Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCT APP Written > Deck C > Flashcards

Deck C Flashcards

1
Q

When does an SQL injection occur

A

When a user-input is used in an SQL query without proper sanitisation or filtering of the input

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the types of SQL Injections

A

In-band. Blind Out-of-band

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are characters to use for testing of SQLi Discovery

A

” # ; )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the 3 types of queries for MySQL fingerprint testing

A

SELECT @@version. SELECT POW(1.1). SELECT SLEEP(5)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the expected output of SELECT @@version if MySQL

A

It will output the current MySQL version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the expected output of SELECT @@version if NOT MySQL

A

In MSSQL it returns MSSQL version. Error with other DBMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the expected output of SELECT POW(1.1) if MySQL

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the expected output of SELECT POW(1.1) if NOT MySQL

A

Error with other DBMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the expected output of SELECT SLEEP(5) if MySQL

A

Delays page response by 5 seconds and returns 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the expected output of SELECT SLEEP(5) if NOT MySQL

A

Will not delay response with other DBMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

If the web server is running Apache or Nginx what is likely the SQL server

A

MySQL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

If the web server is running IIS what is likely the SQL server

A

MSSQL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the three types of XSS

A

Stored. Reflected and DOM-Based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a Stored XSS

A

The most critical type of XSS which occurs when user input is stored on the back-end database and displayed upon retrieval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Reflected XSS

A

When a user input is displayed on the page after being processed by the backend server but without being stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a DOM based XSS

A

When a user input is directly shown in the browser and is completely processed on the client side without reaching the backend

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When can XSS be performed in Headers

A

When their values are displayed on the page

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What 3 ports does MSSQL run on

A

TCP 1433 and UDP 1434. Hidden mode: TCP 2433

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Query to verify MSSQL version

A

SELECT @@version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Oracle RDBMS port

A

TCP Port 1521

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Query to verify Oracle RDBMS version

A

SELECT * FROM v$version;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

MySQL Port

A

Port 3306

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Query to verify MySQL version

A

SELECT VERSION()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

MySQL Error

A

“You have an error in your SQL syntax”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

PostgreSQL Port

A

TCP Port 5432

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

PostgreSQL Error

A

“PGERROR” or includes PostgreSQL in error text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Query to verify PostgreSQL version

A

SELECT version()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

MongoDB port

A

TCP Port 27017

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Query to verify MongoDB version

A

db.version()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Redis Port

A

TCP Port 6379

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Spear Phishing

A

Instead of casting a wide net attackers research their victims and craft personalised messages increasing likelihood of success

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is Whaling

A

A subtype of Spear Phishing but targeting high profile individuals within an organisation such as C-Suite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is Vishing

A

Voice Phishing involves using phone calls or voice messages to deceive victims into revealing sensitive information

34
Q

What is Virtualisation

A

Virtualisation refers to creating a virtual version of a resource. It allows for multiple OS or applications to run on a single physical system whilst keeping them isolated from one another

35
Q

VMWare ESXI Port

A

Port 902

36
Q

HyperV DCE/RPC Port

A

135

37
Q

Docker Port

A

Port 2375 and 2376

38
Q

IBM DB2 Port

A

50000

39
Q

What is the DB that contains schema info in MSSQL

A

INFORMATION_SCHEMA

40
Q

What is the DB that contains schema info in MySQL

A

INFORMATION_SCHEMATA

41
Q

In Blind SQLi what query can we use to extract length of a field

A

LEN(fieldName)

42
Q

In Blind SQLi what query can we use to extract name of field letter by letter

A

ASCII(SUBSTRING(fieldName,1,1))

43
Q

How to sleep in PGSQL

A

SELECT 1 FROM PG_SLEEP(10)

44
Q

How to sleep in MSSQL

A

WAITFOR DELAY ‘0:0:5’

45
Q

How to sleep in MySQL

A

SELECT SLEEP(5)

46
Q

How to enable xp_cmdshell

A

EXEC sp_configure ‘xp_cmdshell’. 1; RECONFIGURE;

47
Q

What does CSRF stand for

A

Cross Site Request Forgery

48
Q

What is CSRF

A

Where an attacker tricks a victim into submitting unwanted requests through a link

49
Q

Example of Insecure Headers

A

Missing CSP, Missing X-Frame-Options, Missing HSTS

50
Q

What does CSP stand for

A

Content Security Policy

51
Q

What does HSTS stand for

A

Header Strict-Transport-Security

52
Q

What does CSP do and what is risks of missing CSP

A

Helps mitigate XSS by defining which resources can be loaded by browser, missing CSP means malicious scripts could be injected and executed in user’s browsers

53
Q

What is HSTS and risks of missing HSTS

A

HSTS ensures that the website is only accessed from HTTPS and not HTTP, missing HSTS increases the risk of HTTPS downgrade attacks where the attacker forces the user to connect via HTTP allowing them to intercept data

54
Q

What are X-Frame-Options and what are risks of Missing X-Frame-Options

A

X-Frame-Options prevent clickjacking by disallowing the website to be embedded in an iframe, Missing X-Frame-Options means an attacker can embed the website in a malicious frame leading to clickjacking attacks

55
Q

What are risks of CSRF

A

Unauthorised actions being performed, data manipulation, account takeover

56
Q

What is XML Injection / XXE

A

When an attacker manipulates input in XML format, causing the web application to process unintended data or behaviour

57
Q

What are anti-CSRF, anti-XSS headers

A

SameSite Cookie, CSRF Tokens, CSP Header

57
Q

What are the risks of XML Injection / XXE

A

Data leakage, RCE, DoS

57
Q

How can we test/exploit an XXE

A

We can try including malicious XML entities such that they read the contents of file:///etc/passwd and then print out the contents of it

58
Q

What is a CSRF token

A

A unique and unpredictable value that is included in forms or headers for each request, these tokens must match a token stored in the user’s session

58
Q

What is a SameSite cookie

A

It controls when cookies are sent in cross-origin requests, Strict: cookies only sent in requests that originate from the same site

59
Q

What does CSP do

A

Restricts scripts, styles and other resources from being loaded or executed if they are not explicitly allowed, can prevent reflected and stored XSS by blocking malicious scripts

60
Q

What is Session Fixation

A

The attacker generates/creates a valid session and sends a victim a link using that cookie, which when the victim logs in, the attacker will have access to the account using the cookie

60
Q

What is a MIME-Type and what can it be exploited for

A

Determines the file type through its general format and byte structure and can be exploited for passing malicious files as allowed files (e.g: php scripts as a .jpg)

61
Q

What can be an example of Session Fixation

A

An attacker logs into an account, copies the session token, logs out to invalidate it, sends a crafted URL to a victim who will login and attacker will have possession of a valid session ID

62
Q

Name 3 laws relating to Cyber in Australia

A

Privacy Act 1988, Cybercrime Act 2001 and Security of Critical Infrastructure Act 2018

63
Q

What is the Cybercrime Act 2001

A
  • Criminalises hacking and unauthorised access to data
  • Addresses fraud involving computers and data manipulation
64
Q

What is the Privacy Act 1988

A

It regulates the handling of personal information about individuals, requires organisations to notify individuals and the Australian Information Commissioner about data breaches that are likely to result in serious harm

65
Q

What is the Security of Critical Infrastructure Act 2018

A

The SOCI Act identifies critical infrastructure assets and imposes obligations on owners and operators to protect their assets

66
Q

What are the top 3 international Cyber laws/standards

A

GDPR, PCI DSS and ISO 27001

67
Q

What does GDPR stand for

A

General Data Protection Regulation

68
Q

What does GDPR do

A
  • Enhances individuals control over their personal data
  • Requires timely reporting of data breaches
  • Imposes fines for non-compliance
69
Q

What does PCI DSS stand for

A

Payment Card Industry Data Security Standard

70
Q

What does PCI DSS do

A
  • Mandates encryption of cardholder data
  • Requires restricted access to sensitive information
71
Q

What does ISO 27001 do?

A
  • Emphasises the identification and management of information security risks
  • Encourages ongoing enhancement of security measures
72
Q

What is the name of the scheme in the Privacy Act 1988 regarding notifying stakeholders

A

NDB scheme

73
Q

What is the NDB scheme

A

Mandates the reporting of data breaches that are likely to result in serious harm

74
Q

What TLS configuration does the PCI DSS find non-compliant

A

TLS 1.0

75
Q

What are some questions that can be asked during scoping

A
  • A brief description of the service?
  • How many endpoints and functions are there?
  • Does the service have a login mechanism in order to access authenticated content?
76
Q

What is an open line in the Technical Summary

A

This section is targeted towards Project Managers or IT Managers wishing to delegate remediation tasks to various parties. It is a summary of all vulnerabilities with related risk ratings and business impacts designed to help prioritise resourcing for remediation.

CCT APP Written (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions