Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Pentest+ > 2.1 Information gathering & Vulnerability scanning: passive reconnaissance > Flashcards

2.1 Information gathering & Vulnerability scanning: passive reconnaissance Flashcards

1
Q

What is reconnaissance?

A

Focuses on gathering as much information on the target as possible and can be either passive or active

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is footprinting?

A

Figuring out exactly what type off system the organization uses to be able to attack them in the next phase of assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is passive reconnaissance?

A

Attempts to gain information about targeted computers and networks without actively engaging with those systems (e.g. online search, social engineering, dumpster diving, email harvesting)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Open-Source Intelligence (OSINT)?

A

The collection and analysis of data gathered from publicly available sources to produce actionable intelligence (e.g. social media, blogs, newspapers, government records, job listing, metadata, website info etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of valuable information are pentester looking for when doing OSINT?

A
  • Roles different employee have
  • Different teams and departments
  • Contact information
  • Technical aptitude and security training
  • Employee and managerial mindset
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How to do start an OSINT investigation?

A

Start with the organization’s own social media profiles and accounts (e.g. LinkedIn, Monster, Indeed, ZipRecruiter, Glassdoor etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a metadata?

A

The data about the data in the file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

OSINT tools: what are OSINT tools for?

A

Open-source intelligence tools that find actionable intelligence from various publicly available sources such as public websites, whois database, DNS servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OSINT tools: what’s Metagoofil for?

A

A Linux-based tool that can search the metadata associated with public documents located on a target’s website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

OSINT tools: what’s Fingerprinting Organizations with Collected Archives (FOCA)?

A

Used to find metadata and hidden information in collected documents from an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

OSINT tools: what’s The Harvester?

A

A program for gathering emails, subdomains, hosts, employee names, email addresses, PGP key entries, open ports and service banners from servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

OSINT tools: what’s Recon-ng?

A

Uses a system of modules to add additional features and functions for your use. It is a cross-platform web reconnaissance framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

OSINT tools: what’s Shodan?

A

A website search engine for web cameras, routers, servers, and other devices that are considered part of the Internet of things

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

OSINT tools: what’s Censys?

A

A website search engine used for finding hosts and networks across the Internet with data about their configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

OSINT tools: what’s Maltego?

A

A piece of commercial software used for conducting open-source intelligence that helps connect those relationships.
It can automate the querying of public sources of data and then compare it with other info from various sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What’s a DNS?

A

Domain Name Server (DNS) helps network clients find a website using human readable hostnames instead of numeric IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DNS information: what’s Address (A) Record?

A

Links a hostname to an IPv4 address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DNS information: what’s AAAA Record ?

A

Links a hostname to an IPv6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DNS information: what’s Canonical Name (CNAME) Record?

A

A Canonical Name (CNAME) record is a type of DNS record used to specify that a domain name is an alias for another domain name. In other words, it allows a domain to be known by multiple names. For example, if you have a website called “example.com” and you also want it to be accessible via “www.example.com,” you can use a CNAME record to indicate that “www.example.com” is an alias of “example.com”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

DNS information: what’s Mail Exchange (MX) Record?

A

A Mail Exchange (MX) record is a type of DNS record that specifies the mail server responsible for receiving and handling email messages on behalf of a domain. When someone sends an email to an address within a specific domain, the sender’s mail server uses DNS to look up the MX records for the recipient’s domain to determine where to deliver the email. The MX record contains the name of the mail server and a priority value, which indicates the order in which mail servers should be used. This allows for redundancy and load balancing in the email delivery process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

DNS information: what’s Start of Authority (SOA) Record?

A

Stores important information about a domain or zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DNS information: what’s Pointer (PTR) Record?

A

Correlates an IP address with a domain name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DNS information: what’s Text (TXT) Record?

A

A Text (TXT) record is a type of DNS record used to associate arbitrary text with a host or other name. It is often used to carry human-readable information, such as a sender’s email address or a brief note about the host. Additionally, TXT records are commonly used in various internet protocols, such as SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), to verify the legitimacy of an email message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

DNS information: what’s Service (SRV) Record?

A

Specifies a host and port for a specific service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

DNS information: what’s Nameserver (NS) Record?

A

It specifies which name servers are authorized to respond to DNS queries for a specific domain name. These records indicate the authority over the DNS zone of a domain by specifying the name servers that are responsible for providing information about that domain. In other words, NS records indicate which servers are the sources of authority for the DNS resolution of a domain. This allows for the delegation of management of subdomains to other name servers while maintaining a hierarchical structure in the domain name system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

DNS information: while doing an OSINT, what record can you check to gather information on email and SaaS solutions?

A

Focus on MX, TXT and SRV records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

DNS information: what’s Name Server Lookup (nslookup)?

A

Tool to query the DNS to provide the mapping between domain names and IP addresses or the other DNS records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

DNS information: what’s Whois?

A

A command line tool on Linus, which is also a website, that is a query and response protocol for Internet resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Public repositories: what public source code repositories for?

A
  • Websites that allow developers to work together in an agile way to create software very quickly.
  • Private files can sometimes be mistakenly classified as public for anyone to find
  • GitHub, Bitbucket, SourceForge
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Public repositories: why should you search for website archives/caches?

A

Deleted data can still exist somewhere on the Internet. You can use Wayback Machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Google hacking: what is it for?

A

Open-source intelligence technique that uses Google search operators to locate vulnerable web servers and applications.

32
Q

Google hacking: how to use it: quote/NOT/ AND/ Scope/ URL?

A
  • Quote: use “” to specify an exact phrase and make a search precise
  • NOT: use - in front a word to exclude results that contain that string
    -AND/ OR: use these to require both search terms (AND) or to require either term (OR)
  • Scope: keyword that can be used to select the scope of the search (e.g. site, filetype, related, allintitle, allinurl, allinanchor)
  • URL modifiers: modifiers that can be added to the results page to affect the results (e.g. &pws=0, &filter=0, &tbs=li:1
33
Q

Google hacking: what’s Google Hacking Database (GHDB)?

A

The Google Hacking Database (GHDB) is a repository of complex search methods, operators, and queries. This enables regular users and cybersecurity experts to locate security flaws and potential threats.

34
Q

URL analysis: what it is?

A

Activity that is performed to identify whether a link is already flagged on an existing reputation list, and if not, to identify what malicious script or activity might be coded within in

35
Q

URL analysis: why is it important?

A
  • Resolving percent encoding
  • Assessing redirection of the URL
  • Showing source code for scripts in URL
36
Q

URL analysis: what is HTTP Method?

A

Different types of requests that can be made by a client to interact with a web server. The most common HTTP methods are:

  • GET: Used to request data from a specified resource.
  • POST: Used to send data to a server to create/update a resource.
  • PUT: Used to update a resource on the server.
  • DELETE: Used to delete a specified resource.
    A request contains a method, a resource, a version number, the header and the body of the request
37
Q

URL analysis: give explanation for each of the methods: GET, POST, PUT, DELETE, HEAD?

A
  • GET: principal method used with HTTP and used to retrieve a resource
  • POST: used to send data to the server for processing by the requested resource
  • PUT: creates or replaces the requested resource
  • DELETE: remove the requested resource
  • HEAD: retrieve the header for a resource only and ignores the body
38
Q

URL analysis: what “?” means in an URL?

A

Data submitted via URL are delimited by “?”

39
Q

URL analysis: what are the query parameters in this exemple : “www.exemple.com/widgets?color=blue&sort=new”?

A

? > start of parameter
color=blue > name= value
& > separator

40
Q

URL analysis: what is HTTP Response Codes?

A

The header value returned by a server when a client requests a URL

41
Q

URL analysis: what is HTTP code 200 and code 201?

A

200 = successful GET or POST request (OK)
201 = indicates where a PUT request has succeeded in creating a resource

42
Q

URL analysis: what is HTTP code 3xx ?

A

These codes indicate that further action needs to be taken to complete the request. For example, 301 Moved Permanently indicates that the requested resource has been permanently moved to a new location.

43
Q

URL analysis: what is HTTP code 4xx?

A

Any code in this range indicates an error in the client request

44
Q

URL analysis: what is HTTP code 400?

A

It indicates that the server cannot process the request because the client sent a request that the server could not understand. This could be due to malformed syntax, invalid request message framing, or deceptive request routing.

45
Q

URL analysis: what is HTTP code 401?

A

HTTP code 401 is an Unauthorized error. It indicates that the client’s request lacks valid authentication credentials, and the server is refusing to respond to the request without proper authentication. This status code is commonly used when a user tries to access a resource that requires authentication, but the user has not provided the necessary credentials or the credentials provided are invalid.

46
Q

URL analysis: what is HTTP code 403?

A

Request did not have sufficient permissions

47
Q

URL analysis: what is HTTP code 404?

A

Client has requested a non-existent resource

48
Q

URL analysis: what is HTTP code 5xx?

A

Any code in this range indicates a server-side issue

49
Q

URL analysis: what is HTTP code 500?

A

HTTP code 500 is an Internal Server Error. This status code indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. It’s a generic error message that is often used when no more specific message is suitable. The server-side issue could range from a bug in the server software to problems with the server’s database or other backend systems.

50
Q

URL analysis: what is HTTP code 502?

A

Indicates a bad gateway has occurred when the server is acting as a proxy

51
Q

URL analysis: what is HTTP code 503?

A

Indicates an overloading of the server is causing service unavailability

52
Q

URL analysis: what is HTTP code 504?

A

Indicates a gateway timeout which means there’s an issue with the upstream server

53
Q

URL analysis: what is percent encoding/ URL encoding?

A

Percent encoding, also known as URL encoding, is a method used to convert special characters and non-ASCII characters into a format that can be transmitted through a URL. When a URL contains characters that are unsafe or have special meaning in the context of the URL, these characters need to be encoded to ensure proper transmission.
For example, if a character like space (“ “) or a non-ASCII character like “é” is included in a URL, it needs to be percent encoded. For the space, it would be encoded as %20, and for “é”, it would be encoded as %C3%A9.

This allows web browsers and servers to correctly transmit URLs, even if they contain special characters, ensuring that these characters are not misinterpreted or disrupt the structure of the URLA mechanism to encode 8-bit characters that have specific meaning in the context of URLs, also known as URL encoding

54
Q

URL analysis: what are the reserved and unreserved characters in percent encoding?

A
  • Unreserved characters: a-z, A-Z, 0-9, (-), (.), (_), (~)
  • Reserved characters: (:), (/), (?), (#), ([), (]), (@), (!), ($), (&), (‘), ((), ()), (*), (+), (,), (;), (=)
55
Q

URL analysis: what are the unsafe characters that an URL cannot contains?

A

Null string termination, carriage return, line feed, end of file, tab, space, and (), (<), (>), ({), (})

56
Q

Cryptographic flaws: what is Cryptographic Inspection?

A

Checks validity of certificates or potential vulnerabilities to exploit within the target servers

57
Q

Cryptographic flaws: what is Cipher Suite?

A

Defines the algorithm supported by the client and server when requesting to use encryption and hashing.
Exemple: ●ECDHE_RSA_AES128_GCM_SHA256
●TLS_AES_256_GCM_SHA384

58
Q

Cryptographic flaws: how to test a web server to see its cipher suite?

A

Use ssllabs.com

59
Q

Cryptographic flaws: what are the encryption algorithms?

A

▪ ChaCha20
▪ RSA
▪ AES
▪ GCM
▪ CBC

60
Q

Cryptographic flaws: are SSL 2 and SSL 3 secure?

A

No

61
Q

Cryptographic flaws: what is the risk with falsified digital certificates?

A

Falsified digital certificates can be used to trick the target organization’s users

62
Q

Cryptographic flaws: why should you look into SAN field or Wildcard in a digital certificates?

A

Looking into the Subject Alternative Name (SAN) field or using a Wildcard in a digital certificate is important for ensuring that the certificate can secure multiple domains or subdomains under a single certificate:
- SAN: allows you to include additional domain names beyond the primary domain for which the certificate is issued. This is particularly useful when securing multiple subdomains or different domain names with a single certificate
- Wildcard: allows you to secure a domain and all its subdomains with a single certificate using a wildcard character (*). This can simplify certificate management and reduce costs for organizations with numerous subdomains.

63
Q

Cryptographic flaws: what is a Certificate Revocation List (CRL) in PKI?

A

An online list of digital certificates revoked by the certificate authority

64
Q

Cryptographic flaws: what is the Online Certificate Status Protocol (OCSP) in PKI?

A

Determine the status of a digital certificate using its serial number

65
Q

Cryptographic flaws: how a client validates the certificate?

A

With the CRL and the OCSP

66
Q

Cryptographic flaws: what is certificate pinning?

A

Certificate pinning is a security mechanism used to prevent man-in-the-middle attacks by associating a host with its expected X.509 certificate or public key. This involves hardcoding the certificate or public key of the server that the client expects to communicate with. By doing so, the client can verify that it is connecting to the correct server and not a malicious one. If the server’s certificate or public key does not match the pinned value, the client will terminate the connection, thus providing an additional layer of security against potential attacks.

67
Q

Cryptographic flaws: what is certificate stapling?

A

Allows a web server t perform certificate status check and eliminate the need for additional connection at the time of the request

68
Q

Cryptographic flaws: what is HTTP Strict Transport Security (HSTS)?

A

Allows a web server to notify web browsers to only request using HTTPS and not HTTP

69
Q

CWE & CVE: what is it for?

A

A penetration tester needs to keep updated with the latest techniques and vulnerabilities:
▪ CVEs
▪ CWEs
▪ Security Blogs
▪ Podcasts

70
Q

CWE & CVE: what is Computer Emergency Response Team (CERT) -Vcisa.gov/uscert?

A

Maintained by the United States federal government and lists all of the different known vulnerabilities that they have identified in the wild as well as those self-reported by industry partners

71
Q

CWE & CVE: what is JPCERT - pcert.or.jp?

A

Japan’s version of the Computer Emergency Response Team

72
Q

CWE & CVE: what is National Vulnerability Database (NVD) - nvd.nist.gov ?

A

Provided by the National Institute for Standards and Technology (NIST) which displays all of the latest vulnerabilities and assigns them each a CVE number

73
Q

CWE & CVE: what is Common Vulnerabilities and Exposures (CVE) - cve.org?

A

Common database used worldwide that references known vulnerabilities

74
Q

CWE & CVE: what is Common Weakness Enumeration (CWE) – cwe.mitre.org?

A

A community-developed list of the different types of software weaknesses and the details of those weaknesses

75
Q

CWE & CVE: what is Common Attack Pattern Enumeration and Classification (CAPEC) - capec.mitre.org?

A

Help to understand and identify a particular attack so that security researchers may better understand the different attack patterns

76
Q

CWE & CVE: what is Full Disclosure?

A

A mailing list from the makers of Nmap

Pentest+ (28 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions