Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PWK > Active Information Gathering > Flashcards

Active Information Gathering Flashcards

1
Q

What is DNS?

A

The Domain Name System (DNS) is one of the most critical systems on the Internet and is a distributed database responsible for translating user-friendly domain names into IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Example of TLD?

A

.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How to control how long a server or client caches a DNS record?

A

Via TTL field of DNS record.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is NS?

A

NS - Nameserver records contain the name of the authoritative servers hosting the DNS records for a domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is A?

A

A - Also known as a host record, the “a record” contains the IP address of a hostname (such as www.megacorpone.com).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is MX?

A

MX - Mail Exchange records contain the names of the servers responsible for handling email for the domain. A domain can contain multiple MX records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is PTR?

A

PTR - Pointer Records are used in reverse lookup zones and are used to find the records associated with an IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is CNAME?

A

CNAME - Canonical Name Records are used to create aliases for other host records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is TXT?

A

TXT - Text records can contain any arbitrary data and can be used for various purposes, such as domain ownership verification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How to to find the A host record for www.megacorpone.com?

A

host www.megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How to find the MX records for megacorpone.com?

A

host -t mx megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How to find the TXT records for megacorpone.com?

A

host -t txt megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How to look up a valid host for megacorpone.com?

A

host www.megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How to use host to look up an invalid host?

A

host idontexist.megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What NXDOMAIN means?

A

Public DNS record does not exist for that hostname.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How to use bash to brute force forward DNS name lookups for megacorpone.com? You have a wordlist called “list.txt”.

A

kali@kali:~$ for ip in $(cat list.txt); do host $ip.megacorpone.com; done

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How to use bash to bruteforce reverse DNS names? Let’s use a loop to scan IP addresses 38.100.193.50 through 38.100.193.100. We will filter out invalid results by showing only entries that do not contain “not found” (with grep -v).

A

for ip in $(seq 50 100); do host 38.100.193.$ip; done | grep -v “not found”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What “grep -v” do?

A

Select non-matching lines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is DNS zone transfer?

A

A zone transfer is basically a database replication between related DNS servers in which the zone file is copied from a master DNS server to a slave server. The zone file contains a list of all the DNS names configured for that zone. Zone transfers should only be allowed to authorized slave DNS servers but many administrators misconfigure their DNS servers, and in these cases, anyone asking for a copy of the DNS server zone will usually receive one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How to use host to perform a DNS zone transfer?

A

host -l domain_name dns_server_address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How to attempt zone transfer on “megacorpone.com” and on ns1 subdomain?

A

kali@kali:~$ host -l megacorpone.com ns1.megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How to use host to do a DNS zone transfer on www.megacorpone.com and ns2 subdomain?

A

kali@kali:~$ host -l megacorpone.com ns2.megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How to use host to obtain DNS servers for a given domain name?

A

host -t ns megacorpone.com | cut -d “ “ -f 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What ‘-t’ do in host command?

A

-t specifies the query type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is DNSRecon?

A

DNSRecon is an advanced, modern DNS enumeration script written in Python.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is ‘-d’ for in dnsrecon?

A

To specify a domain name.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is ‘-t’ for in dnsrecon?

A

To specify the type of enumeration to perform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How to use dnsrecon to perform a zone transfer on megacorpone.com?

A

kali@kali:~$ dnsrecon -d megacorpone.com -t axfr

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is ‘-D’ for in dnsrecon?

A

To specify a file name containing potential subdomain strings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is ‘-t’ for in dnsrecon?

A

To specify the type of enumeration to perform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How to brute force hostnames using dnsrecon and list.txt?

A

kali@kali:~$ dnsrecon -d megacorpone.com -D ~/list.txt -t brt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is DNSenum?

A

DNSEnum is another popular DNS enumeration tool.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How to find a website’s DNS address?

A

host -t ns domain-name-com-here

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How to attempt a Zone transfer using dnsrecon on megacorpone.com?

A

dnsrecon -d megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is port scanning?

A

Port scanning is the process of inspecting TCP or UDP ports on a remote machine with the intention of detecting what services are running on the target and what potential attack vectors may exist.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How to use netcat to perform a TCP port scan on ports 3388-3390? On address IP 10.11.1.220.

A

nc -nvv -w 1 -z 10.11.1.220 3388-3390

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What ‘-w’ option do in netcat?

A

Specifies connection timeout in seconds.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What ‘-z’ option do in netcat?

A

Is used to specify zero-I/O mode, which will send no data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How to use netcat to perform a UDP port scan on ports 160-162, destination IP 10.11.1.115?

A

kali@kali:~$ nc -nv -u -z -w 1 10.11.1.115 160-162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What ‘-u’ option do in netcat?

A

Indicate UDP port scan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is nmap?

A

Is one of the most popular, versatile, and robust port scanners available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is ‘-I’ option for in iptables?

A

To insert a new rule into a given chain which in this case includes both the INPUT (Inbound) and OUTPUT (Outbound) chains followed by the rule number.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is ‘-s’ option for in iptables?

A

Specify a source IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is ‘-d’ option for in iptables?

A

Specify a destination IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is ‘-j’ option for in iptables?

A

ACCEPT the traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is ‘-z’ option for in iptables?

A

Zero the packet and byte counters in all chains.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How to configure iptables rules for the scan on IP 10.11.1.220?

A

kali@kali:~$ sudo iptables -I INPUT 1 -s 10.11.1.220 -j ACCEPT
kali@kali:~$ sudo iptables -I OUTPUT 1 -d 10.11.1.220 -j ACCEPT
kali@kali:~$ sudo iptables -Z

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How to scan an IP 10.11.1.220 for the 1000 most popular TCP ports?

A

nmap 10.11.1.220

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What ‘-v’ option in iptables do?

A

Add some verbosity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What ‘-n’ option in iptables do?

A

Enable numeric output.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What ‘-L’ option in iptables do?

A

List the rules present in all chains.

52
Q

How to to monitor nmap traffic for a top 1000 port scan?

A

sudo iptables -vn -L

53
Q

How to perform a SYN scan on ip 10.11.1.220?

A

kali@kali:~$ sudo nmap -sS 10.11.1.220

54
Q

How to perform a TCP connect scan on ip address 10.11.1.220?

A

nmap -sT 10.11.1.220

55
Q

How to perform a UDP scan on ip 10.11.1.115?

A

kali@kali:~$ sudo nmap -sU 10.11.1.115

56
Q

How to to perform a combined UDP and SYN scan?

A

sudo nmap -sS -sU 10.11.1.115

57
Q

How to perform a network sweep?

A

kali@kali:~$ nmap -sn 10.11.1.1-254

58
Q

How to perform a network sweep and then using grep to find live hosts?

A

nmap -v -sn 10.11.1.1-254 -oG ping-sweep.txt

grep Up ping-sweep.txt | cut -d “ “ -f 2

59
Q

How to scan for web servers using port 80?

A

kali@kali:~$ nmap -p 80 10.11.1.1-254 -oG web-sweep.txt

kali@kali:~$ grep open web-sweep.txt | cut -d” “ -f2

60
Q

How to perform a top twenty port scan, saving the output in greppable format?

A

nmap -sT -A –top-ports=20 10.11.1.1-254 -oG top-port-sweep.txt

61
Q

What ‘-O’ option do in nmap?

A

OS fingerprinting. This feature attempts to guess the target’s operating system by inspecting returned packets. This
is possible because operating systems often have slightly different implementations of the
TCP/IP stack (such as varying default TTL values and TCP window sizes) and these slight
variances create a fingerprint that Nmap can often identify.

62
Q

How to use nmap for OS fingerprinting on ip 10.11.1.220?

A

kali@kali:~$ sudo nmap -O 10.11.1.220

63
Q

How to use nmap for banner grabbing and/or service enumeration, destination ip address is 10.11.1.220?

A

kali@kali:~$ nmap -sV -sT -A 10.11.1.220

64
Q

What is NSE for?

A

To launch user-created scripts in order to automate various scanning tasks. These scripts perform a broad range of functions including DNS enumeration, brute force attacks, and even vulnerability identification.

65
Q

Where are NSE scripts?

A

NSE scripts are located in the /usr/share/nmap/scripts directory.

66
Q

How to use nmap’s scripting engine (NSE) for OS fingerprinting? Destination IP address is 10.11.1.220, and SMB is turned on.

A

kali@kali:~$ nmap 10.11.1.220 –script=smb-os-discovery

67
Q

How to use nmap to perform a DNS zone transfer on ns2.megacorpone.com, port 53.

A

nmap –script=dns-zone-transfer -p 53 ns2.megacorpone.com

68
Q

What service is on port 53?

A

DNS

69
Q

How to view more information about a script?

A

–script-help
which displays a description of the script and a URL where we can find more in-depth information, such as the script arguments and usage examples.

70
Q

How to use –script-help option to view more information about script?

A

kali@kali:~$ nmap –script-help dns-zone-transfer

71
Q

How to conduct a ping sweep 10.11.1.* addresses and save the output to a file “ping_sweep.txt”, and use grep to show only machines that are online?

A

nmap -sP 10.11.1.1-255 | grep “10.11.1.” | cut -d “ “ -f 5 > ping_sweep.txt

72
Q

How to scan the IP addresses from “ping_sweep.txt” for open webserver ports. Use Nmap to find the webserver and operating system versions.

A

sudo nmap -iL ping_sweep.txt -p 80 -O

73
Q

How to use NSE scripts to scan the machines in the labs that are running the SMB service?

A

sudo nmap –script smb-os-discovery.nse -iL ping_sweep.txt -p 445

74
Q

How to check IP address 10.11.1.5 and port 80 using netcat?

A

nc -zv 10.11.1.5 80

75
Q

How to perform nmap UDP scan on IP 10.11.1.5?

A

sudo nmap -sU 10.11.1.5

76
Q

What is Masscan?

A

Masscan is arguably the fastest port scanner; it can scan the entire Internet in about 6 minutes, transmitting an astounding 10 million packets per second! While it was originally designed to scan the entire Internet, it can easily handle a class A or B subnet, which is a more suitable target range during a penetration test.

77
Q

How to install Masscan on Linux?

A

sudo apt install masscan

78
Q

How to use masscan to look for all web servers within a class A subnet?

A

kali@kali:~$ sudo masscan -p80 10.0.0.0/8

79
Q

What is ‘–rate’ for in masscan?

A

To specify the desired rate of packet transmission.

80
Q

What is ‘-e’ for in masscan?

A

To specify the raw network interface to use.

81
Q

What is ‘–router-ip’ for in masscan?

A

Specify the IP address for the appropriate gateway.

82
Q

How to use masscan on port 80

A

kali@kali:~$ sudo masscan -p80 10.11.1.0/24 –rate=1000 -e tap0 –router-ip 10.11.0.1

83
Q

What is SMB?

A

Server Message Block

84
Q

On which port NetBIOS service listen?

A

139

85
Q

SMB port?

A

445

86
Q

What is NetBIOS?

A

NetBIOS is an independent session layer protocol and service that allows computers on a local network to communicate with each other.

87
Q

How to use nmap to scan for the NetBIOS service?

A

kali@kali:~$ nmap -v -p 139,445 -oG smb.txt 10.11.1.1-254

88
Q

How to use nbtscan to collect additional NetBIOS information on IP 10.11.1.*?

A

kali@kali:~$ sudo nbtscan -r 10.11.1.0/24

89
Q

Where are Nmap SMB NSE Scripts?

A

/usr/share/nmap/scripts

90
Q

How to find various nmap SMB NSE scripts?

A

ls -1 /usr/share/nmap/scripts/smb*

91
Q

What is NetBIOS?

A

Network Basic Input/Output System

92
Q

How to use NSE to perform OS discovery?

A

kali@kali:~$ nmap -v -p 139, 445 –script=smb-os-discovery 10.11.1.227

93
Q

How to pass argument to NSE script?

A

–script-args

94
Q

How to pass “smb-vuln-ms08-067” argument to NSE script? Destination IP is 10.11.1.5 and destination ports are 139 and 445.

A

nmap -v -p 139,445 –script=smb-vuln-ms08-067 –script-args=unsafe=1 10.11.1.5

95
Q

What is NFS?

A

Network File System is a distributed file system protocol originally developed by Sun Microsystems in 1984. It allows a user on a client computer to access files over a computer network as if they were on locally-mounted storage.

96
Q

What is UDP?

A

User Datagram Protocol

97
Q

How to use nmap to identify hosts that have portmapper/rpcbind running?

A

kali@kali:~$ nmap -v -p 111 10.11.1.1-254

98
Q

How to query rpcbind in order to get registered services?

A

nmap -sV -p 111 –script=rpcinfo 10.11.1.1-254

99
Q

How to locate various NSE scripts for NFS?

A

kali@kali:~$ ls -1 /usr/share/nmap/scripts/nfs*

100
Q

How to run all NSE scripts for NFS on IP address 10.11.1.72?

A

nmap -p 111 –script nfs* 10.11.1.72

101
Q

How to use nmap to make a list of machines running NFS in the labs?

A

nmap –script=nfs-ls 10.11.1.1-255 -p 111

102
Q

What is SMTP and what it support?

A

The Simple Mail Transport Protocol (SMTP) supports several interesting commands, such as VRFY and EXPN.

103
Q

What VRFY do in SMTP?

A

A VRFY request asks the server to verify an email address.

104
Q

What EXPN do in SMTP?

A

EXPN asks the server for the membership of a mailing list.

105
Q

How to validate nc to validate SMTP users on ip address 10.11.1.217?

A

nc -nv 10.11.1.217 25
VRFY root
VRFY idontexist

106
Q

What is SNMP?

A

Simple Network Protocol

107
Q

SNMP is based on what?

A

UDP

108
Q

What is UDP?

A

Simple, stateless protocol, which is susceptible to IP spoofing and replay attacks.

109
Q

What is the SNMP MIB?

A

The SNMP Management Information Base (MIB) is a database containing information usually related to network management. The database is organized like a tree, where branches represent different organizations or network functions. The leaves of the tree (final endpoints) correspond to specific variable values that can then be accessed, and probed, by an external user. The IBM
Knowledge Center contains a wealth of information about the MIB tree.

110
Q

How to scan for open SNMP ports, which command would you use?

A

nmap

111
Q

Which option would you use to perform UDP scanning in nmap?

A

-sU

112
Q

Which option is used to limit the output to only display open ports in nmap?

A

–open

113
Q

How to use nmap to perform a SNMP scan on 10.11.1.*?

A

sudo nmap -sU –open -p 161 10.11.1.1-254 -oG open-snmp.txt

114
Q

What is onesixtyone?

A

Tool that will attempt a brute force attack against a list of IP addresses.

115
Q

How to use onesixtyone to brute force community strings?

A

onesixtyone -c community -i ips

116
Q

How to enumerate the entire MIB tree on IP address 10.11.1.14?

A

snmpwalk -c public -vl -t 10 10.11.1.14

117
Q

How to enumerate Windows Users using snmpwalk on address IP 10.11.1.14?

A

snmpwalk -c public -vl 10.11.1.14 1.3.6.1.4.1.77.1.2.25

118
Q

How to enumerate Windows processes using snmpwalk on address IP 10.11.1.73?

A

snmpwalk -c public -vl 10.11.1.73 1.3.6.1.2.1.25.4.2.1.2

119
Q

How to enumerate open TCP ports using snmpwalk on address IP 10.11.1.14?

A

snmpwalk -c public -vl 10.11.1.14 1.3.6.1.2.1.6.13.1.3

120
Q

How to enumerate installed software using snmpwalk on IP address 10.11.1.50?

A

snmpwalk -c public -vl 10.11.1.50 1.3.6.1.2.1.25.6.3.1.2

121
Q

How to scan network 10.11.1.0 to identify a SNMP servers?

A

sudo nmap -sU -p 161 10.11.1.0/24

122
Q

How to find SNMP Servers on network 148.32.42.*?

A

nmap -sU -p 161 148.32.42.0/24

123
Q

What is SNMP?

A

SNMP fullform is Simple Network Management Protocol and that is used for interchanging or exchanging management information between different network devices. SNMP allows an administrator to gather information about the host on which SNMP service is running. It is also possible to modify the information.

124
Q

What is an SNMP Community String?

A

The “SNMP Community string” is like user id and password that allows router’s to access other router’s statistics data. IPCheck Server Monitor sends the community string along with all SNMP requests. If the community string data is correct, the device responds with the requested information. If the community string is incorrect, the device simply discards the request and does not respond.
Important: SNMP Community strings are used only by those devices which support SNMP v1 and SNMP v2c protocol. The SNMP v3 uses the username and password authentication, along with an encryption key. Most SNMP v1 and v2c devices are set to default from the factory with a read-only community string set to “public“.

124
Q

What is an SNMP Community String?

A

The “SNMP Community string” is like user id and password that allows router’s to access other router’s statistics data. IPCheck Server Monitor sends the community string along with all SNMP requests. If the community string data is correct, the device responds with the requested information. If the community string is incorrect, the device simply discards the request and does not respond.
Important: SNMP Community strings are used only by those devices which support SNMP v1 and SNMP v2c protocol. The SNMP v3 uses the username and password authentication, along with an encryption key. Most SNMP v1 and v2c devices are set to default from the factory with a read-only community string set to “public“.

125
Q

How to Find SNMP Community String?

A

One can find the SNMP Community String using a tool called Onesixtyone. Onesixtyone will use a word list provided by the user and brute force the SNMP service.

PWK (25 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions