5.3 Tools and Code Analysis Flashcards
Explain use cases of the following tools during the phases of a penetration test.
What is nslookup?
Nslookup is a command-line tool in either Windows or Linux operating system (OS) that can be used to query a domain and specify various record types.
What is Dig?
Dig is a utility widely used on a Linux OS that can perform reverse lookups to match an IP address to a domain name.
What is the WHOIS protocol?
The WHOIS protocol provides the ability to search for data related to entities that register public domains and other internet resources.
What is TinyEye?
TinyEye is a reverse image searcher that a team can use to scout a target to see if there is any actionable intel.
What is Metagoofil?
Metagoofil is a Linux-based tool that can search for metadata from public documents located on the target website(s).
What is Fingerprinting Organization with Collected Archives (FOCA)?
FOCA is a Windows-only GUI OSINT tool used to discover metadata that may be hidden within documents. It can scan search engines to find downloadable files, but you can also provide local files for FOCA to analyze.
What is theHarvester?
theHarvester is data collecting tool that can search a company’s visible threat landscape, in order to gather the following information:
-Subdomain names
-Employee names
-Email addresses
-PGP key entries
-Open ports and service banners
What is Recon-ng?
Recon-ng is another data gathering tool, using modules to customize the search . Some modules include:
-WHOIS query to identify points of contact
-PGP key search
-Social media profile associations
-File crawler
-DNS record enumerator
What is Maltego?
Maltego is a full GUI tool, helping users visualize the gathered information. It features an extensive library of “transforms”, which automate the querying of public sources of data. Maltego then compares the data with other sets of information to provide commonalities among the sources.
What is Shodan?
Shodan is a search engine designed to locate and index Internet of Things (IoT) devices that are connected to the internet, such as traffic lights, industrial control systems (ICSs) and other devices that have internet connectivity and are part of the IoT.
What is the Social Engineering Toolkit (SET)?
The SET is a Python-based collection of tools that can be used when conducting a social engineering PenTest. It allows you to select from a number of different options that includes attacking websites, mass mailings and spearphishing attacks.
What does the Open Vulnerability Assessment Scanner (OpenVAS) do?
When run, OpenVAS will list the vulnerabilities along with a risk rating that summarizes the overall state of the site that was tested, including CVSS values and CVE numbers.
What is Nikto?
Nikto is an open-source web server scanner that can complete comprehensive testing on web servers for a variety of vulnerabilities, such as anticlickjacking X-Frame-options header, and dangerous files and CGIs.
What is the Security Content Automation Protocol (SCAP)?
SCAP is a US standard use to ensure applications are in line with mandated security requirements. Scanning will use a predetermined security baseline that checks for vulnerabilities, either on-site or cloud based.
What is the Wireless Geographic Logging Engine (WiGLE) ?
WiGLE is a site dedicated to mapping and indexing access points. It is considered an OSINT tool to help during the reconnaissance phase of PenTesting.
What is Steghide?
Steghide is an open-source tool used to conceal a payload in either an image or audio file. It can compress, conceal, and encrypt data using images such as JPEG and BMP, and audio files using WAV and AU formats.
What is OpenStego?
OpenStego is also an open source stenography tool, written in Java. In addition to standard stenography functions, you can embed a watermark - similar to a digital signature - which can prevent someone from making unauthorized changes to the file.
What is Snow?
Snow is a CLI stenography tool that conceals a data payload within the whitespace of a text file that uses the ASCII format.
What do Coagula and Sonic Visualizer do?
These tools synthesize images into a .wav file to conceal text. It can be revealed by converting the the text in a spectogram.
What is ProxyChains?
ProxyChains is a command-line tool that enables PenTesters to mask their identity and/or source IP address by sending messages through intermediary or proxy servers, providing an extra layer of protection.
What is Responder?
Responder is a man-in-the-middle type tool that can be used to exploit name resolution on a Windows network. It is designed to intercept and poison LLMNR and NBT-NS requests. Once a request is intercepted, Responder will return the attacker’s host IP as the name record, causing the querying host to establish a session with the attacker.
What is Metasploit?
Metasploit is a multi-purpose computer security and PenTesting framework that is used worldwide for both legitimate security analysis and unauthorized activities. It is intentionally modular, as it allows the attacker to mix and match scanners, exploits, and payloads into a single attack.
What is Impacket tools?
Impacket tools is an open-source collection of tools used when PenTesting in a Windows environment. The Impacket library provides methods for several attacks such as NTLM and Kerberos authentication attacks, PtH, credential dumping, and packet sniffing.
What is mitm6?
mitm6 is an IPv6 DNS hijacking tool that works by first replying to DHCPv6 messages that set the malicious actor as DNS server. It will then reply to DNS queries with bogus IP addresses that redirect the victim to another malicious host.
