Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IST-294 IT & DATA ASSURANCE > Final > Flashcards

Final Flashcards

1
Q

What are the four use cases for the MITRE ATT&CK Framework?

A

Threat intelligence

Detection
and analysis

Adversary emulation
and red teaming

Assessment and engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the ATT&CK Navigator?

A

It helps do annotation and navigation for different attack techniques.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the Pyramid of Pain?

A

The Pyramid of Pain defines levels of indicators, each escalating in difficulty for adversaries to alter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the Atomic Red Team project?

A

An open source project that provides red team content that aligns with ATT&CK that can be
used to test analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the six levels of the Pyramid of Pain? Which is the most difficult to defend against.

A

TTPs
Tools
Network/Host Artifacts
Domain names
IP address
Hash Values
The most difficult to detect and protect against are TTPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Whois?

A

Gives information about a website like the owner, register, address of registrar and register.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Nslookup?

A

Provides IP’s and addresses, can also be used to search for mail servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a vulnerability assessment?

A

Gathers data from public resources and various tools to identify open ports and identify potential vulnerabilities that can be exploited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you start a simple http server from the terminal?

A

python -m http.server 80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is OSINT and what are some examples?

A

Open Source Intelligence, used to gather information about a target.
Shodan, Linkedin, whois, dnsdumpster, dnslytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are linpeas and winpeas?

A

Scripts that determine vulnerabilities for privilege escalation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a sticky bit?

A

An option in Linux that is set on directories that prevent users that share access to a directory from deleting files and sub-directories within it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

cpassword attack?

A

Retrieves and cracks the GPP (Group Policy Preferences) password on unpatched systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

LDAP?

A

Windows
(Lightweight Directory Access Protocol)
Used to manage and interact with users, susceptible to sniffing and MITM attacks. Sends credentials in plain text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Kerberoasting

A

All
An attacker gains the Kerberos password hash and decrypts in an offline password attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is NTLM and how is it cracked?

A

Windows
NT LAN Manager
Easy to crack password hashes, doesn’t need to be cracked in order to be used over the network in a pass the Hash attack. psexec command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

LSASS?

A

Local Security Authority Subsystem Service
Stores Windows credentials in plaintext through Windows 7 / Windows 2008

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

LSA Secrets?

A

Windows
Local Security Authority stores passwords, credentials. The Registry contains the info required to load and decrypt the LSA secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DLL Hijacking

A

Windows
Replaces a Data Link Library with an infected file, when the application loads the file will be called upon.

20
Q

What is enum4linux?

A

A way to enumerate Windows Active Directory
Shows ip and domain name,SID,OS info, users, password policy, and groups are revealed

21
Q

Active Directory also typically runs what?

A

Windows DNS
The DNS server may have software vulnerabilities which may be exploited

22
Q

What are some ports associated with Active Directory?

A

TCP 88:
Kerberos

TCP & UDP 389:
Lightweight Directory Application Protocol (LDAP)

23
Q

What is rpcclient?

A

A way to enumerate Active Directory

querydominfo:
Gives domain info

enumdomusers:
Gives user info

enumdomgroups:
gives group info

24
Q

john the Ripper?

A

The original tool for cracking password hashes of most popular types. Linux, Windows

25
Q

Hashcat?

A

Cracks password hashes, faster than John the Ripper

26
Q

Rainbow tables?

A

A database of password hashes and the plaintext equivalent.

27
Q

What is Hydra?

A

Tool for online password attacks.
-l singular user
-L List of user accounts
-P List of Passwords

ssh://192.168.1.123
server example

28
Q

Password Spraying?

A

Using a long list of passwords against a small number of user accounts.

29
Q

Credential Stuffing

A

Uses published breach data to leverage credentials reused by users

30
Q

Hash-identifier?

A

Used to determine the hashing algorithm used to generate a password hash (which then is in turn used to crack the password hash)

31
Q

What is and where is the Windows SAM file?

A

Security Accounts Manager

stored in the %WINDOWS%\SYSTEM32\CONFIG\

Encrypted weakly, encryption key is stored in the SYSTEM file

32
Q

What is the LM Hash?

A

Password hash on a Windows system

14 bytes, 2 groups of 7 bytes are stored in separate blocks

Converted to UPPER CASE

33
Q

What is Mimikatz?

A

Tool used to extract passwords stored in memory of the system it is used on.

34
Q

What is 2FA/MFA?

A

Two-factor/Multi factor authentication

If you attempt to log in from a new source you will get a confirmation on another device like a smartphone

35
Q

How to find the kernel version on linux?

A

uname -r

36
Q

How to load just the server headers on curl?

A

curl -i

37
Q

What are some common nmap switches?

A

-sC is a script scan -sV is a version scan
-Pn is no ping -sP is ping sweep
-p- pings all ips

38
Q

Specialized google searches used by penetration testers to enumerate aspects of an org’s internet-facing hosts are called what?

A

Google Dorks

39
Q

What are wget and certutil?

A

wget is a GNU command-line tool to download files.

certutil is a Windows tool that can view Certificates as well as send and receive files

40
Q

What is netcat used for?

A

Used to establish a simple network and receive files from incoming connections.

nc -nlvp 80

-n Do not perform dns lookups
-l listens
-v Will type any connections received
-p port number

41
Q

What are common ports for a domain controller?

A

TCP/UDP 53-
DNS

UDP 88-
Kerberos authentication

TCP 135-
connect to clients and other domains

TCP 139 | UDP 138-
File Replication Service between domain controllers

TCP & UDP 445-
Replication, User and Computer Authentication, Group Policy,

42
Q

What is DirBuster/Gobuster and how do you use it?

A

Brute force pen testing tools, Dirbuster is GUI, and Gobuster can be used in command line.

-u target ip
-w wordlist to use

43
Q

What is msfvenom and how does it work?

A

msfvenom is a command-line tool that combines payload generation and encoding.

-p add custom payload
lhost=(attacker ip)
lport=4444
-f file type you want back

44
Q

builtwith.com

A

Show’s details about a website and how it functions

45
Q

What is the traditional attacker methodology?

A

Reconnaissance

Scanning & Enumeration

Exploitation & Gaining Access

Maintaining Access & Covering

46
Q

What is wifiphisher?

A

A rogue Access Point framework for conducting red team engagements or Wi-Fi security testing.

IST-294 IT & DATA ASSURANCE (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions