Deck F Prt. 2

Question 1

SQLMap

Answer 1

The Command “sqlmap.py - u http://10.10.1.20/? p=1&forumaction=search;dbs” used for Enumerating the databases in the DBMS for the URL. SQLMap is an Open Source Penetration Test Tool that Automates the Process of Detecting and exploiting Weaknesses in SQL Injectoin and taking over the server Database. So SQLmap is a tool that can Automatically Detect and exploit SQL Injection Bugs.

Question 2

Serpent

Answer 2

Is a 128 Bit Symmetric Block Cipher (Encryption Algorithm) With key sizes of 128,192 or 256 Bits, which involves 32 rounds of computational Operations that include substitution and permutation operations on four 32 bit word blocks using 8 variable s-boxes with 4 bit entry and 4 bit exit.

Question 3

SSI Attack (Server Side Includes)

Answer 3

SSI (Server Side Inclusion) Attack Refers to the Exploitation of a WEB Application by injecting Scripts in HTML Pages or Executing Arbitrary Code Remotely. The .html File type on the web server, is a strong indication that the server is vulnerable to this kind of attack.

Question 4

Side Channel Attack

Answer 4

SCAs (Side Channel Attacks) aim to Extracting Secrets from a Chip or a System, though measurements and analysis of physical parameters. Examples of such Parameters include Supply Current Execution time and electromagnetic emission. The Attacker uses a loop strategy to recover the passwords. He uses one character at at time to check whether the first character entered is correct; if so he continues the loops for consecutive characters. If not he Terminates the loop. Then the Attacker Checks how much time the device takes to finish one complete Password Authentication Process, through which he can compute how many characters entered are correct.

Question 5

Stateful Firewall

Answer 5

Stateful Firewall Does NOT Respond with a RST Packet when you send a TCP ACK Segment to a known Closed port on a Firewall.

Question 6

TTL Value of IOS

Answer 6

TTL (The Time To Live) Value of IOS 12.4 (Cisco Routers) is 255 and Window size is 4128

Question 7

TTL Value of Linux OS

Answer 7

TTL (The Time To Live) Value of Linux OS is 64 and window size is 5849

Question 8

TTL Value of Windows 7 OS

Answer 8

TTL (The Time To Live) Value of Windows 7 or Windows Server 2008 is 128 and the window size is 8192

Question 9

Technical Threat Intelligence

Answer 9

Consists of Feeding Threat Intelligence into the Security Devices in a Digital Format to block and Identify inbound and outbound Malicious Traffic Entering the Organization’s Network.

Question 10

Union SQL Injection

Answer 10

Union SQL Injection Attack that Extends the results returned by the Original Query, Enabling Attackers to run two or more statements if they have the same structure as the Original One.

Question 11

Verbose Failure Messages

Answer 11

Providing Verbose Failure Messages is a design flaw that Enumerates usernames from the login form of the Web Application, Which Requests users to feed Data and Specifies the Incorrect Field in case of Invalid Credentials. This helps the Attacker carry out social Engineering. Any applications that have Verbose Error Messages inform the Site users as to the validity of Entered Usernames. this Information will be helpful when testing for default or guessable User Accounts

Question 12

Vulnerability Management

Answer 12

The Correct Sequence of Steps in Vulnerability Management is 1: Identify Assets and Create a Baseline, 2: Vulnerability Scan, 3: Risk Assessment, 4: Remediation, 5: Verification, 6: Monitor.

Question 13

Vulnerability Scanning

Answer 13

The First Step in Vulnerability Scanning is to Check if the Remote Host is Alive Followed by Vulnerability Scanners that go ahead and Scan the Network.

Question 14

WPA3

Answer 14

Is the New Wireless Standard that Uses SAE (Simultaneous Authentication of Equals), Also known as Dragonfly Key Exchange which REPLACES the PSK (Pre Shared Key) Concept.

Question 15

WS Security

Answer 15

Is a Component of the Web Service Architecture, Which is an Extension of SOAP (Simple Object Access Protocol), and it can Maintain the Integrity and Confidentiality of SOAP Messages. Web Services Security (WS-Security, WSS) is an Extension to SOAP to apply Security to Web Services. its main Focus is the Use of XML Signature and XML Encryption to provide end to end Security.

Question 16

Wash

Answer 16

Is the COMMAND LINE Utility that allows the attacker to discover the WPS-Enabled APs in a Wireless Network. Wash Program is Included in the Reaver Package. Wash Gives you an overview of wireless Networks in range and tells you if WPS is Locked or Not. Wash is a Utility for Identifying WPS Enabled Access Points. It can Survey From a Live Interface or it can Scan a List of pcap Files.

Question 17

Watering Hole Attack

Answer 17

Is Where the Attacker Targets a Company and Identifies the Types of Websites Frequently visited by its Employees. using this information, the Hacker Searches for possible loopholes in these Websites and injects a Malicious Script that can redirect Users from the Web Page and download Malware onto a Victim’s Machine. The Attacker then Waits for the Victim to access the infected Web Application so as to compromise the Victim’s Machine.

Question 18

Web Server Footprinting

Answer 18

Occurs when an Attacker Gathers System Level Data, Including Account Details and server Names. In Webserver Footprinting, Information is Gathered using some specific Tools that are focused on Web Servers such as Maltego, httprecon, Nessus, ETC. Resulting in Details like Operating System, Running Services, Type, Applications, ETC.

Question 19

Whois Footprinting

Answer 19

In Whois Footprinting Technique, the Hacker Uses a Footprinting Technique to gather as much information as possible about the Domain Information such as the Target domain Name Contact Details of its Owner, expiry Date, and Creation Date.

Question 20

Zone Walking Attack

Answer 20

A Zone Walking Attack Is a Kind of Privacy Invasion into the DNS Records. The Zone Walking Attack Purpose is to get all existing Domain information from the DNSSEC Server. the Fetched information might contain some domain Names and their detailed information.