Exploits & Attacks Flashcards
Exploits
A piece of software or a sequence of commands that takes advantage of a vulnerability in a computer system to cause unexpected behavior to occur.
netstat
A command-line tool used for showing network statistics, specifically the ports and IP addresses on your computer system that can communicate with other hosts on the network
DDoS attack
A (distributed) denial of service attack that targets websites and web servers with the intention of bringing the services they provide to a halt. If one host is involved in the attack, the attack is considered to be a DoS attack. If multiple hosts are involved, it is a DDoS attack.
Botnet
Software that replicates and infects many computers, turning the computer into a “zombie”. Zombie devices are remotely controlled by an attacker for malicious purposes.
Keylogger
Software and hardware that track all keyboard clicks, including backspaces, to discover usernames, passwords, credit card numbers, and other sensitive information.
Man-in-the-Middle (MITM)
A human-based attack in which the malicious user intercepts communication between the victim’s computer and the internet.
Ransomware
Software that locks your computer and makes it inoperable, requiring you to pay someone to remove it. Ransomware can spread like a virus, worm, or trojan horse.
Rootkit
Software running with elevated privileges to control a computer or to gain access to restricted accounts and data.
Forceful Directory Browsing
When hackers can use their knowledge of a web server’s directory structure to craft URL addresses and navigate to locations that are unreferenced and unlinked in a website.
FTP (File Transfer Protocol)
Lets computers copy files to and from devices on a network. If malicious users are able to “FTP” to your computer, they can deliver malware to it
SMTP (Simple Mail Transfer Protocol)
A communication protocol for electronic mail transmission. It has a history of vulnerabilities and weaknesses.
Loose-lipped errors
When HTTP requests fail or when systems crash, the system often provides some feedback as to why. Error messages can provide instructive information to a user, but also can be a rich source of intelligence to potential hackers.
Cross-site scripting (XSS)
A type of exploit in which the attacker inserts malicious client-side code into web pages to steal data, take control of a computer, run malicious code, or achieve a phishing scam.
XSS Stored Attack
Similar to an XSS-reflected attack with one major difference: This exploit permanently stores the malware script in the database.
Command Execution (Injection) attack
an attack in which the goal is the execution of arbitrary commands on the host operating system via a vulnerable application.
