Chapter 6 - Web-Based Hacking: Servers & Apps Flashcards
1
Q
IETF
A
Internet Engineering Task Force - Creates engineering documents to help make the internet work better
2
Q
W3C
A
World Wide Web Consortium - A standards-developing community
3
Q
OWASP
A
Open Web Application Security Project - Organization focused on improving the security of software.
4
Q
Web Server attack Methodology
A
Information Gathering (Whois), Footprinting (banner grab), Website mirroring, Vulnerability Scanning, Session Hijacking, Password Cracking
5
Q
Banner Grab
A
Method for web server footprinting
6
Q
Netcraft
A
Web server footprinting tool
7
Q
HTTPRecon
A
Web server footprinting tool
8
Q
ID Serve
A
Web server footprinting tool
9
Q
nmap
A
Powerful footprinting tool
10
Q
nmap -script http-trace -p80 localhost.
A
Detects vulnerable TRACE method
11
Q
nmap -script http-google-email
A
Lists email addresses
12
Q
nmap -script hostmap-*
A
Discovers virtual hosts on the IP address you are tryingto footprint; * is replaced by online database
13
Q
nmap -script http-enum -p80
A
enumerates common web apps
14
Q
nmap -p80 -script http-robots.txt
A
Grabs the robots.txt file
15
Q
Nikto
A
Vulnerability scanner specifically suited for web servers
16
Q
Wget
A
Website mirroring tool
17
Q
Black Widow
A
Website mirroring tool
18
Q
HTTrack
A
Website mirroring tool
19
Q
WebCopier Pro
A
Website mirroring tool
20
Q
Web Ripper
A
Website mirroring tool
21
Q
SurfOffline
A
Website mirroring tool
22
Q
HTTPrint
A
Website mirroring tool
23
Q
What is N-Tier Architecture?
A
Distributes processes across multiple servers; normally as three tier: Presentation (web), logic (application), and data (database)
24
Q
What is WebGoat
A
Project maintained by OWASP which is an insecure web app meant to be tested.
25
Http request: GET
retrieves whatever information is in the URL; sending data is done in URL
26
Http Request: HEAD
identical to get except for no body in return
27
Http Request: POST
sends data ia body - data not shown in URL or in history
28
Http Request: PUT
Requests data be stored at the URL
29
Http Request: DELETE
Requests origin server delete resource
30
Http Request: TRACE
Requests application layer loopback of message
31
Http Request: CONNECT
Reserved for use with proxy (Post and Get can be manipulated by proxy)
32
HTTP Error: 1xx
Informational - request received, continuing
33
HTTP Error: 2xx
Success - Action received, understood and accepted
34
HTTP Error: 3xx
Redirection - Further action must be taken
35
HTTP Error 4xx
Client Error - Request contains bad syntax or cannot be fulfilled
36
HTTP Error 5xx
Server Error.- server failed to fulfill an apparently valid request
37
Web Server Attack: DNS Amplification
Uses recursive DNS to DoS a target; Amplifies DNS answers to target until it can't do anything.
38
Web Server Attack: Directory Transversal
requests file that should not e accessible from web server. Example: http://www.example.com/etc/passwd
39
Web Server Attack: Parameter Tampering (URL Tampering)
Manipulating parameters within URL to achieve escalation or other changes.
40
Web Server Attack: Hidden Field Tampering
Modifying hidden form fields producting unintended results (Example: Look at source code and change price of item to $0.00
41
Web Server Attack: Web Cache Poisoning
Replacing the cache on a box with a malicious version of it
42
Web Server Attack: Misconfiguration Attack
Same as before - improper configuration of a web server
43
Web Server Attack: Password Attack
Attempting to crack passwords related to web resources
44
Web Server Attack: Connection String Parameter Pollution
Injection attack that uses semicolons to take advantage of databases that use this separation method.
45
Web Server Attack: Web Defacement
Simply modifying a web page to say something else
46
Brutus
Tool for attacking web server. Brute force passwords of HTTP
47
Hydra
Network login cracker
48
WFETCH
Microsoft tool that allows you to craft HTTP requests ot see response data (BURP does this too)
49
Shellshock
Causes Bash to unintentionally execute commands when commands are concatenated on the end of function definitions.
50
Web App Attacks - Tools for identifying entry points
WebScarab, HTTPPrint, BurpSuite
51
What is "Web 2.0"
Dynamic web application; have a larger attack surface due to simultaneous communication
52
Web App Attack: File Injection
Attacker injects a pointer in a web form to an exploit hosted elsewhere
53
Web App Attack: Command Injection
Attacker gains shell access using Java or similar
54
Web App Attack: LDAP Injection
Exploits applications that construct LDAP statements. Format is )(&)
55
Web App Attack: SOAP Injection
Simple Object Access Protocol - Can inject query strings in order to bypass authentication. Uses XML to format info. Compatible with HTTP and SMTP. Messages are typically "one way" in nature.
56
Buffer Overflow (Smashing the Stack)
Attempts to write data into an application's buffer area to overwrite adjacent memory, execute code or crash a system
57
What is a canarie?
Used to monitor for buffer overflow attacks. Placed between buffer and control data.
58
Ways to prevent buffer overflow
Secure coding techniques, Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP)
59
Cross-Site Scritping (XSS)
Inputting JavaScript into a web form that alters what the page does. Can be passed via URL: www.google.com/. Can access cookies and send to remote host.
60
Stored XSS (Persistent)
Stores the XSS in a forum or comment field of some sort for multiple people to access.
61
Cross-Site Request Forgery (CSRF)
Forces an end user to execute unwanted actions on an app they're already authenticated on. Inherits identity and privileges of victim to perform an undesired function on victim's behalf. Captures session and sends a request based off logged in user's credentials.
62
Session Fixation
Attacker logs into a legitimate site and pulls a session ID; sends link with session ID to victim. Once victim logs in, attacker can now log in and run with user's credentials.
63
What does the following expression accomplish: 'OR 1=1 --
Tells the server if 1=1 (always true) to allow login. The Double-Dash (-) tells server to ignore rest of the query (usually the password)
64
Fuzzing
Inputting random data into a target in order to see what will happen.
65
Tautology
using always true statements to test SQL
66
In-band SQL injection
Uses same communication channel to perform attack. Most common, used with UNION statements.
67
Out-of-Band SQL Injection
Contrary to in-band, this type of SQL injection uses different communication channels for the attack and results. It's also more difficult to do.
68
Blind SQL Injection (inferrential)
Occurs when attacker knows the database is susceptible to injection, but error messages and screen returns don’t come back to attacker.
69
SQL Injection Tools
Sqlmap, sqlninja, Havij, SQLBrute, Pangolin, SQLExec, Absinthe, BobCat
70
HTTP Response Splitting
adds header response data to an input field so server splits the response.
71
Countermeasure for web app attacks
Input scrubing for injection, SQL parameterized queries, patching servers, turning off unnecessary services, ports, and protocols.
72
Modulation type: OFDM
Orthogonal Frequency-Division Multiplexing (OFDM) - carries waves in various channels (think cable tv)
73
Modulation type: DSSS
Direct-Sequence Spread Spectrum (DSSS) - Combines all available waveforms into a single purpose.
74
802.11 Series
Defines the standards for wireless networks
75
DNS Record Type: SRV
Service - this record defines the hostname and port number of servers providing specific services, such as a Directory Services server.
76
DNS Record Type: SOA
Start of Authority - This record identifies the primary name server for the zone. The SOA record contains the hostname of the server responsible for all DNS records within the namespace, as well as the basic properties of the domain.
77
DNS Record Type: PTR
Pointer - This maps an IP address to a hostname (providing for reverse DNS lookups). Usually associated with e-mail server records.
78
DNS Record Type: NS
Name Server - This record defines the name servers within your namespace. These servers are the ones that respond to your clients' request for name resolution
79
DNS Record Type: MX
Mail Exchange - This record identifies your email servers within your domain.
80
DNS Record Type: CNAME
Canonical Name - This record provides for domain name aliases within your zone. For example, you may have an FTP service and a web service running on the same IP address. CNAME records could be used to list both within DNS for you.
81
DNS Record Type: A
Address - This record maps an IP address to a hostname and is used most often for DNS lookups.
82
802.15.1
Bluetooth Standards
83
802.15.4
Zigbee - Low power, low data rate, close proximity ad-hoc networks
84
802.16
WiMAX - broadband wireless metropolitan area networks. 40 Mbps
85
Wireless Standard - 802.11a
Mbps - 54 Frequency - 5 GHz Modulation Type: OFDM
86
Wireless Standard - 802.11b
Mbps - 11 Frequency - 2.4 GHz Modulation Type: DSSS
87
Wireless Standard - 802.11d
Mbps - Variation of a & b. Frequency - Global Use
88
Wireless Standard - 802.11e
Mbps - QoS Initiative Frequency - Data and Voice
89
Wireless Standard - 802.11g
Mbps - 54 Frequency - 2.4 GHz. Modulation Type: OFDM and DSSS
90
Wireless Standard - 802.11i
Mbps - WPA/WPA2 Encryption
91
Wireless Standard - 802.11n
Mbps - 100+ Frequency: 2.4 - 5. Modulation Type: OFDM
92
Wireless Standard - 802.11ac
Mbps - 1000 Frequency: 5 GHz Modulation Type: QAM
93
Orthogonal Frequency - Division Multiplexing (OFDM)
Carries waves in various channels
94
Direct-Sequence Spread Spectrum (DSSS)
Combines all available waveforms into a single purpose.
95
Basic Service Set Identifier (BSSID)
MAC address of wireless access point.
96
Three types of Authentication are:
Open System - No authentication Shared Key Authentication - authentication through shared key (pw) Centralized Authentication - Authentication through something like RADIUS
97
Assocation vs Authentication
Association is the act of connecting; Authentication is the act of identifying the client.
98
Spectrum Analyzer
Verifies wireless quality, detects rogue access points and detects attacks
99
Directional Antenna
Signals in one direction; Yagi antenna is a type
100
Omnidirectional Antenna
Signals in all directions
101
WEP
Wired Equivalent Privacy - Encryption: RC4. IV Size: 24 bits. Key Length: 40/104. Integrity Check: CRC-32
102
WPA
Wi-Fi Protected Access - Encryption: RC4 + TKIP IV Size: 48 bits. Key Length: 128 bits. Integrity Check: Michael/CRC-32
103
WPA2
Encryption: AES-CCMP IV Size: 48 bits Key Length: 128-bits Integrity Check: CBC-MAC (CCMP)
104
WPA2 Enterprise vs WPA2 Personal
Enterprise: Can tie an EAP or RADIUS server into authentication. Personal: Uses a pre-shared key to authenticate.
105
Message Integrity Code (MIC)
Hashes for CCMP to protect integrity.
106
Cipher Block Chaining Message Authentication Code (CBC-MAC)
Integrity process of WPA2
107
WIGLE
Tool for network discovery that can map for wireless networks
108
NetStumbler
Tool for network discovery
109
Kismet
Wireless packet analyzer/sniffer that can be used for discovery. Works passively and can detect access points.
110
NetSurveyor
Tool for Windows that does network discovery
111
pcap vs libcap
pcap - driver library for Windows libcap - Drivery library for Linux
112
Rogue Access point
Places an access point controlled by an attacker
113
Evil Twin
Rogue AP with a SSID similar to the name of a popular network
114
Honeyspot
Fakinga well known hotspot with a rogue AP
115
Ad Hoc Connection Attack
Connecting directly to another phone via ad-hoc network. User must accept connection
116
Aircrack-ng
Sniffer, detector, traffic analysis tool and password cracker. Uses Dictionary attacks for WPA and WPA2.
117
Cain & Abel
Sniffs packets and cracks passwords. Relies on Statistical measures and the PTW technique to break WEP
118
KisMAC
MacOS tool to brute force WEP or WPA passwords
119
KRACK
Key Installation Attack (KRACK) - Method for cracking WPA. Replay attack that uses third handshake of another device's session.
120
OmniPeek
Provides data like Wireshark in addition to network activity and monitoring.
121
AirMagnet WiFi Analyzer Pro
Sniffer, traffic analyzer and network-auditing suite
122
WiFi Pilot
Wireless sniffer
