Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

OSCP > Chapter 7: Active Information Gathering > Flashcards

Chapter 7: Active Information Gathering Flashcards

1
Q

What does DNS stand for?

A

Domain Name System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the DNS and what does it do?

A

A distributed database responsible for responsible for translating user-friendly domain names into IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Explain the process that goes on behind the scenes when a domain name is entered into a web browser.

A

Hostname sent to OS’s DNS client which passes it to an external DNS server known as the DNS recursor.

This server interacts with all the DNS infrastructure. The recursor contacts a server in the root zone, which then returns a TLD (top level domain), usually a .com

Once the recursor receives the TLD, it queries it and looks for the nameserver which contains the DNS records. There are two types - the forward lookup zone which finds IP address to a specific domain name and the reverse lookup zone which looks for domain names matches to an IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In terms of DNS records, what does NS stand for?

A

Name server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What do the nameserver records do?

A

Contain the name of the authoritative servers hosting the DNS records for a domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In terms of DNS records, what does A stand for?

A

A stands for the host record.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does the host record do?

A

It contains the IP address for a given domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In terms of DNS records, what does MX stand for?

A

MX stands for mail exchange.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What do mail exchange records do?

A

Contain the names of the servers responsible for handling email for the domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In terms of DNS records, what does CNAME stand for?

A

CNAME stands for Canonical Name Records and are used to create alias for other records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In terms of DNS records what does TXT stand for?

A

Text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What do the Text records do?

A

Contain arbitary data and can be used for various purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a forward look up?

A

A forward look up is searching for an IP address based on a specific hostname.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a reverse look up?

A

A reverse look up is searching for a host name based on a specific IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a DNS Zone Transfer?

A

A database replication between related DNS servers. The zone file is copied from the master server to a slave server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does a zone file contain?

A

All DNS names configured for that zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the command for performing a DNS zone transfer?

A

host -l

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What service is usually running on port 80?

A

http service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What service is usually running on port 443?

A

SSL/TLS encrypted web service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What nmap command will scan for the top 1000 ports and nothing else?

A

nmap

21
Q

What simple nmap command will scan for all ports?

A

nmap -p-

22
Q

In nmap, what does the -sC switch do?

A

All scripts

23
Q

In nmap, what does the -sV switch do?

A

Enumerate versions

24
Q

In nmap, what does the -sU switch do?

A

Scans for open UDP ports

25
Q

In nmap, what does the -oA switch do?

A

Output all formats

26
Q

In nmap, what does -sS do?

A

A SYN scan. This scan fails to complete the third part of the three way handshake present in the TCP protocol.

This results in a faster and more efficient scan.

27
Q

In nmap, what does the -O switch do?

A

Fingerprint - determining the Operating Systems version.

28
Q

In nmap, what does the -A switch do?

A

Runs service enumeration and operating system enumeration scripts.

29
Q

What is the file path of the NSE scripts?

A

/usr/share/nmap/scripts

30
Q

What does SMB stand for?

A

Server Message Block

31
Q

What port does NetBIOS listen on?

A

Port 139 and several UDP ports

32
Q

What port does SMB listen on?

A

Port 445

33
Q

What is the difference between SMB and NetBIOS?

A

SMB is a file sharing protocol while NetBIOS is an older transport layer protocol designed to allow Windows computers to talk to each other on a local network.

34
Q

What does NFS stand for?

A

Network File System

35
Q

What is NFS?

A

NFS is a distributed file system protocol. It allows a user to access files over a computer network as if they were on locally mounted storage.

36
Q

What services are associated with NFS shares?

A

rpcbind and portmapper

37
Q

What port are NFS share found on?

A

Port 111

38
Q

How do we enumerate NFS shares using nmap?

A

nmap -p 111 –script nfs*

39
Q

On NFS shares, once we’ve found the mounting point, how do we mount?

A

Make a directory identical to the mount directory.

Use the command:
sudo mount -o nolock 10.11.1.72:/home ~/home/

40
Q

What does SMTP stand for?

A

Simple Mail Transport Protocol

41
Q

What command in SMTP verifies whether a user account exists?

A

VRFY

42
Q

What command in SMTP checks the membership of a mailing list?

A

EXPN

43
Q

What does SNMP stand for?

A

Simple Network Management Protocol

44
Q

What protocol does SNMP use?

A

UDP

45
Q

What is one flaw in the SNMP protocol?

A

It fails to use any sort of traffic encryption with versions 1, 2 and 2c.

46
Q

What is the SNMP MIB tree?

A

A database containing information related to network management within the SNMP protocol. The database is organised like a tree and the final endpoints (leaves of the tree) have specific variable values which can be accessed and probed by an external user.

47
Q

What port does SNMP use?

A

Port 161

48
Q

When scanning for SNMP, what protocol must be use?

A

UDP. We use -sU to ensure we pick it up.

OSCP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions