cysa Flashcards
Port 20/21
FTP
Port 22
SSH
Port 23
Telnet
Port 25
SMTP
Port 53
DNS (UDP AND TCP)
Port 67/68
DHCPs
Port 69
TFTP (UDP)
Port 80
HTTP
Port 110
POP3 (mail receiving protocol)
Port 111
RPCBind (Linux)
Port 123
NTP
Port 135
MSRPC
Port 137
Netbios nameservicing
Port 138
Netbios Datagram
Port 139
Netbios SNN
Port 143
Imap4 (email server protocol)
Port 161/162
SNMP
Port 389
LDAP
Port 443
HTTPS
Port 445
Windows file sharing (SMB and MDS AD)
Port 500
ISAK (TCP rules for the internet)
Port 514 UDP
Syslog mostly for linux
Port 515
Printing LPD
Port 520
RIP (routing protocol like ospf but uses less memory)
Port 631
Printing (always TCP for print service ports)
Port 636
LDAPs
Port 993
IMAPs
Port 995
POP3s
Port 1433
SQL
Port 1434
SQL (UDP)
Port 1521
Oracle
Port 1720
H.323 (VoIP and telephony)
Port 1723 and 1194
PPTP and openVPN (both vpn protocols) PPTP no longer considered very secure
Port 3306
MySQL
Port 3389
RDP
Port 4500
NAT
Port 5900
VNC
NMAP -sS
(TCP SYN Scan):
This flag initiates a TCP SYN scan, also known as a half-open scan. It sends SYN packets to target ports and analyzes the response to determine whether the port is open, closed, or filtered. Slightly faster than -sT.
Nmap -sT
(TCP Connect Scan):
The TCP Connect Scan is a full (open) three-way handshake scan. It connects to the target port and waits for a response to determine if the port is open.
nmap -sU
(UDP Scan):
This flag performs a UDP scan, which is used to identify open UDP ports. UDP scans are generally slower and more challenging than TCP scans due to the stateless nature of UDP.
nmap -O, -sV, -A
-O is OS detection
-sV is (Version Detection):
This flag attempts to determine the version and service information of open ports by comparing responses to known service fingerprints. It can help identify vulnerable software versions.
the -A flag combines these two
nmap –script
(Scripting Engine):
The –script flag allows you to run Nmap scripts against the target. These scripts can perform various tasks, such as vulnerability scanning, service discovery, and more. For example, you might use –script vuln to run vulnerability scripts.
nmap oN, -oX, -oG
(Output Formats):
These flags allow you to specify different output formats for Nmap results. -oN saves results to a normal text file, -oX saves results in XML format, and -oG generates a grepable output format.
nmap -p
(Port Specification):
Use the -p flag to specify which ports you want to scan. You can define a single port, a range of ports, or even use a comma-separated list of ports.
nmap -T
(Timing Template):
The -T flag controls the timing template for the scan. Options range from 0 (paranoid) to 5 (insane). Faster timing templates can increase the speed of the scan but might be more likely to trigger intrusion detection systems.
nmap -v -vv
(Verbose Output):
The -v flag provides verbose output, displaying additional information about the scan process. -vv increases the level of verbosity.
nmap -Pn
(No Ping):
Use the -Pn flag to skip the host discovery phase and assume that the target host is online. This is useful when you want to scan hosts that might not respond to ping requests.
What is banner grabbing, and what are the common services and protocols used for it?
Banner Grabbing is the term used to refer to the technique of grabbing information of a system available on a certain network and all the services running on its open ports. The Administrator can use this technique totally or take inventory of the system and its services on their available network. Banner hacking is often applicable for performing white hat hacking endeavors as well as for grey hacking. (HTTP, FTP, and SMTP)
Telnet, Wget, cURL, Nmap, NetCat, ASR
Describe the CVSS Parameters and what they mean
CVSS:3.0/AV:/AC:/PR:/UI:/S:/C:/I:/A:
Attack Vector
Attack Complexity
Privilege Required
User Interaction
Scope
Confidentiality
Integrity
Availablity
Scores:
0.1-3.9 Low
4.0-6.9 Medium
7.0-8.9 High
9.0-10 Critical
What is Pof v3?
It is a passive scanning tool that looks at tcp traffic. Can identify OS quickly, measure system uptime, automate detection of connection sharing, and detect clients and servers that make declaritive statements. Zeek is another similar tool.
What is footprinting?
Discovering the layout of the network. Subnets, routing, protocols, etc. Can be an IoC
What is fingerprinting?
Discovering what specifically is running on a host. Open ports, OS, apps. Can be an IoC
nmap -sn
No port scanning, essentially a ping sweep
nmap -D (or -sI)
Decoy or zombie (idle) scans. Stealth scan where a decoy appears to do scan in order to hide source identity. A way to bypass threat prevention/detection.
nmap -S
Spoof address to bypass firewall
nmap -f
fragment packets to bypass firewall. Can be used for DDoS. Not as frequently used.
Nmap port states
Open
Closed
Filtered (port cant be probed, usually fw)
Unfiltered (uncertain, but reachable)
Open| Filtered (UDP scans)
Closed | Filtered (decoy scans)
Also, NMAP uses CPE (for exam)
What is hping and its common flags?
Hping is a TCP/IP packet assembler and analyzer. It receives IP data, de-packets that data, and moves it to the linked device in the reverse order. It works on systems such as Linus, Solaris, macOS, and Windows.
-Transmit. You will send an Internet Control Message Protocol (ICMP) echo request.
-Wait. The target for your ping should return your message.
-Analyze. You’ll get a great deal of data, including information about how many bytes were sent, how many arrived, and how long the trip took.
-Repeat. You’ll go through this process a few times, just to ensure the connection remains consistent.
-c (Count):
This flag specifies the number of packets to send before stopping. For example, -c 5 will send 5 packets and then stop.
-S (TCP SYN scan):
This flag initiates a TCP SYN scan, similar to the -sS flag in Nmap. It sends TCP SYN packets to target ports to determine if they are open.
-P (ICMP Echo Request):
The -P flag sends ICMP Echo Request packets to the target. It’s used for basic connectivity testing, similar to the ping command.
-p (Specify Port):
Use this flag to specify the port number to target. For example, -p 80 will target port 80.
-i (Interface):
If you have multiple network interfaces, you can use this flag to specify which interface to use for sending packets.
–traceroute (Traceroute Mode):
This flag enables traceroute mode, where hping sends packets with increasing Time to Live (TTL) values to identify the route taken to reach the target.
-s (Source IP):
You can set the source IP address using this flag. This can be useful for spoofing the source IP for testing purposes.
-a (Set Acknowledgment Number):
This flag allows you to set a specific acknowledgment number in TCP packets. This can be useful for certain types of testing and analysis.
What is Responder and what is it used for?
MiTM tool, used to detect LLMNR attacks (ex, DNS failure)
Used for poisoning LLMNR, NBT-NS, and MDNS
What are the 3 NIST categories for controls? 800-53
- Technical Or Logical: WAFs, IDS, IPS, DB firewall (technical), Authorization, authentication (logical)
- Operational Controls: Also known as administrative controls. Training, Sec guards, people. Act of emergency/disaster planning is operational control.
- Management: High level overview of sec systems. IE legislation, documentation, or info that helps decide controls. The act of planning, is a management control.
What are the 6 security control goals?
- Preventative. IE Firewalls
- Detective. Provide notification and alerting during attack.
- Corrective. After the attack, actions on restoring operations. Patching.
- Physical controls
- Deterrent. Discourages attacks (warning signs, sec guards, etc)
- Compensating. (substitution)
What are the methods for evaluating security controls?
- Quality control
- Verification (does it work)
- Validation (does it do the intended job)
- Assessments
- Evaluation
Port 49
TACACS+ (router/nas authentication)
Port 88
Kerberos
1701
L2TP (layer 2 tunneling for VPNs)
Is Trend analysis proactive/reactive and what is a drawback? Give examples of solutions.
Proactive, and it is very time consuming and resource intensive.
Examples of tool is SIEMs
What are some risks to asset changes and associated pre-cautions?
Downtime, Degraded functionality, increased attack surface, Reactive changes (as opposed to planned), rollback steps, testing/sandbox steps
Briefly describe waterfall sdlc
Difficult to implement, and only works if perfectly implemented. You can only advance to subsequent steps once the current step is FULLY completed. Major code changes will be very difficult to implement
Briefly describe the agile sdlc
More of a “way of life”. Teamwork, flexible, realistic, big picture focused. Not great for complexity or when goals need perfect clarity. It is welcome to change. Sprints.
Briefly describe the Iterative sdlc
Good for projects that need well defined requirements. More flexible with functionality added at a later date. Progress is easily measured. However needs more resources and not great for small projects.
Briefly describe the Spiral sdlc
Good for rapidly changing requirements. Smaller iterations, smaller risk. However harder to manage an there are a lot of phases. No linear path.
Briefly discuss Information Asset Value and how it is determined?
The non financial value of data or IT assets. The equation is TAV = AV * Weight of asset (CIA very important here)
What is the vulnerability score range? Briefly describe
1 (lowest) to 5 (highest)
Typically only 3 and above require remediation
Describe the following acronyms:
SLA, MOU, DRP, BIA
Service Level Agreement - contract that determines acceptable uptime/performance
Memorandum of Understanding
Similar to SLA, often a contract between company and outside vendor that does scanning
Disaster recovery plan - Self explanatory, but not needed for scanning agreements
Business Impact Assessments - Also not necessary for scanning agreements. Formalized methods for allowing companies to do their risk assessments (qualitative and quantitative)
When coding a web application, what method is more secure than using direct system calls when traversing different systems/apps from the current web application?
APIs
To avoid race conditions, what is an appropriate method to include? What are race conditions?
Locking (or locking mechanisms)
Race conditions are bugs that can be exploited when two processes attempt to access the same resource at the same time. One of them will usually try to change the resource.
Dirty Cow is a common vuln.
These also are fixes for TOU/TOC issues
What is buffer overflow, what types are there, and what is a mechanism to prevent it?
Using bad functions or code (such as the strcpy which does not do bounds checking), more data is placed into the buffer than the buffer can handle. Bounds checking, ASLR, DEP, and stack canary prevent this.
Stack based. When a user-supplied buffer is stored on the stack section of memory. (function and variable data)
Heap-based. When a user supplied buffer is stored on the heap data area of memory. (Non variable files loaded in memory) if exam asks about mallac function, this is heap.
Integer based (self explanatory).
printf , sprintf , strcat , strcpy , and gets
What is NIST?
(US) National Institute of Standards and Technology
Provides recommendations and standards for cybersecurity. Provides tool recommendations as well.
