Exam Questions - Misc Flashcards
What is a multipartite virus?
A multipartite virus (also known as a multipart virus or hybrid virus) combines the approach of file infectors and boot record infectors and attempts to simultaneously attack both the boot sector and the executable or program files. When the virus infects the boot sector, it will, in turn, affect the system files and vice versa. This type of virus re-infects a system repeatedly if it is not rooted out entirely from the target machine. Some examples of multipartite viruses include Invader, Flip, and Tequila.
What is a sparse infector virus?
Sparse infector viruses infect less often and try to minimize their probability of discovery. These viruses infect only occasionally upon satisfying certain conditions or infect only those files whose lengths fall within a narrow range
What is the Google dork that helped Jude find the VoIP login portals?
inurl: 8080 intitle:”login” intext:”UserLogin” “English”
inurl: /voice/advanced/ intitle:Linksys SPA configuration
inurl: /remote/login?lang=en
!Host=*.* intext:enc_UserPassword=* ext:pcf
inurl:8080 intitle:”login” intext:”UserLogin” “English”
Karen, a security professional in an organization, performed a vulnerability assessment on the organization’s network to check for vulnerabilities. In this process, she used a type of location data examination scanner that resides on a single machine but can scan several machines on the same network.
Which of the following types of location and data examination tools did Karen use?
Network-based scanner
Agent-based scanner
Proxy scanner
Cluster scanner
Agent-based scanner.
- Network-based scanners only scan the machine they’re running on
- Proxy scanners scan the network performing only one scan at a time
- Cluster scanners can perform multiple network scans at a time.
What is an ip address decoy?
The IP address decoy technique refers to generating or manually specifying IP addresses of the decoys to evade IDS/firewalls. It appears to the target that the decoys as well as the host(s) are scanning the network. This technique makes it difficult for the IDS/firewall to determine which IP address is actually scanning the network and which IP addresses are decoys
Example:
> nmap -D RND:10 10.10.10.10
What is a Packet filtering firewall?
In a packet filtering firewall, each packet is compared with a set of criteria before it is forwarded. Depending on the packet and the criteria, the firewall can drop the packet and transmit it or send a message to the originator. The rules can include the source and the destination IP address, the source and the destination port number, and the protocol used. It works at the internet layer of the TCP/IP model or the network layer of the OSI model.
What is a Circuit-level gateway firewall?
A circuit-level gateway firewall works at the session layer of the OSI model or transport layer of TCP/IP. It forwards data between networks without verification and blocks incoming packets from the host but allows the traffic to pass through itself.
What is a Application-level firewall?
Application-based proxy firewalls focus on the application layer rather than just the packets. Application-level gateways (proxies) can filter packets at the application layer of the OSI model (or the application layer of TCP/IP). Incoming and outgoing traffic is restricted to services supported by the proxy; all other service requests are denied
What is an Application proxy?
An application-level proxy works as a proxy server and filters connections for specific services. It filters connections based on the services and protocols when acting as a proxy. For example, an FTP proxy will only allow FTP traffic to pass through while all other services and protocols will be blocked.
What is a MarioNet attack?
MarioNet is a browser-based attack that runs malicious code inside the browser, and the infection persists even after closing or browsing away from the malicious web page through which the infection has spread. Most of the latest web browsers support a new API called Service Workers that allows the website to isolate operations that render the web page UI from intensive computational tasks to avoid freezing of the UI when large amounts of data are processed.
Attackers register and activate the Service Workers API through a website controlled by them. When the victim browses that website, the Service Workers API automatically activates, and it can run persistently in the background even when the user is not actively browsing the website. To keep the Service Workers API alive, attackers abuse the Service Workers SyncManager interface.
In which of the following techniques does an attacker use a combination of upper- and lower-case letters in an XSS payload to bypass the WAF?
- Using hex encoding to bypass the WAF
- Using ASCII values to bypass the WAF
- Using obfuscation to bypass the WAF
- Using ICMP tunneling
Using obfuscation to bypass the WAF.
In contrast, Using ASCII values looks like this:
String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 88, 83, 83, 34, 41)
What is a null cipher?
A technique used to hide the message within a large amount of useless data. The original data are mixed with the unused data in any order horizontally, diagonally, vertically, or in reverse so that no one can understand it other than those who know the order.
Which of the following cryptography attacks is similar to the chosen plaintext attack, except that the attacker can obtain ciphertexts encrypted under two different keys?
- Ciphertext-only attack
- Known-plaintext attack
- Chosen-key attack
- Related-key attack
Related-key attack
Which of the following modbus-cli commands is used by attackers to manipulate the register values in a target PLC device?
- modbus write 101 1 1 1 1 1 1 1 1 1 1
modbus write %M100 1 1 1 1 1 1 1 1 1 1 - modbus write %MW100 2 2 2 2 2 2 2 2
modbus write 400101 2 2 2 2 2 2 2 2 - modbus read 101 10 modbus read %M100 10
- modbus read %MW100 10 modbus read 400101 10
modbus write %MW100 2 2 2 2 2 2 2 2
modbus write 400101 2 2 2 2 2 2 2 2
- modbus write 101 1 1 1 1 1 1 1 1 1 1 and modbus write %M100 1 1 1 1 1 1 1 1 1 1 are not right, as these write to coils, not registers.
- %MW or 400101+ references registers, while %M100 or 101+ references coils.
Which of the following attacks does not directly recover a WEP key and requires at least one data packet from a target AP for initiation?
- MAC spoofing attack
- Evil twin attack
- Fragmentation attack
- De-authentication attack
A successful fragmentation attack can obtain 1500 bytes of a pseudo-random generation algorithm (PRGA). However, this attack does not directly recover the WEP key. At least one data packet must be received from the target AP to initiate this attack.
The aircrack-ng suite helps the attacker obtain a small amount of keying material from the packet, following which it attempts to send ARP and/or logical link control (LLC) packets with known content to the AP. The attacker can gather a larger amount of keying information from the replay packet if the AP echoes this packet. An attacker repeats this cycle several times to obtain the PRGA. The attacker can use PRGA with packetforge-ng to generate packets for injection attacks
Which of the following modules establishes a communication channel between the Metasploit framework and a victim host?
- Exploit module
- Auxiliary module
- Payload module
- NOPS module
A payload module establishes a communication channel between the framework and the victim host. A Metasploit payload module can upload and download files from the system, take screenshots, and collect password hashes. It can even take over the screen, mouse, and keyboard to control a computer remotely. The payload Module establishes a communication channel between the Metasploit framework and victim host. It combines arbitrary code that is executed as the result of an exploit succeeding.
In contrast:
- An exploit module is used to encapsulate a single exploit, using which users target many platforms. This module has simplified meta-information fields. Using the Mixins feature, users can also dynamically modify exploit behavior, perform brute-force attacks, and attempt passive exploits. In short, the exploit module is the way into the target system.
- A NOPS module is used to generate various NOPS sleds which may vary by architecture/detection, for use in shellcode or other applications as part of the exploit process.
- An auxiliary module can be used to perform arbitrary, one-off actions such as port scanning, DoS, and even fuzzing. It includes tools and modules that assess the security of the target as well as auxiliary modules such as scanners, DoS modules, and fuzzers.
In which of the following stages of the web server attack methodology does an attacker determine the web server’s remote access capabilities, its ports and services, and other aspects of its security?
- Information gathering
- Web server footprinting
- Website mirroring
- Vulnerability scanning
Web Server Footprinting. The purpose of web server footprinting is to gather information about the security aspects of a web server with the help of tools or footprinting techniques. Through footprinting, attackers can determine the web server’s remote access capabilities, its ports and services, and other aspects of its security.
In contrast:
- Information gathering involves trying to collect as much information as possible about the target web server. The attacker gathers the information and then analyzes it to find lapses in the current security mechanisms of the web server. In essence, this is a vague catch-all term.
- Website mirroring is a method of copying a website and its content onto another server or to a local filesystem for offline browsing. With a mirrored website, an attacker can view the detailed structure of the website.
- Vulnerability scanning is a method of finding the vulnerabilities and misconfigurations of a web server. Attackers scan for vulnerabilities with the help of automated tools known as vulnerability scanners
An attacker aims to hack an organization and gather sensitive information. In this process, they lure an employee of the organization into clicking on a fake link, which appears legitimate but redirects the user to the attacker’s server. The attacker then forwards the request to the legitimate server on behalf of the victim.
Which of the following types of attack is performed by the attacker in the above scenario?
- Man-in-the-middle attack
- Cross-site script attack
- Session replay attack
- Session hijacking using proxy servers
This is a Session hijacking using proxy servers attack. In this attack, an attacker lures the victim to click on a fake link, which appears legitimate but redirects the user to the attacker’s server. The attacker then forwards the request to the legitimate server on behalf of the victim and serves as a proxy for the entire transaction. Acting as a proxy, the attacker captures the session information during the interaction between the legitimate server and user.
In contrast:
- A man-in-the-middle (MITM) attack is used to intrude into an existing connection between systems and to intercept messages being transmitted. In this attack, attackers use different techniques and split a TCP connection into two: a client-to-attacker connection and an attacker-to-server connection. After the successful interception of a TCP connection, an attacker can read, modify, and insert fraudulent data into the intercepted communication. In the case of an HTTP transaction, the TCP connection between the client and server is the target.
- A cross-site script attack is a client-side attack in which the attacker compromises a session token by using malicious code or programs. This type of attack occurs when a dynamic web page receives malicious data from the attacker and executes it on the user’s system
- In a session replay attack, the attacker captures the authentication token of a user by listening to a conversation between the user and server. Once the authentication token is captured, the attacker replays the authentication request to the server with the captured authentication token to dodge the server; consequently, they gain unauthorized access to the server.
