504.2

Question 1

Breakout time

Answer 1

from initial compromise to privilege escalation on additional internal network targets.

Question 2

MITRE ATTACK

Answer 2

Framework knowledge base for mapping adversary tactics, techniques, and procedures. Based on real world observation

Question 3

Reconnaissance

Answer 3

building intel, looking for opportunities. usually begins with OSINT collection.

Question 4

OSINT

Answer 4

collective representation of planned and unplanned shared online data.

Question 5

Certificate Transparency

Answer 5

Certificate Authority requirement where they must publish logs of all issued certificates. Can be useful to an attacker for revealing hosts that may not be public yet.

Question 6

SpiderFoot

Answer 6

open source data collection and analysis tool. collects data from hundreds of online sources, using the collected data to seed additional searches.

Question 7

DNS

Answer 7

Attackers use dns to discover IPs associated with target domain.

Question 8

nslookup

Answer 8

used to interact with a DNS server to get domain info.

Question 9

DNS Zone Trasnfer

Answer 9

Allows an attacker to connect to your DNS server and grab records associated with a particular domain. They can then determine which machines in that domain are public facing.

Question 10

NMAP dns-brute

Answer 10

leverages a list of common hostnames and a target domain name to determine if the DNS name is present on the DNS server.

Question 11

exiftool

Answer 11

perl script that extracts metadata from many different file types. can view things like operating system, document software version, etc.

Question 12

CeWL

Answer 12

custom wordlist generator that crawls a target website and collects all web pages and common document formats to extract metadata. Data can then be used to build a wordlist for password attacks, host enumeration, etc.

Question 13

NMAP Network Sweeping

Answer 13

Sweep through address space to identify active hosts on the network.

Question 14

Port Scanning

Answer 14

help identify openings on a system and allow an attacker to focus their attack on specific services

Question 15

Nmap Scripting Engine (NSE)

Answer 15

nmap scripts to conduct additional interrogation on a target system. NSE scripts can be used for enhanced host interrogation, but also for vulnerability discovery and several attacks as well.

Question 16

JQ

Answer 16

lightweight tool and programming language for parsing, interrogating, and editing JSON data

Question 17

masscan

Answer 17

network scanning tool separates the syn send code from the awk receive code into different functionality which allows for sending tcp syn packets at a very fast rate and scan many more hosts than nmap can.

Question 18

TLS Scanner

Answer 18

tool that reads from a list of IP addresses, one per line, and extracts certificate information from the identified TLS server on a given port

Question 19

EyeWitness

Answer 19

tool that takes a screenshot of every web server it detects to quickly identify the purpose of multiple websites simply by reviewing the pictures included in an HTML report

Question 20

builtwith.com

Answer 20

website tool, search for a domain name to disclose several characteristics of the target website including the cloud providers

Question 21

SMB

Answer 21

Application layer protocol that implements file and printer sharing, domain auth, remote admin, and other features. Uses port 445

Question 22

SharpView

Answer 22

tool used to enumerate many different WIndows domain and server settings.

Question 23

Bloodhound

Answer 23

A tool that graphs the quickest way to get domain admin privileges

Question 24

DeepBlueCLI

Answer 24

Powershell script that parses windows event logs and searches for unusual behaviors and characteristics

Question 25

whois

Answer 25

cli tool that collects domain registrant info. not very useful anymore because of data protection laws and replaced by certificate transparency.

Question 26

Split DNS

Answer 26

External name information in external server, internal name information in internal server

Question 27

Google Dorks

Answer 27

Google searches that can reveal vulnerable sites or other useful information to an attacker