Chap 3 - Information Gathering

Question 1

nmap -sU -sT -p 1-65535 example.com
What information will she not receive?

• TCP services
• The state of the service
• UDP services
• A list of vulnerable services

Answer 1

A list of vulnerable services

This is a port scan, not a vulnerability scan, so Megan will not be able to determine if the services are vulnerable just from this scan. The Nmap scan will show the state of the ports, both TCP and UDP.

Question 2

Tom wants to find metadata about an organization using a search engine. What tool from the following list should he use?

• ExifTool
• MetaSearch
• FOCA
• Nmap

Answer 2

FOCA

FOCA, or Fingerprinting Organizations with Collected Archives, is a useful tool for searching for metadata via search engines. ExifTool is used for individual files. MetaSearch was made up for this question, and although Nmap has many functions, it isn’t used for metadata searches via search engines.

Question 3

ExifTool

Answer 3

ExifTool is a powerful, open-source software utility designed for reading, writing, and manipulating metadata across various file types, including images, audio, video, and PDFs. Developed by Phil Harvey and first released in 2003, ExifTool has become a standard tool for managing metadata due to its extensive capabilities and support for a wide range of formats.

Key Features
* Metadata Support: ExifTool handles numerous metadata formats such as EXIF, IPTC, XMP, JFIF, GeoTIFF, ICC Profile, and more. It can also process manufacturer-specific metadata from many digital cameras
* Command-Line Interface: It operates primarily through a command-line interface, allowing users to execute commands to read or modify metadata efficiently. Users can specify tags to read or write and can process multiple files at once
* Custom Tags: Users can define custom tags and manage over 23,000 tags categorized into 130 different groups. This flexibility makes it suitable for both casual users and professionals requiring detailed metadata management
* Cross-Platform Compatibility: ExifTool is platform-independent and works on Windows, macOS, and Linux systems. It is available as both a standalone command-line application and a Perl library

Question 4

After running an Nmap scan of a system, Zarmeena discovers that TCP ports 139, 443, and 3389 are open. What operating system is she most likely to discover running on the system?

• Windows
• Android
• Linux
• iOS

Answer 4

Windows

Zarmeena knows that TCP ports 139, 443, and 3389 are all commonly used for Windows services. Although those ports could be open on a Linux, Android, or iOS device, Windows is her best bet.

Question 5

Port 3389

Answer 5

RDP

Question 6

Port 443

Answer 6

HTTPS (SSL over HTTP)

Question 7

Port 139

Answer 7

NetBIOS

Question 8

Charles runs an Nmap scan using the following command:

nmap -sT -sV -T2 -p 1-65535 example.com
After watching the scan run for over two hours, he realizes that he needs to optimize the scan. Which of the following is not a useful way to speed up his scan?

• Only scan via UDP to improve speed.
• Change the scan timing to 3 or faster.
• Change to a SYN scan.
• Use the default port list.

Answer 8

Only scan via UDP to improve speed.

Only scanning via UDP will miss any TCP services. Since the great majority of services in use today are provided as TCP services, this would not be a useful way to conduct the scan. Setting the scan to faster timing (3 or faster), changing from a TCP connect scan to a TCP SYN scan, or limiting the number of ports tested are all valid ways to speed up a scan. Charles needs to remain aware of what those changes can mean, since a fast scan may be detected or cause greater load on a network, and scanning fewer ports may miss some ports.

Question 9

Karen identifies TCP ports 8080 and 8443 open on a remote system during a port scan. What tool is her best option to manually validate the services running on these ports?

• SSH
• SFTP
• Telnet
• A web browser

Answer 9

A web browser

Karen knows that many system administrators move services from their common service ports to alternate ports and that 8080 and 8443 are likely alternate HTTP (TCP 80) and HTTPS (TCP 443) server ports, and she will use a web browser to connect to those ports to check them. She could use Telnet for this testing, but it requires significantly more manual work to gain the same result, making it a poor second choice unless Karen doesn’t have another option.

Question 10

Angela recovered a PNG image during the early intelligence‐gathering phase of a penetration test and wants to examine it for useful metadata. What tool could she most successfully use to do this?

• ExifTool
• Grep
• PsTools
• Nginx

Answer 10

ExifTool

ExifTool is designed to pull metadata from images and other files. Grep may be useful to search for specific text in a file, but it won’t pull the range of possible metadata from the file. PsTools is a Windows Sysinternals package that includes a variety of process‐oriented tools. Nginx is a web server, load balancer, and multipurpose application services stack.

Question 11

During an Nmap scan, Casey uses the -O flag. The scan identifies the host as follows:

Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
What can she determine from this information?

• The Linux distribution installed on the target
• The patch level of the installed Linux kernel
• The date the remote system was last patched
• That the system is running a Linux 2.6 kernel between .9 and .33

Answer 11

That the system is running a Linux 2.6 kernel between .9 and .33

OS identification in Nmap is based on a variety of response attributes. In this case, Nmap’s best guess is that the remote host is running a Linux 2.6.9–2.6.33 kernel, but it cannot be more specific. It does not specify the distribution, the patch level, or when the system was last patched.

Question 12

Steve is working from an unprivileged user account that was obtained as part of a penetration test. He has discovered that the host he is on has Nmap installed, and he wants to scan other hosts in his subnet to identify potential targets as part of a pivot attempt. What Nmap flag will Steve probably have to use to successfully scan hosts from this account?

• -sV
• -u
• -oA
• -sT

Answer 12

-sT

The TCP connect scan is often used when an unprivileged account is the tester’s only option. Linux systems typically won’t allow an unprivileged account to have direct access to create packets, but they will allow accounts to send traffic. Steve probably won’t be able to use a TCP SYN scan, but a connect scan is likely to work. The other flags shown are for version testing (-sV) and output type selection (-oA), and -u doesn’t do anything at all.

Question 13

Chris runs an Nmap scan of the 10.10.0.0/16 network that his employer uses as an internal network range for the entire organization. If he uses the -T0 flag, what issue is he likely to encounter?

• The scan will terminate when the host count reaches 0.
• The scan will not scan IP addresses in the .0 network.
• The scan will progress at a very slow speed.
• The scan will only scan for TCP services.

Answer 13

The scan will progress at a very slow speed.

The -T flag in Nmap is used to set scan timing. Timing settings range from 0 (paranoid) to 5 (insane). By default, it operates at 3, or normal. With timing set to a very slow speed, Chris will run his scan for a very, very long time on a /16 network.

Question 14

Which of the following Nmap output formats is unlikely to be useful for a penetration tester?

• -oA
• -oS
• -oG
• -oX

Answer 14

-oS

The Script Kiddie output format that Nmap supports is entirely for fun—you should never have a practical need to use the -oS flag for an actual penetration test.

Question 15

During an early phase of his penetration test, Mike recovers a binary executable file that he wants to quickly analyze for useful information. Which of the following will quickly give him a view of potentially useful information in the binary?

• Netcat
• strings
• Hashmod
• Eclipse

Answer 15

strings

The strings command parses a file for strings of text and outputs them. It is often useful for analyzing binary files, since you can quickly check for information with a single quick command‐line tool. Netcat, while often called a pentester’s Swiss Army knife, isn’t useful for this type of analysis. Eclipse is an IDE and would be useful for editing code or for managing a full decompiler in some cases.

Question 16

strings (command line tool)

Answer 16

The strings command line tool is a utility used in Linux and other Unix-like operating systems to extract and display sequences of printable characters from binary files, such as executables, object files, and other non-text files.

Question 17

Netcat

Answer 17

Netcat, often abbreviated as nc, is a versatile and powerful command-line networking utility that has earned the nickname “the Swiss Army knife of networking tools” due to its wide range of capabilities and flexibility.

Core Functionality
* Network Connections: Netcat can establish network connections using both TCP and UDP protocols. It can operate in either client or server mode, allowing it to create outbound connections or listen for inbound connections
* Data Transfer: It can read and write data across these connections, supporting both text-based communication and binary data transfer. This makes it useful for tasks such as file transfers, port scanning, and network debugging.

Key Features and Capabilities
* Port Scanning: Netcat can perform port scanning to identify open ports on a target system. This is done using the -z option for TCP and -zu for UDP, and it supports sequential and individual port scanning
* File Transfer: It allows for simple file transfers between systems without the need for additional authentication. This is achieved by setting up one system to listen and another to send the file
* Port Listening and Redirection: Netcat can listen on specific ports and redirect incoming connections to other ports or systems, making it useful for port forwarding and proxying
* Network Debugging: It includes features like hex dump for debugging, slow-send mode, and the ability to read command-line arguments from standard input5.
* IPv4 and IPv6 Compatibility: Netcat supports both IPv4 and IPv6, ensuring it can work in various network environments15.

Use Cases
* Network Testing and Debugging: Netcat is widely used for testing network connectivity, debugging network issues, and verifying the availability of services on specific ports
* File Transfer: It is a simple and effective tool for transferring files between systems, especially in scenarios where other file transfer protocols are not available or practical
* Port Scanning and Security: System administrators and security professionals use Netcat to scan for open ports and identify potential vulnerabilities in networked systems
* Proxying and Port Forwarding: Netcat can be used to set up simple proxies and forward traffic between different ports or systems, which is useful in various networking scenarios

Question 18

Jack is conducting a penetration test for a customer in Japan. What NIC will he most likely have to check for information about his client’s networks?

• RIPE
• ARIN
• APNIC
• LACNIC

Answer 18

APNIC

The Asia‐Pacific NIC covers Asia, Australia, New Zealand, and other countries in the region. RIPE covers central Asia, Europe, the Middle East, and Russia, and ARIN covers the United States, Canada, parts of the Caribbean region, and Antarctica.

Question 19

APNIC

Answer 19

APNIC, or the Asia Pacific Network Information Centre,

is a crucial organization that plays a significant role in the management and distribution of Internet number resources in the Asia Pacific region. Here are the key aspects of APNIC:

Role and Responsibilities
* APNIC is the Regional Internet Registry (RIR) for the Asia Pacific region, one of the five RIRs globally, and a part of the Number Resource Organization (NRO)
* It is responsible for allocating and managing Internet number resources, including IPv4 and IPv6 addresses and Autonomous System Numbers (ASNs) within the Asia Pacific region, which encompasses 56 economies

Question 20

RIPE

Answer 20

Réseaux IP Européens Network Coordination Centre (RIPE NCC)

is a crucial organization that plays a significant role in the management and coordination of Internet resources in the Europe, Middle East, and parts of Central Asia region.

Role as a Regional Internet Registry (RIR)
RIPE NCC is one of the five Regional Internet Registries (RIRs) globally, responsible for allocating and registering Internet number resources such as IPv4 and IPv6 addresses and Autonomous System Numbers (ASNs) within its service region

Geographical Service Region
The RIPE NCC serves Europe, the Middle East, and parts of Central Asia, covering over 76 countries

Question 21

ARIN

Answer 21

The American Registry for Internet Numbers

is a nonprofit, member-based organization that plays a critical role in the management and distribution of Internet number resources within its defined service region.

Service Region ARIN serves the United States, Canada, and many Caribbean and North Atlantic islands. This region includes a diverse set of countries and territories, making ARIN responsible for a significant portion of the global Internet infrastructure

Core Functions
* Resource Allocation: ARIN is responsible for allocating and registering Internet number resources, including IPv4 and IPv6 addresses and Autonomous System Numbers (ASNs). These allocations are based on demonstrated need and follow policies developed by the ARIN community
* Database Maintenance: ARIN maintains the ARIN Whois and Whowas databases, which contain registration details of IP addresses and ASNs. This ensures the accuracy and completeness of the registration data
* Technical Services: ARIN provides various technical services, including reverse DNS delegation, Internet Routing Registry (IRR), Resource Public Key Infrastructure (RPKI), and Domain Name Service Security (DNSSEC)

Question 22

LACNIC

Answer 22

the Latin American and Caribbean Internet Addresses Registry

is a Regional Internet Registry (RIR) responsible for managing and allocating Internet number resources in the Latin American and Caribbean regions.

Service Region LACNIC serves 33 countries and territories in Latin America and the Caribbean, including countries such as Argentina, Brazil, Chile, Mexico, and many others in the region

Core Functions
* Resource Allocation: LACNIC allocates and manages IPv4 and IPv6 addresses, as well as Autonomous System Numbers (ASNs), according to the policies developed by its community
* DNS Delegations: It handles reverse DNS delegations, ensuring proper mapping of IP addresses to domain names
* Whois Database: LACNIC maintains the public Whois database for the Latin American and Caribbean regions, providing information about IP address and ASN registrations
* Global Representation: The organization represents the interests of Internet users and members in the Latin American and Caribbean regions at a global level

Question 23

Lin believes that the organization she is scanning may have load balancers in use. Which of the following techniques will help her detect them if they are DNS‐based load balancers?

• Use Nmap and look for service port differences.
• Use ping and check for TTL and IP changes.
• Use Nessus and check for service version differences.
• Use WHOIS to check for multiple hostnames.

Answer 23

Use ping and check for TTL and IP changes.

Checking for DNS load balancing via ping requires checking time to live (TTL) and IP address differences. Using Nmap or Nessus is less likely to be successful, because most devices in a pool should provide the same services and service versions. WHOIS records do not show load balancing details.

Question 24

Charles uses the following hping command to send traffic to a remote system:

hping remotesite.com -S -V -p 80

What type of traffic will the remote system see?

• HTTP traffic to TCP port 80
• TCP SYNs to TCP port 80
• HTTPS traffic to TCP port 80
• A TCP three‐way handshake to TCP port 80

Answer 24

TCP SYNs to TCP port 80

Charles has issued a command that asks hping to send SYN traffic (-S) in verbose mode (-V) to remotesite.com on port 80.

Question 25

What does a result of * * * mean during a traceroute?

• No route to the host exists.
• All hosts are queried.
• There is no response to the query, perhaps a timeout, but traffic is going through.
• A firewall is blocking responses

Answer 25

There is no response to the query, perhaps a timeout, but traffic is going through.

A series of three asterisks during a traceroute means that the host query has failed but that traffic is passing through. Many hosts are configured to not respond to this type of traffic but will route traffic properly.

Question 26

Rick wants to describe flaws found in an organization’s internally developed web applications using a standard model. Which of the following is best suited to his need?

CWE
The Diamond Model
CVE
OWASP

Answer 26

CWE

The Common Weakness Enumeration is a community‐developed list of hardware and software weaknesses. Although OWASP provides a massive amount of application security knowledge, it is not in and of itself a listing or standard for listing flaws. The Diamond Model is a model designed to evaluate intrusions, and CVE, the Common Vulnerabilities and Exposures database, focuses on vulnerabilities for commercial and open source projects and thus will not typically be used for internal applications and code.

Question 27

CVE

Answer 27

the Common Vulnerabilities and Exposures database

Question 28

CWE

Answer 28

The Common Weakness Enumeration is a community‐developed list of hardware and software weaknesses.

Question 29

Diamond Model

Answer 29

Diamond Model of Intrusion Analysis

• Adversary: The attacker or group responsible for the cyber incident, including their identity, motivations, and TTPs
• Capability: The methods, tools, or techniques used by the adversary during the attack
• Infrastructure: The technical resources or assets used by the adversary, such as servers and IP addresses
• Victim: The individual or organization targeted by the adversary.

Question 30

Why would a penetration tester look for expired certificates as part of an information‐gathering and enumeration exercise?

• They indicate improper encryption, allowing easy decryption of traffic.
• They indicate services that may not be properly updated or managed.
• Attackers install expired certificates to allow easy access to systems.
• Penetration testers will not look for expired certificates; they only indicate procedural issues.

Answer 30

They indicate services that may not be properly updated or managed.

Penetration testers are always on the lookout for indicators of improper maintenance. Lazy or inattentive administrators are more likely to make mistakes that allow penetration testers in.

Question 31

John has gained access to a system that he wants to use to gather more information about other hosts in its local subnet. He wants to perform a port scan but cannot install other tools to do so. Which of the following tools isn’t usable as a port scanner?

• Hping
• Netcat
• Telnet
• ExifTool

Answer 31

ExifTool

All of these tools except ExifTool are usable as port scanners with some clever use of command‐line flags and options.