Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPSA Syllabus > All Appendix 2 > Flashcards

All Appendix 2 Flashcards

1
Q

RIP Port

A

UDP 520

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

UDP 520

A

RIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does rusers stand for

A

Remote Users Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does rusers do

A

rusers displays information about users currently logged into remote systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the difference between rusers and rwho

A

rusers displays information only for the current host while rwho displays information for the entire network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does rusers work

A

When you run rusers on a network, it sends out a broadcast request to all machines on the network running the rusersd daemon, these machines will respond with a list of currently logged in users along with their idle times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Rusers port

A

UDP 513

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

UDP 513

A

Rusers and Rwho

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does Rwho stand for

A

Remote Who Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does rwho do

A

rwho displays information about users logged into remtoe systems on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Rwho port

A

UDP 513

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How can SMTP be used to enumerate users

A

Certain SMTP commands such as VRFY and EXPN can be used to validate whether a specific email/username exists on the server through obsering response status codes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the two commands responsible for SMTP user enumeration

A

VRFY and EXPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Finger

A

Finger is a utility that provides information about users on a system, it can display details such as full name, home dir, login shell, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Where is information from Finger derived from

A

Lots of the information comes from the /etc/passwd file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What happens if no user is specified on a finger query

A

It can return a list of all users on the system including login names and other details

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Finger port

A

TCP 79

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

TCP 79

A

Finger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is an FTP access control mechanism

A

/etc/ftpusers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does /etc/ftpusers do

A

It is a list of users that cannot access the ftp server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is anonymous user on FTP

A

Anonymous user is used to allow everyone on the internal network to share files and data without accessing each others computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Does Anonymous user require authentication/password for FTP

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a security configuration in FTP to prevent identifying authors of files

A

hide_ids=YES means the UID and GID of files will be overwritten meaning it is more difficult to identify which rights these files have and to prevent user enumeration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a vulnerability of allow file upload to an FTP server

A

If we can upload files this may allow for LFI vulnerabilities to make system commands and RCE (remote code execution)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

FTP Ports

A

20-21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

FTP conf file

A

/etc/vsftpd.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is SMTP

A

SMTP is a protocol used for sending emails in an IP network, it can be used between an email client and an outgoing mail server or between two SMTP servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

SMTP Port

A

TCP 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What do newer SMTP servers listen on

A

TCP 587

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is an essential function of SMTP

A

Blocking spam by using authentication mechanisms that allow only authorised users to send emails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is ESMTP

A

It is an extension of SMTP, aptly called Extended STP which uses SSL and TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How can we enumerate usernames on SMTP

A

Using the EXPN and VRFY queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does EXPN do

A

The client checks if a mailbox is available for messaging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What does VRFY query do

A

The client checks if a mailbox is available for mail transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is Code 252 in VRFY

A

User that does not exist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is Code 250 in VRFY

A

Requested mail action completed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How can we connect to an SMTP server

A

Telnet 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is Mail Relaying

A

Mail Relaying is the process where an SMTP server forwards an email from one server to another that is not directly responsible for either the sender or recipient, such as when emails need to be transferred across different domains and servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

In essence what is Mail Relaying

A

Any transfer of an email that is not directly the recipient or sender but rather an intermediary server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What does NFS stand for

A

Network File System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does NFS do

A

It is a file system that has the same purpose as SMB - to access file systems over network as if they were local

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are the versions of NFS

A

NFSv2, NFSv3 and NFSv4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is NFSv2

A

It is older but supported by many systems and was initially operated over UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is NFSv3

A

It has more features including variable file size and better error reporting, but it is not compatible with NFSv2 clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is NFSv4

A

It includes Kerberos, supports ACLs and provides performance improvements and higher security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the most secure version of NFS

A

NFSv4

47
Q

What is NFS based on

A

ONC-RPC / SUN-RPC

48
Q

What does ONC-RPC stand for

A

Open Network Computing Remote Procedure Call

49
Q

What port does NFS listen on

A

2049

50
Q

What port does ONC-RPC listen on

A

111

51
Q

What does NFS rely on for authentication

A

NFS relies on UID/GID on the client machine which is checked against the local user database to determine user permissions

52
Q

What file contains a table of filesystems on the NFS server

A

/etc/exports

53
Q

What is Root_Squash / No_Root_Squash

A

Prevents the root user on the client from having root privileges on the NFS server, if turned on, any requests from the root user will be mapped to an anonymous user

54
Q

What is Nosuid option

A

Prevents the execution of files with the setuid or setgid set (meaning it won’t execute as the author of the file but rather as the logged in user)

55
Q

What is noexec option

A

Option that prevents the exectution of binaries on the file system, any attempt to execute a binary file (an executable or script) will fail

56
Q

How can we access files through UID/GID manipulation

A

If we have access to the system via SSH and want to read files from another folder that a specific user has access to, we can upload a shell to the NFS server that has a SUID of that user and run the shell via the SSH user

57
Q

What are the two access control types in NFS

A

Host level and File level

58
Q

What is Host level in NFS

A

The NFS server controls which hosts (devices) can access the shared directories through the NFS server’s /etc/exports file

59
Q

What is File level on NFS

A

Traditional UNIX model where access to files and directories are controlled based on user IDs (UID) and group IDs (GID)

60
Q

What is HINFO in DNS records

A

Resource record that provides descriptive information about a host, specifically its hardware and operating system

61
Q

NetBIOS Name Port

A

UDP 137

62
Q

UDP 137

A

NetBIOS Name

63
Q

List all of the R Services

A

rcp, rexec, rlogin, rsh, stat, ruptime, rwho

64
Q

What is R Services

A

R Services are a suite of services hosted to enable remote access or issue commands between UNIX hosts over TCP/IP

65
Q

Are R Services used now?

A

No they were replaced by SSH

66
Q

What is a vulnerabiity in R. Services

A

Much like Telnet, R Services transmits information for client to server (and vice versa) over the network in an unencrypted format, making it possible for attackers to intercept traffic

67
Q

What ports does R Services use

A

512, 513 and 514

68
Q

What is rcp

A

Remote Copy

69
Q

What is rexec

A

Remote Execution

70
Q

W hat is Rlogin

A

Remote login

71
Q

What is Rsh

A

Remote Shell

72
Q

What port does rcp listen on

A

TCP 514

73
Q

What port does rsh listen on

A

TCP 514

74
Q

What port does rexec listen on

A

TCP 512

75
Q

What port does rlogin listen on

A

TCP 513

76
Q

What does rcp do

A

Copy a file/directory bidirectionally from local machine to remote system, but provides no warning to user for overwriting existing files

77
Q

What does rsh do

A

Opens a shell on a remote machine without a login procedure, relies upon trusted entries in the /etc/hosts.equiv and .rhosts files

78
Q

How is authentication overwritten in rsh, rexec and rlogin

A

Passing authentication relies on trusted entries in the /etc/hosts.equiv and .rhosts rule for validation

79
Q

What does rexec do

A

Enables a user to run shell commands on a remote machine

80
Q

What does rlogin do

A

Enables a user to login to a remote host over the network similar to Telnet, but can only connect to Unix-like hosts

81
Q

What is the difference between /etc/hosts.equiv and .rhosts

A

Hosts.equiv is the global configuration of all users on a system, whereas .rhosts provides a per-user configuration

82
Q

What is X11

A

X11 is a framework for building GUIs on Unix OS, provides tools and protocols to display graphical applications, manage windows, handle input devices, etc.

83
Q

What is security with X11 like

A

X11 communication is unencrypted, making it vulnerable to eavesdropping and MiTM attacks, however it can be tunneled through SSH for secure access

84
Q

What does Xhost + do

A

Allows all hosts access to the X server

85
Q

What is recommended when using xhost

A

To use user-based access control and not host-based

86
Q

What is the two types of access control on X11

A

Host-based and User-based

87
Q

What is host-based access control in X11

A

The xhost command is used to manage host-based access control, it allows or denies access to the X server for specific hosts

88
Q

What does xhost - do

A

Denies access for all hosts

89
Q

What is used based access control in X11

A

Restricts access to the X server based on individual users rather than entire hosts offering finer control.

90
Q

What is the most common user-based authentication method to X server

A

MIT-MAGIC-COOKIE-1 is a random cookie which is provided to authorised clients and stored in the .Xauthority file

91
Q

Is MIT-MAGIC-COOKIE-1 or SSH tunnelling more secure in X11 and why

A

SSH tunnelling is more secure as it encrypts the data transmission whereas the magic cookie does not, it leaves it unencrypted still

92
Q

What is RPC

A

RPC is a protocol that allows a program to request a service or exectute procedures on a remote server as if it were local

93
Q

What does RPC stand for

A

Remote Procedure Call

94
Q

Name 3 common RPC services

A

MSRPC, Portmapper and NFS

95
Q

What is MSRPC

A

MSRPC is used by Windows for various network services such as file sharing, SMB, Active Directory, etc

96
Q

What is Portmapper

A

The Portmapper service maps RPC services on the appropriate network protocols allowing clients to discover where services are available

97
Q

What is NFS

A

NFS allows for files to be shared over a network as if they were on a local disk, NFS uses RPC or all communication between the NFS client and NFS server

98
Q

What tool can we use to enumerate RPC services

A

rpcinfo is a tool that provides information about RPC services running on a Unix system, it can be used to list all registered devices

99
Q

What were two popular vulnerabilities in RPC

A

EternalBlue which targets the SMBv1 protocol which relies on MSRPC which was exploited in the WannaCry attack and Wordpress xmlrpc

100
Q

RPC Endpoint Mapper (Windows) Port

A

Port 135

101
Q

Port 135

A

RPC Endpoint Mapper (Windows)

102
Q

Port 111

A

Portmapper

103
Q

Portmapper Port

A

Port 111

104
Q

What does SSH do

A

SSH enables two computers to establish an encrypted and direct connection within a possibly insecure network on TCP 22

105
Q

Where is SSH native to

A

Native to Unix so it is preinstalled on Linux and MacOS

106
Q

What protocols can connect to SSH-1.99-OpenSSH_3.9p1

A

We can connect with SSH-1 and SSH-2

107
Q

What protocols can connect to SSH-2.0-OpenSSH_8.2p1

A

Only accepts SSH-2 protocol

108
Q

What are the 6 ways of authenticating to SSH

A

Password, Public Key, Host based, Keyboard, Challenge-Response and GSSAPI

109
Q

What is Public Key authentication for SSH

A

The server creates a cryptographic problem with the public key and the client decrypts the problem with its own private key and sends back the solution

110
Q

What file is responsible for the OpenSSH server

A

sshd_config file

111
Q

What is a dangerous setting on SSH

A

PasswordAuthentication=YES as it allows us to brute-force

112
Q

What is a tool used to footprint SSH

A

ssh-audit checks the client-side and server-side configuration and shows general information

113
Q

How can we secure SSH

A

Use key-based authentication, disable password authentication, use SSH-2 and change default SSH port from port 22

114
Q

How to remember what SSH versions can connect to what protocols

A

1.5 or lower just SSH-1, 1.99 is a mix of SSH-1 and SSH-2 and 2.0 and beyond is just SSH-2

CPSA Syllabus (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions