Chapter 12 - Attack & Defense Flashcards
What protocol is used for a Smurf attack?
A. DNS
B. ICMP
C. TCP
D. SMTP
B.
While DNS is also used for amplification attacks, Smurf attacks are a result of someone sending ICMP echo requests to the broadcast address of a network. The echo responses would be sent to the address in the source of the request, which would be spoofed. If enough systems respond, the volume of responses can overwhelm the target system.
If you were to see ‘ or 1=1; in a packet capture, what would you expect was happening?
A. Cross-site scripting
B. Command injection
C. SQL injection
D. XML external entity injection
C.
An SQL injection attack makes use of SQL queries, which can include logic that may alter the flow of the application. In the example provided, the intent is to force the result of the SQL query to always return a true. It is quoted the way it is to escape the existing query already in place in the application. None of the other attacks uses a syntax that looks like the example.
Which protocol is commonly used for amplification attacks?
A. TCP
B. SMTP
C. DNS
D. XML
C.
Because TCP uses a three-way handshake, spoofing like that needed in amplification is difficult. SMTP also uses TCP. XML is used for data structure and presentation. DNS is often used for modern amplification attacks.
What is the purpose of a SYN flood?
A. Fill up connection buffers at the operating system
B. Fill up connection buffers in the web server
C. Fill up connection buffers at the Application layer
D. Fill up connection buffers for UDP
A.
A SYN flood takes advantage of the three-way handshake. A SYN message alone will con- sume a connection buffer at the operating system. Until the operating system has passed the three-way handshake, the request won’t make it to the web server at the Application layer. SYN is not a header flag used with UDP.
How does a slowloris attack work?
A. Holds open connection buffers at the operating system
B. Holds open connection buffers at the web server
C. Holds open connection buffers at the Application layer
D. Holds open connection buffers for UDP
B.
A slowloris attack is used to hold open connection buffers at the web server. Enough of these requests will consume all of the possible connections for the web server. The Applica- tion layer doesn’t factor in here because there are no connection buffers at the Application layer. Web servers don’t use UDP for HTTP requests, and slowloris is an attack against a web server.
What would be the result of sending the string AAAAAAAAAAAAAAAAA into a variable that has been allocated space for 8 bytes?
A. Heap spraying
B. SQL injection
C. Buffer overflow
D. Slowloris attack
C.
Heap spraying uses dynamically allocated space to store attack code. A slowloris attack is used to hold open web server connection buffers. An SQL injection will be used to inject SQL queries to the database server. A buffer overflow sends more data than space has been allocated for into the application.
What is the target of a cross-site scripting attack?
A. Web server
B. Database server
C. Third-party server
D. User
D.
A cross-site scripting attack uses a scripting language to run in the browser. Since the browser is with the user, ultimately the attack targets the user, even if the injection code is stored in a database server.
If you were to see the following in a packet capture, what would you think was happening? <!ENTITY xxe SYSTEM “file:///etc/passwd” >]>
A. Cross-site scripting
B. SQL injection
C. Command injection
D. XML external entity injection
D.
Cross-site scripting attacks usually use JavaScript or perhaps VBScript. SQL injection uses SQL. Command injection uses operating system commands. The fragment shows XML using an external entity. This is, then, an XML external entity injection.
What protection could be used to prevent an SQL injection attack?
A. Buffer overflows
B. Input validation
C. XML filtering
D. Lateral movement
B.
SQL injection attacks take data injected from the user/attacker. Any data sent in from a user should always be validated before being acted on. Nothing coming in from a user should be trusted. None of the other answers could be used to prevent an SQL injection attack.
What security element would be a crucial part of a defense-in-depth network design?
A. Firewall
B. SIEM
C. Web application firewall
D. Log management system
A.
A defense-in-depth network design makes use of multiple prevention layers to make breaching the inside of the network quite a bit harder. A SIEM is used to collect and corre- late intelligence and log data. A web application firewall protects against Application layer
A log management system is just what it says. A firewall, though, is commonly used
in a defense-in-depth network design.
What does a defense-in-breadth approach add?
A. Consideration for a broader range of attacks
B. Protection against SQL injection
C. Buffer overflow protection
D. Heap spraying protection
A.
Defense in breadth starts with defense in depth and takes a broader range of attack strat- egies into consideration. Defense in breadth doesn’t necessarily protect against SQL injection and probably doesn’t protect against buffer overflows or heap spraying attacks. Those pro- tections may possibly be achieved, but ultimately defense in breadth would achieve them by taking a broader range of attacks into consideration.
What attack injects code into dynamically allocated memory?
A. Buffer overflow
B. Cross-site scripting
C. Heap spraying
D. Slowloris
C.
A buffer overflow attack is an attack against data in the stack, which is known about
at compile time and, as a result, is not dynamic. Cross-site scripting attacks and slowloris attacks don’t inject code into memory. A heap spraying attack, though, injects code into the heap, which is where dynamically allocated memory is taken from.
If you were to see the following in a packet capture, what attack would you expect is
happening?
%3Cscript%3Ealert(‘wubble’);%3C/script%3E
A. SQL injection
B. Command injection
C. Cross-site scripting
D. Buffer overflow
C. A buffer overflow takes an excess amount of data and tries to store it into a memory location that can’t accommodate it. An SQL injection attack uses SQL. Command injec- tion attacks use operating system commands. A cross-site scripting attack uses a scripting language such as JavaScript or VBScript. The script is injected using a
HTML tag, and the %3C is a way of encoding < while %3E is a way of encoding >. This means %3Cscript%3E would be decoded to.
What has been done to the following string?
%3Cscript%3Ealert(‘wubble’);%3C/script%3E
A. Base64 encoding
B. URL encoding
C. Encryption
D. Cryptographic hashing
B. Base64 encoding takes nonprintable characters and encodes them in a way that they can be rendered in text. Encryption would generally render text unreadable to people. A crypto- graphic hash is a way of generating a fixed-length value. URL encoding takes text and uses hexadecimal values to represent the characters. This is text that has been converted into hexadecimal so the characters can be used in a URL.
- What technique does a slow read attack use?
A. Small HTTP header requests
B. Small HTTP body requests
C. Small HTTP POST requests
D. Small file retrieval requests
D. A slowloris attack uses small HTTP requests to hold open a web server’s available connections. There are attacks that use body requests in a slow fashion. However, a slow read attack tries to download a file in small increments to keep a web server from serving legitimate requests.
