Chap 7 - Exploiting Network Vulnerabilities Flashcards
Charles wants to deploy a wireless intrusion detection system. Which of the following tools is best suited to that purpose?
A. WiFite
B. Kismet
C. Aircrack‐ng
D. SnortiFi
Kismet
Kismet is specifically designed to act as a wireless IDS in addition to its other wireless packet capture features. WiFite is designed for wireless network auditing. Aircrack‐ng provides a variety of attack tools in addition to its capture and injection capabilities for wireless traffic. SnortiFi was made up for this question.
Kismet
Kismet is a wireless network detector, sniffer, and intrusion detection system. It is used for capturing and analyzing Wi-Fi traffic, identifying access points, detecting hidden networks, and logging raw packets for further analysis. Kismet is a valuable tool for penetration testers conducting wireless network assessments
WiFite
WiFite is an automated wireless auditing tool used for testing the security of Wi-Fi networks. It simplifies the process of testing and attacking wireless networks by integrating multiple tools and automating tasks like capturing handshakes, cracking WEP and WPA keys, and targeting vulnerable networks based on their encryption methods. WiFite is particularly useful for penetration testers focusing on wireless security
Chris is conducting an on‐site penetration test. The test is a gray‐box test, and he is permitted on‐site but has not been given access to the wired or wireless networks. He knows he needs to gain access to both to make further progress.
Which of the following NAC systems would be the easiest for Chris to bypass?
A. A software client‐based system
B. A DHCP proxy
C. A MAC address filter
D. None of the above
A MAC address filter
If the NAC system relies only on MAC filtering, Chris only needs to determine the hardware address of a trusted system. This may be accessible simply by looking at a label on a laptop or desktop, or he may be able to obtain it via social engineering or technical methods.
Chris is conducting an on‐site penetration test. The test is a gray‐box test, and he is permitted on‐site but has not been given access to the wired or wireless networks. He knows he needs to gain access to both to make further progress.
If Chris wants to set up a false AP, which tool is best suited to his needs?
A. Aircrack‐ng
B. Kismet
C. Wireshark
D. WiFite2
Aircrack‐ng
Aircrack‐ng has fake‐AP functionality built in, with tools that will allow Chris to identify valid access points, clone them, disassociate a target system, and then allow on‐path attacks.
Chris is conducting an on‐site penetration test. The test is a gray‐box test, and he is permitted on‐site but has not been given access to the wired or wireless networks. He knows he needs to gain access to both to make further progress.
Once Chris has gained access to the network, what technique can he use to gather additional credentials?
A. ARP spoofing to allow an on‐path attack
B. Network sniffing using Wireshark
C. SYN floods
D. All of the above
ARP spoofing to allow an on‐path attack
Chris can use ARP spoofing to represent his workstation as a legitimate system that other devices are attempting to connect to. As long as his responses are faster, he will then receive traffic and can conduct on‐path attacks. Network sniffing is useful after this to read traffic, but it isn’t useful for most traffic on its own on a switched network. SYN floods are not useful for gaining credentials; thus, both options C and D are incorrect.
What attack technique can allow the pentester visibility into traffic on VLANs other than their native VLAN?
A. MAC spoofing
B. Dot1q spoofing
C. ARP spoofing
D. Switch spoofing
Switch spoofing
Switch spoofing relies on a switch interface that is configured as either dynamic desirable, dynamic auto, or trunk mode, allowing an attacker to generate dynamic trunk protocol messages. The attacker can then access traffic from all VLANs.
Dot1q spoofing
Dot1q spoofing, also known as VLAN hopping, is a network attack technique that exploits improper configuration of 802.1Q VLAN tagging to send traffic to unauthorized VLANs. The two primary methods of VLAN hopping are:
Double Tagging: The attacker sends packets with two VLAN tags. The outer tag is stripped by the first switch, and the second tag (intended for another VLAN) is processed by the next switch, redirecting the traffic to the targeted VLAN.
Switch Spoofing: The attacker configures their device to imitate a trunk port, allowing it to communicate with all VLANs on the switch.
Mitigation involves:
* disabling unused switch ports
* explicitly configuring access ports (not leaving them as dynamic)
* using private VLANs or VLAN Access Control Lists (VACLs)
What type of Bluetooth attack attempts to send unsolicited messages via Bluetooth devices?
A. Bluesnarfing
B. Bluesniping
C. Bluejacking
D. Bluesending
Bluejacking
Bluejacking is an attack technique that attempts to send unsolicited messages via Bluetooth. Bluesnarfing attempts to steal information, whereas bluesniping is a term for long‐distance Bluetooth attacks. Bluesending is not a common term used for Bluetooth attacks as of this writing.
Bluesnarfing
Bluesnarfing is a Bluetooth attack that involves unauthorized access to data on a Bluetooth-enabled device, such as contacts, messages, or files. Unlike Bluejacking, Bluesnarfing exploits vulnerabilities to gain access to sensitive information without the user’s knowledge
Bluejacking
Bluejacking is a Bluetooth attack where unsolicited messages are sent to nearby Bluetooth-enabled devices. It exploits the Bluetooth messaging feature but does not involve accessing or compromising the target device’s data
Bluesniping
Bluesniping is a long-range Bluetooth attack using directional antennas to intercept or exploit Bluetooth connections beyond their typical range. It targets vulnerabilities in Bluetooth implementations to gain unauthorized access to devices or data
Cassandra wants to attack a WPS‐enabled system. What attack technique can she use against it?
A. WPSnatch
B. Pixie dust
C. WPSmash
D. e‐Lint gathering
Pixie dust
Pixie dust attacks use brute force to identify the key for vulnerable WPS‐enabled routers due to poor key selection practices. The other options are made up.
Pixie dust
Pixie Dust refers to an attack that exploits vulnerabilities in the Wi-Fi Protected Setup (WPS) protocol, specifically in its use of weak PINs. This offline attack takes advantage of predictable or poorly implemented randomization in WPS PIN generation, allowing attackers to brute-force the PIN and gain access to a network. Mitigation involves disabling WPS on routers to prevent exploitation.
As part of a penetration test Mariana uses a tool that uses the same username and password from a list on many target systems and then uses the next username and password from its list. Which of the following terms best describes the attack she is using?
A. Brute force
B. Dictionary
C. Hash cracking
D. Password spraying
Password spraying
Mariana is conducting a password spraying attack. Password spraying attacks use the same credentials against many systems, then try the next credential pairing. Hash cracking attempts to identify the original password that resulted in a given captured hash. Dictionary attacks use a word list along with a set of rules to modify those words to attempt a brute‐force attack. A brute‐force attack involves repeated tries using an algorithm or process to attempt to log in. When a question like this has multiple potentially correct answers, remember to answer with the most specific answer rather than a broad answer.
