Watering Hole Attack Identification

312-50v13 By islever Editorial Last updated

Hacking Web Applications

Short answer

A Joel uses a watering hole attack by compromising websites frequently visited by the target company's employees to deliver malware.

Question

Joel, a professional hacker, targeted a company and identified the types of websites frequently visited by its employees. Using this information, he searched for possible loopholes in these websites and injected a malicious script that can redirect users from the web page and download malware onto a victim's machine. Joel waits for the victim to access the infected web application so as to compromise the victim's machine. Which of the following techniques is used by Joel in the above scenario?
  1. Watering hole attack Correct Answer
  2. DNS rebinding attack
  3. MarioNet attack
  4. Clickjacking attack

Key Takeaways

The question tests the definition of Watering Hole attacks, with the common trap being confusion with general phishing or drive-by downloads that lack the specific element of compromising trusted sites visited by a targeted demographic.

This question examines the Watering Hole attack technique where attackers compromise websites frequented by a specific target group to deliver malware. The correct answer is identified as A based on the scenario of targeting employee browsing habits.

Common mistake: Candidates often confuse this with Clickjacking (D) or DNS rebinding (B), failing to recognize the strategic aspect of selecting 'frequently visited' websites as the lure.

Expert Analysis

Why the Answer Is Correct

The scenario describes a classic Watering Hole attack. Joel identifies the specific websites his targets (company employees) frequent and compromises them to deliver malware. This technique relies on the trust users have in these legitimate websites.

Why the Other Options Are Wrong

Clickjacking (D) involves tricking users into clicking hidden elements, not downloading malware via site compromise. DNS rebinding (B) tricks browsers into changing the IP address of a domain to bypass same-origin policies. MarioNet (C) is a botnet framework, not an initial access technique involving compromised third-party sites.

Community Comment Notes

The community consensus strongly supports option A. Users note that the key identifier is the attacker targeting 'websites frequently visited' by the organization's members. As one commenter paraphrased, it is about installing malware on sites regularly surfed by the target group to infect their computers.

Exam Strategy

Focus on the 'lure' mechanism in attack questions. If the attacker compromises a trusted site that the victim visits, think 'Watering Hole'. If they trick you into clicking something invisible, think 'Clickjacking'.

Frequently Asked Questions

What distinguishes a watering hole attack from standard phishing?

Phishing typically sends malicious emails directly to victims. A watering hole attack compromises third-party websites that the specific target audience already trusts and visits.

Is MarioNet a type of web attack?

No, MarioNet is a framework for building and managing botnets, often used for DDoS or crypto mining, but it is not the specific technique described in the scenario.

More 312-50v13 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Cysaplus2023 👍 1 Answered A
    -Network-Based Scanner: Network-based scanners are those that interact only with the real machine where they reside and give the report to the same machine after scanning. -Agent-Based Scanner: Agent-based scanners reside on a single machine but can scan several machines on the same network. -Proxy Scanner: Proxy scanners are the network-based scanners that can scan networks from any machine on the network. -Cluster scanner: Cluster scanners are similar to proxy scanners, but they can simultaneously perform two or more scans on different machines in the network p.585
  2. mulekule 👍 1 Answered A
    Watering hole attack is a cyberattack targeting a particular organization, in which malware is installed on a website or websites regularly visited by the organization's members in order to infect computers used within the organization itself.
  3. Rangnarok 👍 1 Answered A
    Module 14 - page 1961 In a watering hole attack, the attacker identifies the kind of websites frequently surfed by a target company/individual and tests these websites to identify any possible vulnerabilities

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide