Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Spring 2019 > CSCI 427 Exam 2 > Flashcards

CSCI 427 Exam 2 Flashcards

1
Q

what are the goals of enumeration?

A

extracting information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

groups can be nested – why is this bad?

A

accidentally escalate privileges of others without intended to by nesting (ex: putting “everyone” under “admin”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is SID?

A

Security Identifier; a string number assigned by the OS to uniquely identify a user, group, or computer object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SIDs are unique and never reused (true/false)

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SIDs allow usernames and group names to be changed without changing their assigned permissions because ?

A

the SID never changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is SAM?

A

Security Accounts Manager; service that contains and manages all usernames and passwords for accounts on the local system; integrated with the Registry database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

passwords in SAM are stored in ? hash format – this is what a ? returns

A

NTLM (NT Lan Manager); hashdump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

how can you distinguish the administrator SID?

A

it ends in 500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is NTLM?

A

NT Lan Manager hash format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

is NTLM considered secure?

A

no; considered weak and easily cracked with brute-force; applies to local user accounts, not to Windows domain accounts using Active Directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

UID

A

user ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

GID

A

group ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is stored in the Linux file /etc/passwd

A

keeps the user account and password information; holds the majority of information about accounts on the Unix system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is stored in the Linux file /etc/shadow

A

holds the encrypted password of the corresponding account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what is stored in the Linux file /etc/group

A

contains the group information for each account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is stored in the Linux file /etc/gshadow

A

contains secure group account information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is a null session?

A

occurs when a connection is made to a system without credentials being provided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

how to connect to a null session from a Windows computer

A

net use \targetNameOrIP\ipc$ “” “/user:”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

how to connect to a null session from a Linux computer

A

rpcclient -U “” < targetIP >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is an SSID?

A

Service Set Identifier; wireless network’s name; continually broadcast by the wireless router or access point and is used by clients to identify and connect to the wireless network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is a BSSID?

A

Basic Service Set Identification; the MAC address of an access point; wireless does not work if this is turned off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what is WEP?

A

Wired Equivalent Privacy; oldest and weakest wireless encryption; easy to break

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what is WPA?

A

WiFi Protected Access; intended to replace WEP, but was also found to be easily cracked; encryption algorithm is TKIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what is WPA2?

A

successor to WPA and uses much stronger encryption in form of AES (dependent on password strength in the case of personal use)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what is 802.1x?

A

Enterprise WPA/WPA2 802.1x is more secure than WPA/WPA2 Personal; clients receive unique encryption keys and the keys are automatically updated at regular intervals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what is PEAP?

A

Protected Extensible Authentication Protocol; facilitates secure communication between client and RADIUS backend during authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what is RADIUS?

A

Remote Authentication Dial-In User Service; used as the backend authentication method for 802.1x wireless standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

enables monitor mode and allows filtering for particular wireless traffic

A

airmon-ng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

component used for capturing 802.11 packets; sniffs traffic from SSIDs

A

airodump-ng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

used to target a particular device; used to force clients to reconnect and send 4-way handshake; sends out a signal to your target to say they need to reconnect to the AP; during the reconnection process, airmon-ng can capture the pre-shared key

A

aireplay-ng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

component of the suite used for actual wireless PSK cracking; decryption

A

aircrack-ng

32
Q

what is monitor mode?

A

never actually connects to the access point; all it does is listen to traffic/radio waves

33
Q

what is the Pixie Dust attack?

A

attack exploiting WPS pins built into the firmware of home routers; used to force the router into dumping WPA/WPA2 credentials

34
Q

what is a token?

A

a supplemental identifier that is unique per client, essentially to verify that HTTP requests are coming from a particular client

35
Q

what are other terms used interchangeably for “token”?

A

cookie, session ID

36
Q

cookies

A

saved to the client’s browser; manually deleting the cookie creates a new session; have an expiration date, after which a new cookie is generated

37
Q

session ID

A

stored on the server side (in the URL or hidden field on the webpage)

38
Q

pros of cookies

A

automatically persisted for each page request, remains valid even if the site is left or browser closed

39
Q

cons of cookies

A

vulnerable to XSS attacks, only one active session per browser

40
Q

pros of session ID

A

possible to have multiple sessions across tabs, works even if cookies are disabled by the client

41
Q

cons of session ID stored in URL

A

lost once you leave the website, sent in the referrer from the HTTP resource, could be stored in cache or logs

42
Q

cons of session ID stores in hidden field (outdated and rarely used – not so important to know)

A

lost once you leave the website, every request needs to be a HTTP POST, so SID is lost on every GET; because it requires a POST, the page cannot use embedded media such as images or video

43
Q

reflected cross-site scripting (XSS) attack

A

requires getting the victim to follow a link that either has a malicious script injected in the link itself or embedded in the page it links to

44
Q

steps of a reflected XSS attack (SHORT ANSWER)

A
  1. Attacker creates and socializes malicious URL with XSS to client/victim
  2. Client/victim sends an authenticated request with XSS payload to the server
  3. Site embeds request to attacker with cookies
  4. Browser makes request with session ID
45
Q

? is the name of the document object in javascript that stores a cookie

A

document.cookie

46
Q

ELMAH

A

Error Log Modules and Handlers; tool for ASP.net web services; infamous for having unsecured web-facing log interface; simply browsing to the ELMAH URL (someSiteName.com/elmah) and drilling into the error log details will reveal the session ID

47
Q

what is the HTTP referer field used for?

A

identifies the web page from which a link was clicked (problematic because session ID in link)

48
Q

session fixation attack

A

type of attack where the attacker generates a pre-made, unauthenticated session ID for the victim, then tricks the victim into using the pre-made session ID to authenticate

49
Q

prevent a session fixation attack by

A

changing session IDs once a user has authenticated

50
Q

know 3 of the 6 tips for mitigating the risk of session hijacking attacks

A
  1. Strong session IDs (randomly generate, don’t program yourself)
  2. Do not persist session IDs in the URL
  3. Don’t reuse session IDs for authentication (instead, either transfer the session ID to a new ID after authentication or use an authCookie post-login in addition to the session ID cookie)
  4. Flag session ID in HTTP responses from the web app as HTTP Only
  5. Flag session ID as secure to prevent pages with both HTTPS and HTTP content from exposing the session ID in GET requests for the HTTP content
  6. Force user to re-authenticate before certain key actions
51
Q

what constitutes untrusted data?

A

integrity not verifiable, intent may be malicious, data may include payloads (SQL injection, XSS, binaries with malware)

52
Q

common sources of untrusted data

A

the user (URL via a query string or route, posted via form), browser (cookies, request headers), other (external sources, your own database)

53
Q

when considering input sanitization, which has a lower risk, a blacklist or whitelist? why?

A

whitelist because you explicitly accept only approved characters, so it is more comprehensive

54
Q

easiest way to execute a reflected XSS attack

A

manipulating parameters in URL query string

55
Q

common feature of server responses (such as a search result) that serves as a potential vector for XSS attacks

A

response reflects back what you type in to the browser, thus back to the client (“you searched for…”)

56
Q

how does output encoding help reduce the risk of XSS attacks?

A

make sure user input gets to screen as it was entered, does not allow into markup; translate icon -> encoding (ex: < would be <) – this way, data cannot break out of data context into markup content

57
Q

why is it important to perform output encoding in the proper context for each occurrence of the output?

A

output encoding has to appear a certain way depending on where you are in the code (HTML, CSS, script)

58
Q

what is the difference between a reflected XSS attack and a persistent XSS attack?

A

persistent has been uploaded into the website’s database (ex: a comment on a post)

59
Q

what is an auth cookie?

A

a cookie that persists an authenticated state (identifies and authorizes the user)

60
Q

what is the central idea behind any cross site attack?

A

want the user to do something on your behalf without them knowing they are doing it

61
Q

how does an anti-forgery token work?

A

when a user requests a page with a form, the resultant page contains a token in a hidden field and one in a cookie (these are paired when issued and keyed to the current user); then, the browser sends back the hidden form token and the cookie, and the website checks if the tokens are a valid pair for the user

62
Q

how does an anti-forgery token prevent a CSRF (cross site forgery request) attack?

A

adds randomness to the request pattern (something the attacker can’t reproduce or guess at)

63
Q

what header is used to prevent clickjacking attacks?

A

X-Frame-Options Header (want to allow frames? no)

64
Q

3 main ways to protect against XSS and CSRF

A

input sanitization, context sensitive output encoding, anti-forgery token

65
Q

what types of information can be extracted through enumeration?

A

usernames and groups, machine names, file shares, routing tables, Simple Network Management Protocol strings, DNS details, etc.

66
Q

the Linux version of a SID (security identifier) is a

A

UID

67
Q

system SID starts with

A

S-1-5-18

68
Q

local service SID starts with

A

S-1-5-19

69
Q

network service SID starts with

A

S-1-5-20

70
Q

non-service or system accounts always start with

A

S-1-5-21

71
Q

guest SID ends in

A

501

72
Q

null sessions can only be made to a special location called the

A

interprocess communication (IPC) share

73
Q

when we talk about SSID and BSSID, we are working with Layer ? of the OSI model

A

2 (data link)

74
Q

Enterprise WPA/WPA2 802.1x requires two components

A
  1. the authentication protocol

2. backend authentication service

75
Q

PEAP is the (front/back) end of 802.1x

A

front

76
Q

RADIUS is the (front/back) end of 802.1x

A

back

Spring 2019 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions