Ethical Hacking Flashcards by Siri P

List the 5 phases of ethical hacking

Reconnaisance
Scanning
Exploitation
Post Exploitation
Report Writing

How well did you know this?

Not at all

Perfectly

List the google search string terms

intitle
intext
inurl
filetype
site

How well did you know this?

Not at all

Perfectly

what is the nslookup command to change server?

server 8.8.8.8

How well did you know this?

Not at all

Perfectly

What is the nslookup command to find the authoritative DNS server for a domain

set type=ns
westernsydney.edu.au

How well did you know this?

Not at all

Perfectly

What are the types of hacking?

White hat: Non malicious attacks with full consent, done for security purposes, also known as ethical hacking

Grey hat hacking: Non malicious attacks done without permission

Black hat hacking: Done for malicious purpose

How well did you know this?

Not at all

Perfectly

What can scanning find?

If a host is alive
What ports are open
What processes are running on the host
What vulnerabilities exist

How well did you know this?

Not at all

Perfectly

What is nmap’s default scan behaviour?

nmap only scans the 1000 most common TCP ports by default. Sends TCP SYN, ACK and ICMP echo requests

How well did you know this?

Not at all

Perfectly

What does nmap do in order?

Host discovery, port scanning, service and OS detection

How well did you know this?

Not at all

Perfectly

What is the nmap command to help?

nmap -h

How well did you know this?

Not at all

Perfectly

What is the nmap command context for the top ports

sudo nmap [-s* for type of ports] –top-ports [number of ports] [ip address]

How well did you know this?

Not at all

Perfectly

What is the nmap command for scanning ports with
1. SYN packets
2. TCP connections
3. ACK packets
4. UDP

sudo nmap -s* [ip address]
*S for SYN
T for TCP
A for ACK
U for UDP

How well did you know this?

Not at all

Perfectly

What is the nmap command syntax to specify a port scan, and what is it for a range of ports?

sudo nmap -p [port number][ip address]
Ranges are [20-28,80,100]

How well did you know this?

Not at all

Perfectly

What is the nmap service detection command

sudo nmap -sV [ip address]
sudo nmap -sUV [ip address] for UDP ports

How well did you know this?

Not at all

Perfectly

What is the nmap OS detection command

sudo nmap -O [ip address]

How well did you know this?

Not at all

Perfectly

Name the vuln database used with our exploits (MS010 etc)

MS Security Bulletin

How well did you know this?

Not at all

Perfectly

Name three vuln scanners

GVM
Nessus
Nmap

How well did you know this?

Not at all

Perfectly

What is the command to start GVM, and to access it?

‘sudo gvm-start’
It is accessed with http://localhost:9392 or http://localhost:80

How well did you know this?

Not at all

Perfectly

What is the exploitation tool we use, and what is the command to start it on Kali Linux

MSF or Metasploit Framework.
It is accessed with the command msfconsole

How well did you know this?

Not at all

Perfectly

What are the steps to exploit a system with MSF

msfconsole to enter it
search vuln
use exploit from the results
set payload
show options and set options
exploit

How well did you know this?

Not at all

Perfectly

What is searchsploit, the syntax and some options

A local kali database to search exploits:
searchsploit [options] [terms]
-c is case sensitive
-p is full path

How well did you know this?

Not at all

Perfectly

How are exploits organised in msfconsole?

By OS

How well did you know this?

Not at all

Perfectly

What are the three payload categories?

Singles (function alone), Stagers(uploads a stage into victim’s memory) and Stages(payload needs loaded into memory)

How well did you know this?

Not at all

Perfectly

What are the two types of payload stagers?

Bind - host connects to the target
Reverse - Sets a TCP connection from target to host

How well did you know this?

Not at all

Perfectly

What are the commands to list the sessions and access them on msfconsole?

sessions
sessions -i (id)

How well did you know this?

Not at all

Perfectly

What does DLL stand for

Dynamic Link Library

What does DLL do?

Forces another process to upload and run a payload on the host system DLL injection is injecting a payload into a process to run it on the system

What is the command to use nmap to detect vulns?

sudo nmap [script name] [port number] [target ip address]

List a few meterpreter shell commands

cd, mkdir, rm, pwd, ls

What is the command to send a session to the background?

background

What is the command to hide a process?

getpid ps -S [explorer] migrate [target pid]

What can vncinject do?

It injects a VNC server into a process on the target. If viewonly is set to true, you can view the desktop in real time, and if false, you have control to the desktop in real time

List netcat's functions

Banner grabbing Establishing a raw data connection Transferring files Scanning ports Shells

What is the syntax for a netcat raw connection?

sudo nc [ip] [port]

What is the command to run netcat on server mode? Explain what the options are.

sudo nc -vlp [port] -l listens to ports -v displays diagnostic messages -p defines the port

Write the file transfer commands for netcat through server mode

nc -vlp 2222 < openme.pdf nc [ip] 2222 > openme.pdf

What is client side exploitation?

Exploiting vulns on client's systems and software i.e browsers, email clients etc.

What is the payload option to create a malicious url to send to the client?

set srvport to listen on, set URIPATH, and set allowprompt to true

What is the meterpreter options to allow migration of processes

set prependmigrate true set prependmigrate proc [process name]

What are the options to create a hostile pdf

exename (name of process) filename [name]

Command to create a meterpreter handler to recieve the connection

use exploit/multi/handler

List some tasks of post exploitation

Privilege escalation Creating backdoors Information gathering Installing rootkits

What are the two methods of privilege escalation?

'getsystem' and local exploits

How are local exploits used to escalate privilege?

Local exploits are run on the target once access is gained. The current session is backgrounded and a local exploit is used. The target is set. The session with the access and LPORT are set, then 'exploit'ed

Name the commands for system info gathering

sysinfo hashdump idletime

Where are system logs stored in Linux, and where in Windows

/var/log Event viewer

What two logs does Windows viewer get?

Windows logs, application and service logs

What command is used to delete all logs in Windows

clearev

What is a rootkit?

An application that gains unauthorised access to computers and can hide its or other processes' existence - hides processes or files

List the three 'reg' commands

query, add, delete

What is the command to turn firewalls off?

netsh advfirewall set allprofiles off

What is the command to show firewall rules?

netsh advfirewall firewall show rule name=["rule"] or all

What are the steps to install an nc backdoor?

Upload nc.exe to target Add nc.exe to automatic startup, set port number to listen on Allow netcat in windows firewall by adding a rule inbound allowing tcp port

What is the crafted input to display all user records?

' or '0'='0

What is the crafted input to display database server version

' union select null, version() #

What is the crafted input to display username for DB access

' union select null, user() #

Crafted input to display database name?

' union select null, database()

Input to display table name

' union select null, table_name from information_schema.tables where table_name like 'user%' #

What does mysqli_real_escape_string() function do

Bypasses ' and ''

What are the two commands used to set proper SQLI security?

stripslashes() mysqli_real_escape_string()

What is a cookie?

A string from the website to a user's browser that is stored as a unique id for the session

What is the syntax to create a cookie?

Set-Cookie: [name]=[value] [; attributes]

What are the cookie attributes?

Expires Secure HTTPOnly Domain Path

What is an XSS Attack?

Using vulnerable websites to send malicious codes to clients

What is the script to generate an alert box?

What is the difference between persistent and non persistent XSS attacks?

Persistent attacks store the JS code in the database, whereas non persistent or reflected attacks do not

What is ZAP and what does it do?

OWASP Zed attack proxy intercepts HTML request and response messages

How does Reflected XSS work?

A hacker sends a URL with a query string with malicious JS code, which is echoed as web content by a vulnerable site and executed in target computers

What is the $_SERVER["PHP_SELF"] variable?

It stores the full path of the php file currently executed by the web server

What are the two guidelines of XSS Defence?

Protect cookies and sanitize user inputs

What are the methods to sanitise user inputs?

htmlspecialchars() - removes the syntax of special characters in user input test_input() Using the HTML purifier library