Ethical Hacking Flashcards
Malware
Any malicious software. Created to inflict damage, steal info
Virus
Malicious software that needs user to execute it
Worm
Malware that spreads copies of itself from one computer to another
Ransomware
Encrypts system data and hacker requests cryptocurrency to decrypt it
Trojan Horse
Malicious software that often arrives via email or is pushed to users when
they visit an infected website
Botnet
Combination of the words robot and network. Refers to computers on a private network that were infiltrated with malicious software that the attacker uses for nefarious purposes
Common Attack Flow
Reconnaissance (scan for vulnerabilities)
Weaponization (Generate payload - Deliver)
Exploit and Execute (Run command upon execution)
Command and Control (possible full system access)
Network Scanning
Reconnaissance step for mapping the network structure. Identify devices on a network
Nmap
Network mapper/scanning tool
Fingerprinting
Detect services using nmap
Firewall & IDS Evasion
Proxies, Timing (-T flag), Fragmentation (-f flag), Decoys (-D flag)
Netdiscover
Uses ARP…networks without DHCP. Sniffs ARP replies
Masscan
Performs large scale scans on thousands of IPs in seconds
Zenmap
Nmap GUI version. Enables creation of customized profile scans
On-Path Attack
Man-in-the-Middle Attacks: Eavesdropping on communication
Used to obtain info secretly
Allows control over network traffic
ARP Poisoning
ARP resolves IP addresses to MAC addresses
Layer 2 protocol on LAN
Exploits lack of ARP packet validation
Arpspoof
Tool used for ARP poisoning attack
Forged packet is sent to numerous times on the network
The victim ARP table is updated with the false entry
DNS Poisoning Process
Use ARP poisoning to position the machine in the middle
Configure host file
Capture victim’s DNS request
Redirect the victim to a target IP
Bettercap
Tool for On-Path attacks
Can initiate ARP poisoning and DNS spoofing
Sends false DNS responses to the victim
Port Stealing
Populating the forwarding table
Uses victim’s MAC address
Works only on LANs
SSL Stripping
Downgrades HTTPS to HTTP
Provides plain text view of the data
John
Linux tool for password cracking
Crunch
Password list generator that forms passwords based on length and charsets
Useful when partial knowledge of the victim has been obtained
Can be used to generate lists of passwords according to templates
Cupp
Creates a wordlist based on word victims may use
Social engineering on the victim may help the attacker build the list
Victim may use an easy to remember password based on personal information
Munge
Crates a modified wordlist based on Munge Level
Using a predefined wordlist, Munge helps that attacker build a 1337 list of passwords
Hydra
Tool/login cracker that supports many remote protocols
It continuously attacks while the server sends and access denied response
-l [user name], -P [path to wordlist],
Ncrack
Fastest and most reliable tool for remote authentication
Has built-in support for Nmap output formats and other advantages
SE
Social Engineering
Based on human interaction and behavior
Involves the use of psychological manipulation
SE Process
Preparation, Deceive to Connect, Winning Information, Cover the Tracks
Self-Extracting Archive
Fake executable documents can be created using a WinRAR feature called SFX
SFX Flow
Preparation, Icon Change, Create SFX, Hide Modules, Modify File Name
MetaSploit
Vulnerability, Payload, Exploit
Net.exe Utility
Windows software component…done in cmd
Manages users, groups, and services
Can also manage network connections
Flow of PE via WinLogon
OS: choose suitable OS
Mount: mount live OS
Edit: Override ethc.exe with cmd.exe
CMD: Execute cmd.exe with high-level privileges
PE: Add user, change a password
Offline Mitigations of Windows PE
BIOS Password
Encrypt the Drive
Physical Access
Online Mitigation of Windows PE
Principle of Least Privilege, Removing Local Admin Rights, Account Audits, User Account Controls, Applocker, Software, Code, Tokens
Burp Suite
Software tool used for pen testing web apps
Fiddler
Web debugging proxy that enables HTTP traffic examination for development
OWASP Zap
Combined Zap’s pen testing project with OWASP projects for a complete solution
JavaScript
JS code can be added to HTML pages. Can affect the page’s behavior.
XSS
Cross Site Scripting-client side
Affects other users by storing code. Exploits vulnerability in web app.
Cookies
String of letters or numbers that verify, track, and store user information.
XSS attack can acquire a cookie to steal a session.
LFI
Local File Inclusion
Common in PHP-based websites. Uses the include() function
RFI
Remote File Inclusion. Accesses remote servers to deliver files
Vulnerability Assessments
Manual Scans-performed by PT experts to find complicated vulnerabilities
Automated Scans- performed to locate simple and more obvious bugs
