Domain 6 Flashcards
__ attack starts with a dictionary attack and then adds characters e.g. camel1, camel2.. Camel99, etc.
Incremental attack
__ box testing is a software testing method that uses internal algorithms and information to conduct the test e.g. source code review.
white box
__ fingerprinting is read-only, inspecting packets passively on the wire or via a pcap file.
Passive e.g. uses TTLs, IPIDs, sequence numbers or even layer 7 packet data to determine system details e.g. p0f -s capture.pcap
__ fingerprinting sends network traffic to determine OS and service version. __ is one of the best fingerprinting tools.
Active, Nmap e.g. nmap -A 10.20.30.2
__ involve intentionally sending end users suspicious, yet harmless, emails with the primary goal of increasing the organization’s security posture rather than shaming or punishing end users.
Phishing campaigns
__ involves overtly looking for potential security weaknesses. In other words you are validating and trying to find faults or break systems, what is this called?
security testing
__ testing begins with no inside knowledge of the application e.g. can be used against compiled code with no access to the source.
black box
A __ analyzes the entire network from the inside and tries to find weaknesses and gives a complete list of risks against critical assets.
security assessment
A __ attack is initiated by the attacker against a listening service. For example in a TCP __ attack the initial SYN is sent by the attacker.
server-side attack aka service-side attack
A __ intercepts web data in real time and is the primary tool in performing dynamic web application penetration testing. This tool can be removed once testing is complete.
HTTP interception proxy
A full knowledge test is a __ test.
white box
A partial knowledge test is a __ test.
gray box
A __ says ‘IIS 7.5 running on port 80’. A __ gives more specific details about libraries, configurations and vulnerabilities that exist on the system eg ‘has XYZ libraries installed which are out-of-date and vulnerable to a buffer overflow attack. It is like a port scanner on steroids.
port scanner, vulnerability scanner
A zero knowledge test is a __ test.
black box
Describe the steps of the Server-side Exploitation Process aka ‘attack or kill chain’
“1 reconnaissance, 2 host discovery, 3 port scan, 4 OS & service fingerprinting, 5 vulnerability scan, 6 exploitation
‘Refer to ‘Server-side Exploitation Process - D6 pg 16’”
Fuzzing sends unexpected output to computer programs and is usually used in __ testing.
black box
How many total ports are there for TCP? For UDP?
same for each, 0-65535 so 65536 total for TCP and 65536 total for UDP
If a penetration tester is performing host enumeration from the same Layer 2 network, what is the most efficient way to discover hosts on that network?
ARP. Would normally use ICMP for host discovery but since it says layer 2 and most efficient, use ARP.
Name 3 examples of attacking tools and frameworks
Metasploit Framework (metasploit.com), Core Impact (coresecurity.com), Immunity Canvas (imunitysec.com)
Password cracking is __ box testing where you have access to the password hashes and can run through them without being locked out.
white box testing
Password guessing is __ box testing where it is easy to get to the login interface to guess a password but lockouts or delays are usually triggered.
black box testing
Static analysis can be considered what type of testing?
white box
The __ specifically calls out a number of security processes that need to be assessed: account mgmt processes, backup/recovery verification, log review process, security training and awareness, disaster recovery and business continuity
CIB (CISSP Information Bulletin)
This can also be referred to as ethical hacking or red team testing.
Pen Test (Penetration Test)
This is a well-known open source port scanner.
Nmap
This is a white box testing approach that attempts to discover security vulnerabilities by inspecting the source code of a target application.
source code review. Typically safer/quicker/cheaper than black box test like fuzzing which is more expensive/higher risk/not as comprehensive
This type of attack is where the victim initiates traffic often by clicking on a link in email or on the web.
client-side attack
When someone is analyzing your configuration files, interviewing you about your security, asking what the risks are this is __.
security assessment
With access to the source code what type of testing can be performed?
Static analysis
