Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Spring 2019 > CSCI 427 Exam 2 > Flashcards

CSCI 427 Exam 2 Flashcards

1
Q

what are the goals of enumeration?

A

extracting information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

groups can be nested – why is this bad?

A

accidentally escalate privileges of others without intended to by nesting (ex: putting “everyone” under “admin”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is SID?

A

Security Identifier; a string number assigned by the OS to uniquely identify a user, group, or computer object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SIDs are unique and never reused (true/false)

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SIDs allow usernames and group names to be changed without changing their assigned permissions because ?

A

the SID never changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is SAM?

A

Security Accounts Manager; service that contains and manages all usernames and passwords for accounts on the local system; integrated with the Registry database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

passwords in SAM are stored in ? hash format – this is what a ? returns

A

NTLM (NT Lan Manager); hashdump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

how can you distinguish the administrator SID?

A

it ends in 500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is NTLM?

A

NT Lan Manager hash format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

is NTLM considered secure?

A

no; considered weak and easily cracked with brute-force; applies to local user accounts, not to Windows domain accounts using Active Directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

UID

A

user ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

GID

A

group ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is stored in the Linux file /etc/passwd

A

keeps the user account and password information; holds the majority of information about accounts on the Unix system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is stored in the Linux file /etc/shadow

A

holds the encrypted password of the corresponding account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what is stored in the Linux file /etc/group

A

contains the group information for each account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is stored in the Linux file /etc/gshadow

A

contains secure group account information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is a null session?

A

occurs when a connection is made to a system without credentials being provided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

how to connect to a null session from a Windows computer

A

net use \targetNameOrIP\ipc$ “” “/user:”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

how to connect to a null session from a Linux computer

A

rpcclient -U “” < targetIP >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is an SSID?

A

Service Set Identifier; wireless network’s name; continually broadcast by the wireless router or access point and is used by clients to identify and connect to the wireless network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is a BSSID?

A

Basic Service Set Identification; the MAC address of an access point; wireless does not work if this is turned off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what is WEP?

A

Wired Equivalent Privacy; oldest and weakest wireless encryption; easy to break

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what is WPA?

A

WiFi Protected Access; intended to replace WEP, but was also found to be easily cracked; encryption algorithm is TKIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what is WPA2?

A

successor to WPA and uses much stronger encryption in form of AES (dependent on password strength in the case of personal use)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
what is 802.1x?
Enterprise WPA/WPA2 802.1x is more secure than WPA/WPA2 Personal; clients receive unique encryption keys and the keys are automatically updated at regular intervals
26
what is PEAP?
Protected Extensible Authentication Protocol; facilitates secure communication between client and RADIUS backend during authentication
27
what is RADIUS?
Remote Authentication Dial-In User Service; used as the backend authentication method for 802.1x wireless standard
28
enables monitor mode and allows filtering for particular wireless traffic
airmon-ng
29
component used for capturing 802.11 packets; sniffs traffic from SSIDs
airodump-ng
30
used to target a particular device; used to force clients to reconnect and send 4-way handshake; sends out a signal to your target to say they need to reconnect to the AP; during the reconnection process, airmon-ng can capture the pre-shared key
aireplay-ng
31
component of the suite used for actual wireless PSK cracking; decryption
aircrack-ng
32
what is monitor mode?
never actually connects to the access point; all it does is listen to traffic/radio waves
33
what is the Pixie Dust attack?
attack exploiting WPS pins built into the firmware of home routers; used to force the router into dumping WPA/WPA2 credentials
34
what is a token?
a supplemental identifier that is unique per client, essentially to verify that HTTP requests are coming from a particular client
35
what are other terms used interchangeably for "token"?
cookie, session ID
36
cookies
saved to the client’s browser; manually deleting the cookie creates a new session; have an expiration date, after which a new cookie is generated
37
session ID
stored on the server side (in the URL or hidden field on the webpage)
38
pros of cookies
automatically persisted for each page request, remains valid even if the site is left or browser closed
39
cons of cookies
vulnerable to XSS attacks, *only one active session per browser*
40
pros of session ID
*possible to have multiple sessions across tabs*, works even if cookies are disabled by the client
41
cons of session ID stored in URL
lost once you leave the website, *sent in the referrer from the HTTP resource*, could be stored in cache or logs
42
cons of session ID stores in hidden field (outdated and rarely used -- not so important to know)
lost once you leave the website, every request needs to be a HTTP POST, so SID is lost on every GET; because it requires a POST, the page cannot use embedded media such as images or video
43
reflected cross-site scripting (XSS) attack
requires getting the victim to follow a link that either has a malicious script injected in the link itself or embedded in the page it links to
44
steps of a reflected XSS attack (SHORT ANSWER)
1. Attacker creates and socializes malicious URL with XSS to client/victim 2. Client/victim sends an authenticated request with XSS payload to the server 3. Site embeds request to attacker with cookies 4. Browser makes request with session ID
45
? is the name of the document object in javascript that stores a cookie
document.cookie
46
ELMAH
Error Log Modules and Handlers; tool for ASP.net web services; infamous for having unsecured web-facing log interface; simply browsing to the ELMAH URL (someSiteName.com/elmah) and drilling into the error log details will reveal the session ID
47
what is the HTTP referer field used for?
identifies the web page from which a link was clicked (problematic because session ID in link)
48
session fixation attack
type of attack where the attacker generates a pre-made, unauthenticated session ID for the victim, then tricks the victim into using the pre-made session ID to authenticate
49
prevent a session fixation attack by
changing session IDs once a user has authenticated
50
know 3 of the 6 tips for mitigating the risk of session hijacking attacks
1. Strong session IDs (randomly generate, don’t program yourself) 2. Do not persist session IDs in the URL 3. Don’t reuse session IDs for authentication (instead, either transfer the session ID to a new ID after authentication or use an authCookie post-login in addition to the session ID cookie) 4. Flag session ID in HTTP responses from the web app as HTTP Only 5. Flag session ID as secure to prevent pages with both HTTPS and HTTP content from exposing the session ID in GET requests for the HTTP content 6. Force user to re-authenticate before certain key actions
51
what constitutes untrusted data?
integrity not verifiable, intent may be malicious, data may include payloads (SQL injection, XSS, binaries with malware)
52
common sources of untrusted data
the user (URL via a query string or route, posted via form), browser (cookies, request headers), other (external sources, your own database)
53
when considering input sanitization, which has a lower risk, a blacklist or whitelist? why?
whitelist because you explicitly accept only approved characters, so it is more comprehensive
54
easiest way to execute a reflected XSS attack
manipulating parameters in URL query string
55
common feature of server responses (such as a search result) that serves as a potential vector for XSS attacks
response reflects back what you type in to the browser, thus back to the client (“you searched for…”)
56
how does output encoding help reduce the risk of XSS attacks?
make sure user input gets to screen as it was entered, does not allow into markup; translate icon -> encoding (ex: < would be <) – this way, data cannot break out of data context into markup content
57
why is it important to perform output encoding in the proper context for each occurrence of the output?
output encoding has to appear a certain way depending on where you are in the code (HTML, CSS, script)
58
what is the difference between a reflected XSS attack and a persistent XSS attack?
persistent has been uploaded into the website’s database (ex: a comment on a post)
59
what is an auth cookie?
a cookie that persists an authenticated state (identifies and authorizes the user)
60
what is the central idea behind any cross site attack?
want the user to do something on your behalf without them knowing they are doing it
61
how does an anti-forgery token work?
when a user requests a page with a form, the resultant page contains a token in a hidden field and one in a cookie (these are paired when issued and keyed to the current user); then, the browser sends back the hidden form token and the cookie, and the website checks if the tokens are a valid pair for the user
62
how does an anti-forgery token prevent a CSRF (cross site forgery request) attack?
adds randomness to the request pattern (something the attacker can’t reproduce or guess at)
63
what header is used to prevent clickjacking attacks?
X-Frame-Options Header (want to allow frames? no)
64
3 main ways to protect against XSS and CSRF
input sanitization, context sensitive output encoding, anti-forgery token
65
what types of information can be extracted through enumeration?
usernames and groups, machine names, file shares, routing tables, Simple Network Management Protocol strings, DNS details, etc.
66
the Linux version of a SID (security identifier) is a
UID
67
system SID starts with
S-1-5-18
68
local service SID starts with
S-1-5-19
69
network service SID starts with
S-1-5-20
70
non-service or system accounts always start with
S-1-5-21
71
guest SID ends in
501
72
null sessions can only be made to a special location called the
interprocess communication (IPC) share
73
when we talk about SSID and BSSID, we are working with Layer ? of the OSI model
2 (data link)
74
Enterprise WPA/WPA2 802.1x requires two components
1. the authentication protocol | 2. backend authentication service
75
PEAP is the (front/back) end of 802.1x
front
76
RADIUS is the (front/back) end of 802.1x
back

Spring 2019 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions