Chap 1 - Penetration testing Flashcards
Assuming no significant changes in an organization’s cardholder data environment, how often does PCI DSS require that a merchant accepting credit cards conduct penetration testing?
- Monthly
- Semiannually
- Annually
- Biannually
Annually
PCI DSS requires that organizations conduct both internal and external penetration tests on at least an annual basis. Organizations must also conduct testing after any significant change in the cardholder data environment.
Which one of the following is not a benefit of using an internal penetration testing team?
- Contextual knowledge
- Cost
- Subject matter expertise
- Independence
Independence
The use of internal testing teams may introduce conscious or unconscious bias into the penetration testing process. This lack of independence is one reason organizations may choose to use an external testing team.
Which one of the following is not a reason to conduct periodic penetration tests of systems and applications?
- Changes in the environment
- Cost
- Evolving threats
- New team members
Cost
Repeating penetration tests periodically does not provide cost benefits to the organization. In fact, it incurs costs. However, penetration tests should be repeated because they can detect issues that arise due to changes in the tested environment and the evolving threat landscape. The use of new team members also increases the independence and value of subsequent tests.
Rich recently got into trouble with a client for using an attack tool during a penetration test that caused a system outage. During what stage of the penetration testing process should Rich and his clients have agreed on the tools and techniques that he would use during the test?
- Planning and Scoping
- Information Gathering and Vulnerability Scanning
- Attacking and Exploiting
- Reporting and Communication Results
Planning and Scoping
During the Planning and Scoping phase, penetration testers and their clients should agree on the rules of engagement for the test. This should result in a written statement of work that clearly outlines the activities authorized during the penetration test.
Which one of the following steps of the Cyber Kill Chain does not map to the Attacking and Exploiting stage of the penetration testing process?
- Weaponization
- Reconnaissance
- Installation
- Actions on Objectives
Reconnaissance
The Reconnaissance stage of the Cyber Kill Chain maps to the Information Gathering and Vulnerability Scanning step of the penetration testing process. The remaining six steps of the Cyber Kill Chain all map to the Attacking and Exploiting phase of the penetration testing process.
Cyber Kill Chain
7 stages:
- Reconnaissance: Attackers gather information about potential targets to identify vulnerabilities. This can involve scanning networks, researching employees on social media, and analyzing publicly available data.
- Weaponization: In this phase, attackers create or acquire a malicious payload (e.g., malware) that can exploit the identified vulnerabilities. This often includes pairing the payload with an exploit to facilitate delivery.
- Delivery: The attacker transmits the malicious payload to the target through various methods, such as phishing emails, malicious links, or compromised websites.
- Exploitation: Upon successful delivery, the attacker exploits a vulnerability in the target’s system to execute the malicious code.
- Installation: After exploiting the system, the attacker installs malware or other tools that allow them to maintain access and control over the compromised system.
- Command and Control (C2): The attacker establishes a communication channel to remotely control the compromised system, enabling further actions.
- Actions on Objectives: Finally, the attacker executes their primary goal, which may include data exfiltration, disruption of services, or other malicious activities.
Some models have expanded this framework to include an eighth stage: Monetization, where attackers seek to profit from their actions, such as selling stolen data or demanding ransom
Beth recently conducted a phishing attack against a penetration testing target in an attempt to gather credentials that she might use in later attacks. What stage of the penetration testing process is Beth in?
- Planning and Scoping
- Attacking and Exploiting
- Information Gathering and Vulnerability Scanning
- Reporting and Communication
Attacking and Exploiting
While Beth is indeed gathering information during a phishing attack, she is conducting an active social engineering attack. This moves beyond the activities of Information Gathering and Vulnerability Scanning and moves into the realm of Attacking and Exploiting.
Which one of the following security assessment tools is not commonly used during the Information Gathering and Vulnerability Scanning phase of a penetration test?
- Nmap
- Nessus
- Metasploit
- Nslookup
Metasploit
Nmap is a port scanning tool used to enumerate open network ports on a system. Nessus is a vulnerability scanner designed to detect security issues on a system. Nslookup is a DNS information‐gathering utility. All three of these tools may be used to gather information and detect vulnerabilities. Metasploit is an exploitation framework used to execute and attack and would be better suited for the Attacking and Exploiting phase of a penetration test.
Metasploit
Metasploit is a widely-used open-source framework designed for penetration testing and security assessment. Developed initially by H.D. Moore in 2003, it allows security professionals to find, exploit, and validate vulnerabilities in systems and networks. The framework has evolved significantly since its inception, being rewritten in Ruby in 2007 and later acquired by Rapid7 in 2009, which enhanced its capabilities and support.
Key Features of Metasploit
* Penetration Testing: Metasploit is primarily utilized for ethical hacking, enabling security teams to simulate attacks on their systems to identify weaknesses before malicious actors can exploit them.
* Modular Architecture: The framework consists of various modules that perform specific tasks. These include:
* Exploits: Code that takes advantage of vulnerabilities in systems or applications.
* Payloads: Code executed after an exploit successfully breaches a system, allowing further actions like gaining control or extracting data.
* Auxiliary Modules: Tools for tasks not directly related to exploitation, such as scanning and sniffing.
* Community Contributions: Metasploit boasts a large repository of over 2,300 exploits and nearly 500 payloads, contributed by a community of users and developers. This extensive database allows users to quickly find the tools they need for specific vulnerabilities.
* Integration with Other Tools: Metasploit can integrate with various reconnaissance tools (like Nmap) to gather information about potential targets, making it easier to identify vulnerabilities.
During what phase of the Cyber Kill Chain does an attacker steal information, use computing resources, or alter information without permission?
- Weaponization
- Installation
- Actions on Objectives
- Command and Control
Actions on Objectives
The attacker carries out their original intentions to violate the confidentiality, integrity, and/or availability of information or systems during the Actions on Objectives stage of the Cyber Kill Chain.
Which one of the following is not an open source intelligence gathering tool?
- WHOIS
- Nslookup
- Nessus
- FOCA
Nessus
Whois and Nslookup are tools used to gather information about domains and IP addresses. FOCA is used to harvest information from files. All three of those tools are OSINT tools. Nessus is a commercial vulnerability scanner.
FOCA
FOCA, which stands for Fingerprinting Organizations with Collected Archives, is a powerful open-source tool used in cybersecurity for metadata extraction and organization fingerprinting. It is particularly effective in gathering hidden information from documents that are publicly accessible on the internet.
Key Features of FOCA
* Metadata Extraction: FOCA specializes in analyzing various document types, including Microsoft Office files, PDFs, and Open Office documents. It retrieves metadata that can reveal sensitive information such as user names, software versions, email addresses, and more.
* Document Scanning: The tool can search for documents across multiple search engines, including Google, Bing, and DuckDuckGo. This capability allows it to compile a comprehensive list of potentially vulnerable files associated with a target organization.
* Network Infrastructure Mapping: FOCA can map the network infrastructure of an organization by analyzing the metadata of the collected documents. This includes identifying servers, IP addresses, and other network components that may be exposed through the metadata.
* Advanced Analysis Techniques: Beyond basic metadata extraction, FOCA supports various analysis techniques such as DNS snooping, searching for common files, and identifying technologies used within an organization.
* Customization Options: Users can customize their searches to focus on specific file types or metadata elements, making FOCA adaptable to different reconnaissance needs.
Aircrack-ng
Aircrack-ng is a comprehensive suite of tools designed for assessing the security of WiFi networks. It enables users to monitor, attack, test, and crack wireless network security protocols, specifically focusing on WEP and WPA/WPA2 encryption standards.
Key Features of Aircrack-ng
* Packet Sniffer: Aircrack-ng includes tools like airodump-ng, which captures packets from wireless networks. This is essential for gathering information about network traffic and connected devices.
* WEP and WPA/WPA2 Cracking: The suite supports various methods for recovering encryption keys. It can perform dictionary attacks on WEP (Wired Equivalent Privacy) and WPA/WPA2 (Wi-Fi Protected Access) keys, allowing users to test the strength of their network passwords.
* Network Monitoring: Tools such as airmon-ng enable users to set their wireless adapters into monitor mode, allowing them to capture all WiFi traffic in the vicinity, regardless of the network.
* Traffic Injection: With tools like aireplay-ng, users can inject packets into the network. This can be used for various attacks, including deauthentication attacks that force clients to disconnect from their access points.
* Fake Access Point Creation: The suite allows users to create rogue access points using tools like airbase-ng, which can be used to intercept traffic from unsuspecting clients.
Which one of the following tools is not a password‐cracking utility?
- OWASP ZAP
- Cain and Abel
- Hashcat
- John the Ripper
OWASP ZAP
Cain and Abel, Hashcat, and John the Ripper are all password‐cracking utilities. OWASP ZAP is a web proxy tool.
OWASP ZAP
OWASP ZAP (Zed Attack Proxy) is an open-source web application security scanner developed by the Open Web Application Security Project (OWASP). It is designed to help security professionals and developers identify vulnerabilities in web applications through various testing methodologies.
Key Features of OWASP ZAP
* Intercepting Proxy: ZAP functions as a proxy between the user’s browser and the web application, allowing it to intercept, analyze, and modify HTTP requests and responses in real-time. This feature is essential for debugging and manual testing.
* Active and Passive Scanning: ZAP offers both active and passive scanning capabilities. Passive scanning analyzes traffic without altering it, identifying vulnerabilities based on existing data. Active scanning, on the other hand, actively probes the application, sending crafted requests to uncover vulnerabilities like SQL injection and cross-site scripting (XSS).
* Fuzzing: The tool includes a fuzzing feature that allows users to send large volumes of malformed requests to test how the application handles unexpected input. This helps identify potential weaknesses in input validation.
* Spidering: ZAP can automatically crawl web applications to map their structure and discover hidden endpoints. It includes specialized spiders for traditional HTML as well as AJAX-heavy applications, ensuring comprehensive coverage.
* Extensibility: Users can enhance ZAP’s functionality through a marketplace of add-ons developed by the community. These add-ons can provide additional scanning capabilities, reporting features, and integration with other tools.
* WebSocket Testing: ZAP supports testing for WebSocket vulnerabilities, allowing it to analyze real-time communication between clients and servers, which is critical for modern web applications
