Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IN5290 > Eksamen > Flashcards

Eksamen Flashcards

Bli klar!

1
Q

What kind of services do we have to face from outside a network?

A

Web, Ftp, ssh, dns, mail (SMTP, POP3, IMAP, Exchange), VPN and many others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What kind of services do we have to face from inside a network?

A

Netbios, SMB, Printer, RDP, DB services, LDAP, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What kind of errors (vulnerabilities) can we expect?

A

Configuration related errors & Software vulnerability related error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Give examples of Configuration related errors

A

– Default credentials
– Easy to guess credentials (we had information gathering before)
– No or inappropriate protection against guessing (brute-force)
– Unnecessary function
– Privilege misconfigurations
– Other configuration errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Give examples of Software vulnerability related error

A

– No input validation
– Memory handling errors
– Several others (see later)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are you looking for when you start compromising and firstly use in the service in a normal way?

A

– Is there any information disclosure?
– Error messages, etc.
– Restrictions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Give examples of ways to force a service to error and obtain information

A

– Provide invalid data

– Use it in an invalid way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 5 other ways to start compromising?

A
  • Try factory defaults
  • Brute-forcing
  • Search for known exploits
  • Service specific exploitations
  • Unique ways
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is brute forcing?

A

• Trying out multiple combinations
• How to generate the options? – Random
– Trying out all combinations – Using a list or dictionary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are som brute forcing tools?

A

– THC Hydra (ssh, ftp, http)
Hydra was created by a hacker group The Hacker’s choice. It is an universal brute-force tool that can be used for several protocols.
– Ncrack – Medusa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an exploit?

A

An exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). Such behavior frequently includes things like gaining control of a computer system, allowing privilege escalation, or a denial-of-service (DoS or related DDoS) attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are some ways of attacking a FTP service?

A

The ftp server configuration file declares what is enabled.

If anonymous is enabled, we can log in to see what we can do We can also brute-force the credentials or use exploits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is SMTP?

A

(Simple Message Transfer Protocol) is a standard for email transmission in widespread today.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the main SMTP commands?

A

HELO: Sent by a client to identify itself
EHLO: The same as HELO but with ESMTP (multimedia support)
MAIL FROM: Identifies the sender of the message
RCPT TO: Identifies the message recipients
DATA: Sent by a client to initiate the transfer of message content
Note there are no Subject, CC, BCC fields. All these data are placed in the data section (these are not part of the smtp)
VRFY: Verifies that a mailbox is available for message delivery. If it’s allowed user enumeration is possible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When attacking SMTP, what is open relay access?

A

In case of open-relay settings, the user doesn’t need to provide credentials. Anyone can send a mail with arbitrary fields. DEMO..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How to find open-relay SMTP?

A
  • If one of the client’s SMTP allows open-relay access then any email can be written unseeingly
  • Spamboxes will probably contain some open-relay SMTP server 
17
Q

How can the users make sure that an email arrived from the right person?

A
  • Check the email header

* There’s no 100% guarantee, use PGP (mail encryption)! 

18
Q

What is a DNS service?

A

• DNS servers are all around the world
• Organized in tree structure (13 root servers)
• The top level domains (.com, .net, .edu, .no, .de, etc.) are directly under the root servers
• DNS data are stored redundantly (master and slave
server)

19
Q

Get in touch with services, what’s the order?

A

The order of the investigation is the following:
• Manual analysis (initial)
• Automatic analysis
(several prewritten scripts) There are several tools to analyze the services automatically. E.g. Nessus, OpenVAS, Qualys, etc..
• Manual analysis (to check for false positives)

20
Q

What is HTTP response splitting?

A

HTTP response splitting is an old vulnerability (still appears in 2018). In case of inappropriate validation of the requests, the client can provide misleading input (two new lines in the header indicates the end of the header). The attacker can force the server to cache a wrong server answer.

21
Q

HTTP operates with several web methods. What are the main methods in use?

A

• GET - to download data
• POST - to send data (e.g. I posted something on facebook )
Other methods in use:
• HEAD – to obtain the HTTP header
• PUT – to place content on the server (e.g. restful services)
Further existing methods:
DELETE (to remove content), TRACE, DEBUG, OPTIONS (to see the available webmethod list)

22
Q

How do you proceed in compromising a website?

A
  • First use it in a normal way (find the linked subsites, contents, input fields)
  • Decide whether it is a simple static site or it has complex dynamic content (server side scripts, database behind)
  • Try to find not intended content (comments in source code
  • Try to find hidden content without link (factory default folders, user folders, configuration files)
  • Try to obtain as much info as it is possible (information disclosures)
  • Force the site to error (invalid inputs) and see the result
23
Q

What is Client side filtering?

A

Input filtering can be done on the client side. Client side input filtering is not input validation! Any data on the client side can be modified (it’s my browser I can decide what data will be sent out). Typical input filtering:
• Form elements with restrictions (max length of input, restriction for special characters, only special characters are allowed, predefined input option e.g. radiobutton, combo)
• Javascript filtering (the javascript is running on client side, more complex validation can be done)
Client side filtering can be bypassed easily, that practically
means no additional security

24
Q

What is the reason for having so many security issues?

A
  • Computer systems have several security problems
  • Lack of money
  • Lack of time
  • Lack of expertise
  • Negligence
  • Convenience
  • Old systems
  • Too complex systems • 3rd party components • And many others…
25
Q

Give a detailed account of the steps of hacking

A
  1. Generalinformationgathering:collectingallavailable information from the target and systemize the information
  2. Technicalinformationgathering:collectingnetworkand system specific information like target ip ranges
  3. Identifyingavailablehostsinthetargetnetwork(which computer can be attacked)
  4. Identifyingavailableservicesinthetargetnetwork (which service can be attacked)
  5. Manualmappingoftheservices(tocheckhowitlooks like, the impressions, system reactions, mitigations, etc.)
  6. Automaticvulnerabilityscanning(intelligenttoolswith huge vulnerability database)
  7. Manualverificationofthefindings(tocheckifthe previous findings are real – true positive)
  8. Exploitation
  9. Lateralmovements(tomovethroughthenetwork)
  10. Ensure access until the end of the project 11. Achieve primary and secondary goals 12. Remove clues
  11. Reporting and presentation
  12. Removing the attacking files!!! (tools, data, script created temporarily during the pentest)
26
Q

What is a Domain name?

A

A domain name is an identification string that defines a realm of administrative autonomy, authority or control within the Internet.

Example:

www. mn.uio.no
hostname. thirdlevel.secondlevel.TLD

27
Q

What is an IP?

A
  • IP addresses are for the identification of computers during the communication
  • In order to be easy to memorize it, 8bit (byte) blocks are used for ipv4 e.g. 129.240.171.52
  • For ipv6 addresses are represented as eight groups of four hexadecimal digits e.g. 2001:0db8:0000:0042:0000:8a2e:0370:7334
28
Q

What type of computers are usually found in the network?

A
  • Servers
  • Network device (router, switch)
  • Firewall (stateless, statefull), Ids, Ips
  • Printers
  • User desktops
  • User laptops
  • Mobil devices
  • IOTs
29
Q

What is ICMP?

A

Internet Control Message Protocol (ICMP)
• To check if a host is responding
• Echo request – Echo reply to make sure a host is turned on

30
Q

What are the answer options you can receive when Network mapping?

A

• Positive answer
In case of icmp we get an echo reply for our
echo request
• Negative answer
In case of icmp we get destination unreachable / host unreachable message
• No answer
In case of icmp, we have no response from the
host that was addressed by the echo request

Example: ping

31
Q

What is ttl?

A 
ttl means time-to-live. Since ICMP contains the ttl value, it is possible to guess the receiver host’s operating system by its ttl.
Initial ttl values:
Windows: 128
Linux: 64
Solaris: 255
32
Q

What is Nmap

A

Nmap is an universal port scanner, it is able to carry out ordinary and specific host and service discoveries

33
Q

Mention some TCP typical services

A
  • TCP 80: web http
  • TCP 443: web https
  • TCP 20,21: ftp
  • TCP 22: ssh
  • TCP 25: smtp
  • TCP 137,139,445: netbios
  • TCP 3306: mysql
  • TCP 3389: remote desktop
  • TCP 5900: VNC
34
Q

What is a TCP handshake?

A

TCP handshake is the process when a connection is about to be established in a specific port.

Sender sends SYN
Reciever sends SYN + ACK
Sender sends ACK

35
Q

What is XSS?

A

Cross Site Scripting (XSS) is a frequently appearing web related vulnerability. If the website accepts input from the user without proper validation or encoding then the attacker can inject client side code to be executed in the browser.

Without validation the attacker can provide
• Html elements
• Javascripts

Javascript can overwrite the website content, redirect the page or access browser data e.g. the cookies.

36
Q

What is possible through XSS, and what is not?

A
  • Attacker can provide any html element including javascript
  • Redirect the page to another site to mislead the user
  • Rewrite the document content (defacing the site) to mislead the user
  • Get the cookie variables (if they’re not protected with HTTPOnly), e.g. the session variables for session hijacking, authentication cookies
  • Keylogging: attacker can register a keyboard event listener using addEventListener and then send all of the user’s keystrokes to his own server
  • Phishing: the attacker can insert a fake login form into the page to obtain the user’s credentials
  • Launch browser exploits
    BUT
  • Local files of the clients are NOT accessible
37
Q

What can you do to prevent against XSS?

A
  • Escaping user input
  • Filtering
  • Input validation
  • Sanitizing input
38
Q

What are some Session related attacks?

A

Session related attacks
The session can be compromised in different ways:
• Predictable session token
The attacker finds out what is the next session id and sets his own session according to this.
• Session sniffing
The attacker uses a sniffer to capture a valid session id
• Client-side attacks (e.g. XSS)
The attacker redirects the client browser to his own website and steals the cookie (Javascript: document.cookie) containing the session id
• Man-in-the-middle attack
The attacker intercepts the communication between two
computers (see later: internal network hacking)
• Man-in-the-browser attack

IN5290 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions