files.

11. Explain Web Server Hardening Methods?

Web Server Hardening is the process of securing a web server by reducing its attack surface and eliminating security weaknesses. Some common web server hardening methods include:

• Keep the server updated with the latest security patches.
• Configure SSL/TLS securely by using strong ciphers and valid certificates.
• Disable unnecessary services, modules and default accounts.
• Restrict file and directory permissions using the principle of least privilege.
• Remove default pages, sample applications and unnecessary files.

12. What is NTFS File Streaming?

NTFS File Streaming, also known as Alternate Data Streams (ADS), is an NTFS feature that allows multiple data streams to be associated with a single file without affecting its primary content. While designed for storing additional metadata, attackers can misuse ADS to hide malicious files or code from normal file listings.

13. What is HMAC (Hashed Message Authentication Code)?

HMAC is a cryptographic mechanism that uses a secret key and a hash function (such as SHA-256) to verify the integrity and authenticity of a message. It ensures that the data has not been altered and confirms it was sent by someone who possesses the shared secret key.

14. How Does a Network Sniffer Work?

A sniffer captures and analyzes network packets transmitted between devices. In ethical hacking, it is used to monitor network traffic, troubleshoot connectivity issues, analyze protocols and identify security vulnerabilities. Sniffers capture packet headers and payloads for inspection.

15. Describe how you would prevent session hijacking?

Session hijacking can be prevented by implementing the following security measures:

• Use HTTPS and HSTS to encrypt session traffic.
• Set cookies with the HttpOnly, Secure and SameSite attributes.
• Regenerate session IDs after login and privilege changes.
• Invalidate sessions on logout or after inactivity.
• Implement CSRF tokens for sensitive operations.
• Use Content Security Policy (CSP) to reduce XSS risks.

16. Explain the principle of wireless sniffers to locate SSIDs?

Wireless sniffers capture and analyze 802.11 wireless packets transmitted over Wi-Fi networks. By monitoring beacon frames, probe requests and probe responses, they can identify the network's SSID (Service Set Identifier), BSSID (AP MAC address), channel and connected devices.

Tools like Kismet, Airodump-ng and Wireshark can discover both broadcast and, in many cases, hidden SSIDs by analyzing wireless management frames

17. What to do after a security breach occurs?

The priority after a breach is containment, investigation, recovery and communication while preserving evidence for forensic analysis. After a security breach, the following steps should be taken:

• Contain the incident to prevent further damage.
• Identify and investigate the root cause of the breach.
• Notify affected users and relevant authorities as required.
• Reset compromised credentials and secure affected systems.
• Recover from backups and monitor for any further malicious activity.

18. What is the main purpose of penetration testing?

The main purpose of penetration testing is to identify and exploit security vulnerabilities in systems, networks or applications before attackers can. It helps organizations assess their security posture, evaluate the impact of vulnerabilities and implement effective remediation measures.

19. What is an Evil Twin (AP Masquerading)?

An Evil Twin (or AP Masquerading) is a rogue wireless access point that impersonates a legitimate Wi-Fi network by using the same or a similar SSID. Attackers use it to trick users into connecting, allowing them to intercept network traffic, steal credentials or perform man-in-the-middle (MITM) attacks.

20. What is coWPAtty in ethical hacking?

coWPAtty is a command-line tool used to perform dictionary and brute-force attacks against WPA/WPA2-PSK wireless networks. It attempts to recover the Wi-Fi pre-shared key by comparing captured WPA handshakes with passwords from a wordlist.

21. What are GREY areas in the company?

Grey areas are situations where an action is not clearly permitted or prohibited by laws, policies or contracts. In cybersecurity, they involve activities that may be technically possible but lack explicit authorization, making them legally or ethically questionable.

22. What is cross-site scripting and explain the types of cross-site scripting?

Cross-Site Scripting (XSS) is a web application vulnerability in which an attacker injects malicious client-side scripts (usually JavaScript) into a trusted website. These scripts execute in the victim's browser, potentially stealing cookies, session tokens or performing unauthorized actions. Types of XSS:

• Reflected XSS: Malicious script is included in a request and immediately reflected in the server's response.
• Stored XSS: Malicious script is permanently stored on the server (e.g., in a database) and executed whenever users access the affected page.
• DOM-based XSS: The vulnerability exists in client-side JavaScript, where user input modifies the DOM without proper validation.

23. What is CSRF ( Cross-site request forgery )?

CSRF is a web attack in which an attacker tricks an authenticated user into performing unintended actions on a trusted website without their consent. The attack exploits the user's active session to execute unauthorized requests.

24. What are NetBIOS DoS attacks?

A NetBIOS DoS (Denial-of-Service) attack targets the NetBIOS service by flooding it with excessive or malformed requests, exhausting system or network resources and disrupting services such as file sharing, name resolution and printer sharing.

25. What are the components of physical security in ethical hacking?

The key components of physical security include:

• Access Control: Restricts entry using locks, ID cards, biometrics or keypads.
• Surveillance: Uses CCTV cameras and security monitoring to detect suspicious activity.
• Security Personnel: Guards and patrols to prevent unauthorized access.
• Environmental Controls: Fire suppression, alarms and power backup to protect critical assets.
• Perimeter Security: Fences, gates, barriers and lighting to secure the facility.

26. Explain the term Google hacking database(GHDB)?

The GHDB is a collection of advanced Google Dorks (search operators) used to find publicly exposed sensitive information, security misconfigurations and vulnerable web resources indexed by Google during the reconnaissance phase.

27. What are the steps involved in performing enumeration?

The enumeration process typically involves the following steps:

• Identify live hosts on the target network.
• Enumerate open ports and services.
• Gather user, group and hostname information.
• Enumerate network shares, DNS, SNMP, SMB, LDAP or Active Directory services.
• Identify software versions and potential vulnerabilities.

28. What are the countermeasure techniques in preventing trojan horses?

The following measures help prevent Trojan horse infections:

• Download software only from trusted sources.
• Avoid opening suspicious email attachments or links.
• Keep the operating system and applications updated.
• Use reputable antivirus/endpoint protection software.
• Enable firewalls and avoid pirated or cracked software.

29. Define the Target of Evaluation (TOE)?

Target of Evaluation (TOE) refers to the specific system, application, network or IT product that is being evaluated during a security assessment or certification. It defines the exact scope of the evaluation, including the security functions and components to be tested.

30. What is the difference between banner grabbing and OS fingerprinting?

31. Name some steganography technologies used in system hacking?

Steganography is the practice of concealing data within another file or medium to avoid detection. Common steganography techniques include:

• Text Steganography: Hides data within text files or documents.
• Image Steganography: Embeds data inside digital images.
• Audio Steganography: Conceals information within audio files.
• Video Steganography: Hides data inside video files.
• Network Steganography: Conceals data within network protocols or packet headers.

32. What does "Covering Tracks" mean in the hacking process?

Covering Tracks is the final phase of the hacking lifecycle in which an attacker attempts to conceal evidence of unauthorized activities to avoid detection. This may involve modifying or deleting logs, hiding malicious artifacts or removing traces of the attack.

33. What do you mean by dumpster diving?

Dumpster Diving is a social engineering technique in which an attacker searches discarded physical materials, such as documents, storage media or other waste, to obtain sensitive or confidential information.

34. What is OWASP? Give some examples of OWASP's top 10 web vulnerabilities?

OWASP (Open Worldwide Application Security Project) is a non-profit organization dedicated to improving software and web application security by providing free security resources, standards, tools and best practices. Example of OWASP's top 10:

• Broken Access Control: Users can access resources or perform actions beyond their authorized permissions.
• Injection: Malicious input (e.g., SQL, OS commands) is executed by the application.
• Security Misconfiguration: Insecure default settings, unnecessary services or improper configurations expose the application to attacks.
• Cryptographic Failures: Weak or improper encryption exposes sensitive data.
• Server-Side Request Forgery (SSRF): An attacker forces the server to make requests to unintended internal or external resources.

35. List some intrusion detection systems and evasion techniques in ethical hacking?

Common Intrusion Detection Systems (IDS):

• Snort: Open-source network IDS/IPS.
• Suricata: High-performance IDS/IPS with deep packet inspection.
• Zeek: Network security monitoring and traffic analysis.
• OSSEC: Host-based IDS for log monitoring and file integrity.

Common IDS evasion techniques include:

• Packet Fragmentation: Splits packets to evade IDS inspection.
• Source Port Manipulation: Uses trusted source ports to bypass filtering rules.
• IP Spoofing/Decoy: Hides the attacker's identity using fake or decoy IP addresses.
• Source Routing: Alters the packet route to bypass security devices.
• Packet Customization: Modifies packet headers or payloads to avoid detection.

36. What is meant by Blowfish algorithms in cryptography?

Blowfish is a symmetric-key block cipher designed by Bruce Schneier in 1993. It encrypts data using a 64-bit block size and a variable key length (32–448 bits). Blowfish is known for its speed, efficiency and strong security in software implementations.

37. Explain how the “Netcat” Trojan works?

Netcat (nc) is a command-line networking utility used to read, write and transfer data over TCP or UDP connections. In ethical hacking, it can be used for port scanning, banner grabbing, file transfer, debugging and creating reverse or bind shells during authorized security assessments.

38. What are bypassing the limitations of switches?

On a switched network, devices normally receive only traffic intended for them. Attackers may attempt to bypass this limitation using techniques such as:

• ARP Spoofing/Poisoning: Redirects traffic through the attacker's system.
• MAC Flooding: Overloads the switch's MAC table, causing it to broadcast traffic.
• Port Mirroring (SPAN): Used legitimately by administrators to monitor network traffic.

39. What are Smurf and SYN Flood Attacks?

40. Explain Escalating Privileges in system hacking?

Privilege Escalation is the process of gaining higher-level permissions on a system by exploiting vulnerabilities, misconfigurations or weak access controls. It allows an attacker to perform actions that require elevated privileges. Types:

• Vertical Privilege Escalation: Gaining higher privileges (e.g., user to administrator/root).
• Horizontal Privilege Escalation: Accessing another user's resources with the same privilege level.

41. Explain Rootkit Countermeasures in ethical hacking?

Rootkit countermeasures are security techniques used to detect, prevent and remove rootkits that hide malicious activities on a system. Common countermeasures include:

• Keep the operating system and software updated.
• Use antivirus/anti-rootkit detection tools.
• Enable Secure Boot and code signing.
• Perform integrity checks on critical system files.
• Regularly monitor system logs and unusual behavior.

42. Discuss Linux Hardening Methods?

Linux hardening is the process of securing a Linux system by reducing its attack surface and strengthening its security. Common Linux hardening methods include:

• Keep the system updated with the latest security patches.
• Disable unnecessary services and remove unused packages.
• Enforce strong authentication and least privilege.
• Configure firewalls (e.g., UFW, iptables or firewalld).
• Enable SELinux or AppArmor and monitor system logs.

43. Discuss vulnerability in the Windows operating system?

Windows systems can be vulnerable due to unpatched software, weak configurations, outdated services and insecure user privileges, allowing attackers to gain unauthorized access or execute malicious code. Common Windows vulnerabilities include:

• Exposed services (e.g., SMB, RDP).
• Misconfigured security settings.
• Malware and privilege escalation vulnerabilities.

44. List out some Penetration Testing deliverables?

Common penetration testing deliverables include:

• Rules of Engagement (RoE): Defines the scope, objectives and testing boundaries.
• Test Plan: Outlines the methodology and testing approach.
• Vulnerability Report: Lists identified vulnerabilities with severity and impact.
• Proof of Concept (PoC): Demonstrates successful exploitation of vulnerabilities.
• Risk Assessment: Prioritizes findings based on business impact and risk.
• Remediation Recommendations: Provides steps to fix identified issues.
• Executive Summary: High-level overview for management.
• Final Penetration Test Report: Consolidates findings, evidence, risk ratings and recommendations.

45. Describe types of Vulnerability assessments?

The common types of vulnerability assessment include:

• Initial Assessment: Identifies the attack surface and critical assets to be evaluated.
• Baseline Assessment: Establishes the current security posture for future comparisons.
• Vulnerability Scanning: Uses automated tools to identify known vulnerabilities and misconfigurations.
• Risk Analysis & Validation: Verifies findings and prioritizes vulnerabilities based on severity and impact.
• Vulnerability Assessment Report: Documents identified vulnerabilities, risk ratings and remediation recommendations.

46. List out some methods for password hacking?

Common password attack methods include:

• Brute Force Attack: Tries every possible password combination.
• Dictionary Attack: Uses a list of common words and passwords.
• Password Spraying: Tries a few common passwords against many accounts.
• Credential Stuffing: Uses stolen username-password pairs from previous data breaches.
• Phishing & Social Engineering: Tricks users into revealing their credentials.
• Keylogging: Captures keystrokes to steal passwords.
• Rainbow Table Attack: Uses precomputed hash tables to crack hashed passwords.

47. Give examples of some automated penetration testing tools?

Some widely used automated penetration testing tools include:

• Nmap: Network discovery and port scanning.
• Nessus: Automated vulnerability scanner.
• OpenVAS (Greenbone): Open-source vulnerability assessment tool.
• Burp Suite: Web application security testing.
• SQLmap: Automated SQL injection detection and exploitation.
• Nikto: Web server vulnerability scanner.
• Metasploit Framework: Exploit development and penetration testing.
• Astra Pentest: Automated web application vulnerability scanner.

48. What are rogue access points?

A Rogue Access Point (Rogue AP) is an unauthorized wireless access point connected to a network without the organization's approval. Attackers or unauthorized users may deploy Rogue APs to bypass security controls, intercept network traffic or gain unauthorized access to internal systems.

49. Describe XML entity injection?

XML External Entity (XXE) Injection is a vulnerability that occurs when an application processes untrusted XML input with external entities enabled. An attacker can exploit it to read local files, perform Server-Side Request Forgery (SSRF), access internal systems or cause Denial-of-Service (DoS) attacks.

50. What is the difference between Black Box, White Box and Gray Box Penetration Testing?

• Black Box: No prior knowledge of the target system.
• White Box: Full knowledge of the target, including source code and architecture.
• Gray Box: Partial knowledge of the target, such as limited credentials or documentation.

Read more about this: difference between Black Box, White Box and Gray Box.