Chap 1 Sybex Flashcards
Authorized legal attempts to defeat an organization’s security controls and perform unauthorized activities
Pen test
CIA triad
Confidentiality: seek to prevent unauthorized access to info or systems
Integrity: prevent unauthorized modification of info or systems
Availability: seek to ensure that legitimate use of info and systems remains possible
DAD triad
Disclosure: attacks seeks to gain unauthorized access to info or systems
Alternation: seek to make unauthorized changes to info or systems
Denial: attacks seek to prevent legitimate use of info and systems
Using hacking tools and techniques in a code of ethics
Ethical hacking
When to pentest you must adopt the ____ ____
Hacker mindset
Benefits of pen testing
-provides knowledge that you can’t obtain elsewhere
-blueprint for remediation
-essential, focused information about specific targets
Uses the attacker mindset to search the organization’s tech infrastructure for the artifacts of a successful attack on “presumption of compromise”
Threat hunter
Incident response plan (NIST)
-preparation
-detection and analysis
-containment and eradication and recovery
-post incident activity
4 pen test requirements of PCI DSS
-perform external pen test at least annually and after any significant infrastructure or application upgrade or modifications
-perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification
-exploitable vulnerabilities found during pen test are corrected and testing is repeated
-if segmentation is used to isolate CDE (cardholder data environment) from other networks, perform pen test at least annually and after any changes to segmentation controls/methods to verify segmentation methods are operational and effective
2 pros and 2 cons of using internal pen test team
Pros:
-they have contextual knowledge of the organization that can improve effectiveness of testing by providing enhanced subject matter expertise
-less expensive
Cons:
-using internal employees who designed and implement security controls. Can create bias
-more difficult for them to detect flaws
Tests conducted by ____ team or to tests conducted from ____ network perspective
Both are Internal or external
If possible, pen test meme era should be separate from cybersecurity team that designs and operates controls
Separation of duties
3 reasons to do pen testing on periodic basis
-tech environment changes
-attack techniques evolve and updated tests should reflect changing attack techniques
-each team member brings unique set of skills, and talents. Can discover different vulnerabilities
CompTIA pen test stages
Planning and scoping
Information gathering and vulnerability scanning
Attacking and exploiting
Reporting and communication results
What stage of pen test:
Outline clear rules of engagement, decide what systems, data, processes and activities are within the authorized scope of the test
Planning and scoping
What stage of pentest:
Gather information about target, vulnerability scans
Information gathering and vulnerability scanning
What stage of pentest:
Exploit vulnerabilities
Attacks and exploits
Phase of pentest:
Actionable recommendations
Reporting and communication
Cyber kill chain by Lookheed Martin (7 items)
-reconnaissance
-weaponization
-delivery
-exploitation
-installation
-command and control (C2C)
-actions on objectives
What stage is this in the cyber kill chain:
Information gathering (OSINT) and vulnerability scanning
Reconnaissance
What stage of the kill chain is this:
Attackers develop specific tool to exploit vulnerabilities
Weaponization
What stage of the kill chain is this:
Could be exploiting a network or application vulnerability, conducting a social engineering attack, distributing malware on a USB or sending an email
Delivery
What stage of the kill chain is this:
Attacker or victim takes some action that triggers the malware payload
Exploitation
What stage of the kill chain is this:
The attacker uses the initial access provided by the malware to establish permanent or persistent access to the target system. Example: back door
Installation
What stage of the kill chain is this:
Attacker can use a remote shell or other means to remotely control the compromised system
Command and control (C2C)
What stage of the kill chain is this:
Theft of sensitive info, the unauthorized use of computing resources to engage in DoS attacks or to mine cryptocurrency or the unauthorized modification or deletion of information
Actions on objectives
What type of tools are these:
WHOIS
Nslookup
TheHarvester
Recon-ng
Censys
FOCA (fingerprinting organizations with collected archives)
Shodan
Maltego
Reconnaissance
What type of tools are these:
Nessus
OpenVAS
Sqlmap
Nikto, Wapiti, W3AF
Security content automation protocol (SCAP)
Vulnerability scanners
What type of tools are these:
SET (____ ____ toolkit)
BeEF (browser exploration framework)
Social engineering
What type of tools are these:
Hashcat, John the Ripper, Hydra, Medusa, Patator, Cain
CeWL
Mimikatz
DirBuster
Credential testing tools
What type of tools:
Immunity debugger
GDB
OllyDbg
WinDbg
IDA
Brakeman
Covenant
TruffleHog
Debuggers and software testing tools
What type of tools:
Wireshark
Hping
Aircrack-ng, WiFite, mdk4, Fern, and Kismet
Rogue wireless access points
EAPHammer
Reaver
Spooftooph
WiGLE (wireless geographic logging engine)
Online SSL checkers
Network testing
What type of tools:
SSH
Ncat and Netcat
Proxychains
Remote access
What type of tools:
Metasploit
SearchSploit
PowerSploit and Empire
Responder
Impacket
Mitm6
CrackMapExec
Exploitation
What type of tools are these:
Open Steg and Steghide
Coagula and Sonic Visualiser
Snow
TinEye
Metagoofil
Steganography
What type of tool:
ScoutSuite
CloudBrute
Pacu
Cloud Custodian
Cloud tools
This tool gathers information from public records about domain ownership
What type of tool?
WHOIS
Reconnaissance
This tool helps identify the IP addresses associated with an organization
What type of tool?
Nslookup
Reconnaissance
Scours search engines and other resources to find email addresses, employee names, and infrastructure details about an org
What type of tool?
TheHarvester
Recon.
Modular web reconnaissance framework that organizes and manages OSINT work
Recon-ng
Web based tool that probe IP addresses across the internet and then provides pen testers with info through a search engine
What type of tool?
Censys
Recon.
OSINT tool used to find metadata within Office documents, PDFs and other common file formats
FOCA (fingerprint organizations with collected archives)
Specialized search engine to provide discovery of vulnerable internet of things devices from public sources
Shodan
Recon.
Commercial product that assists with the visualization of data gathered from OSINT
Maltego
