Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

my CEH - Certified Ethical Hacker > Chapter 6 Enumeration > Flashcards

Chapter 6 Enumeration Flashcards

1
Q

1) Extracting info from Email IDs

A

used to obtain username & domain name info

e-mail address contains two parts, the first before @ is username, and after @ is the domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

3) Using Brute-force attacks on Directory Services

A

a directory service is a DB that contains info used to administer the NW; many directories are vulnerable to input verification deficiencies that may be exploited in discovering & compromising user accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

4) Exploiting SNMP

A

The Simple NW Mgmt Protocol can be exploited by an attacker who can guess the strings & use them to extract usernames

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

5) Working with DNS Zone Transfers

A

Zone transfer in DNS is used to synchronize server info; contains info that could map the NW

info could fall into wrong hands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

6) Capturing Users Groups

A

extract user accounts from specified groups, storing the results, & determining whether the session accounts are in the group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Windows User Contexts (4)

A

Users are most responsible for controlling access to the system

1) Local Service - user account w/ high than normal access to the local system but only limited access to the NW
2) NW service - A user account w/ normal access to the NW but only limited access to the local system
3) System - A super-user style account that has nearly unlimited access to the local system
4) Current User - The currently logged-in user, who can run applications & tasks but is still subject to restrictions that other users are not subject to. The restrictions on this account hold true even if the user account being used is an Admin account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security Identifiers (SID)

A

Each user account in windows has an SID (S-1-3-43-4993949…) Even though you use a username to access the system, Windows identifies each user, group, or object by the SID. Windows uses the SID to match passwords and check permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

1) TCP 53

A

Used for DNS Zone Transfers; DNS system keeps servers up to date w/ latest Zone data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

2) TCP 135

A

communications between client-server apps, such as Microsoft Outlook to communicate w/ Microsoft Exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

3) TCP 137

A

associated w/ NetBIOS Name Service (NBNS) is designed to provide name resolution services involving the NetBIOS protocol;

The service allows NetBIOS to associate names & IP addresses of individuals systems & services; This service is a natural & easy target for many attackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

4) TCP 139

A

NetBIOS Session Service, aka SMB over NetBIOS; management of connections between NetBIOS-enabled clients & apps; service is used by NetBIOS to establish connections & tear them down when they are no longer needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

5) TCP 445

A

SMB over TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

6) UDP 161 and 162

A

SNMP is a protocol used to manage & monitor NW devices & hosts; The protocol is designed to facilitate messsaging, monitoring, auditing, & other capabilities;

Listening takes place on 161 & traps are received on 162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

7) TCP/UDP 389

A

LDAP (Lightweight Directory Access Protocol) is used by many apps; Two of the most common are Active Directory & Exchange;

Used to exchange info beetween two parties; If this port is open, that means one of these or a similar product is present

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

8) TCP/UDP 3368

A

Global Catalog Service associated w/ AD;

service used to locate information within AD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

9) TCP 25

A

SMTP (Simple Mail Transfer Protocol) is used for the transmission of messages in the form of e-mail across NWs.

17
Q

Null Sessions

A

allows clients of a connection to access certain types of info across the NW; it is something that occurs when a connection is made w/ out credentials being provided

Connection can only be made at a special location called the interprocess communication (IPC), an administrative share;

Info obtained:

  • List of users & groups
  • List of machines
  • List of shares
  • Users & host SIDs

The NULL session allows access to a system using a special account called a NULL user; can be used to reveal info while not requiring username or PW

18
Q

SNMP

A

app layer protocol functions using UDP; used in mgmt of devices such as routers, hubs, swtiches, etc; It comes in 3 versions; main requirement is the NW is running TCP/IP protocol

SNMPv1 - introduced a standardized protocol managing NW devices; does not include any security measures

SNMPv2 - backwards compatible w/ SNMPv1, offered security features

SNMPv3 - latest; increased emphasis on security in two areas:

  1) Authentication - ensure traps are read by only the intended recipient
  2) Privacy - encrypts the payload of the SNMP msg to ensure it cannot be read by unauthorized users
19
Q

Management Information Base (MIB)

A

DB containing descriptions of NW objects that can be managed through SNMP; it is the collection of hierarchically organized information;

MIB elements are recognized by object identifiers (OID); Each OID begins w/ the root of the MIB tree;

20
Q

What do Object Identifiers include?

A

object’s type (counter, string, address), access level (r, r/w), size restrictions, range info

21
Q

SNMP passwords (attackers can take adv of default PWs here)

SNMP protocol tends to contain 2 passwords:

A

SNMP protocol tends to contain 2 passwords used to both configure and read the info from an agent:
1) Read community String - configuration of the device or system can be viewed w/ the help of this PW; These strings are public

2) Read/write community string - configuration on the device can be viewed and changed using this PW; These strings are private
tools: SNScan

22
Q

LDAP

A

Lightweight Directory Access Protocol - used to query and organize DBs

23
Q

NTP port #

A

protocol used to synchronize the clocks across hosts on a NW; important b/c directory services rely on clock settings for logon purposes

uses UDP Port 123 for communication purposes

24
Q

SMTP

A

protocol used to send messages between servers that send & receive e-mail

25
Q

SMTP Relay

A

lets users send emails through external servers;

spammers & hackers can use email server to send spam/malware through email

26
Q

MIB Tabular objects

A

2) Tabular objects define groups of related object instances

27
Q

MIB Scalar Objects

A

1) Scalar Objects define a single object instance

28
Q

Windows User Group

Anonymous Logon

A

1) Anonymous Logon Designed - to allow anonymous access to resources; typically used when accessing a web server or web applications

29
Q

Windows User Group

Batch

A

2) Batch - used to allow batch jobs to run schedule tasks, such as a nightly cleanup job that deletes temporary files

30
Q

Windows User Group

Creator Group

A

3) Creator Group - Windows 2000 uses this group to automatically grant access permissions to users who are members of the same group(s) as the creator of a file

31
Q

Windows User Group

Creator Owner

A

4) Creator Owner - the person who created the file is a member of this group. Windows 2000 & later uses this group to automatically grant access permissions to the creator of the file

32
Q

Windows User Group

Everyone

A

5) Everyone - All users are members of this group; This group is used to give wide access to a system resource

33
Q

Windows User Group

Interactive

A

6) Interactive - any user logged on to the local system has the Interactive identity, which allows only local users to access a resource

34
Q

Windows User Group

Network

A

7) Network - Any user accessing the system through a NW has the NW identity, which allows only remote users to access a resource

35
Q

Windows User Group

Restricted

A

8) Restricted Users & computers with restricted capabilities have the restricted identity. On a member server or workstation, a local user who is a member of the Users group (rather than the Power Users group) has this identity.

36
Q

Windows User Group

Self

A

9) Self- refers to the object & allows the object to modify itself

37
Q

Windows User Group

Service

A

10) Service - any service accessing the system has the Service identity, which grants access to processes run

38
Q

Windows User Group

System

A

11) System - The OS has the System identity, which is used when the OS needs to perform a system-level function

39
Q

Windows User Group

Terminal Server User

A

12) Terminal Server User - allows Terminal Server users to access Terminal Server applications & to perform other necessary tasks w/ terminal services

my CEH - Certified Ethical Hacker (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions