Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Exams > IH > Flashcards

IH Flashcards

1
Q

What two documents should your IR plan hook into?

A

COOP, DR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Any observable occurrence on a system or network

A

an event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Examples of events

A

Anything that you can show happened. (measurable)

System boot sequence
A system crash (could be normal behavior)
Packet flooding (could be legit, bursty apps)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Six stages of incident handling

A 
Grand Master PI-CERL
Preparation
Identification
Containment
Eradication
Recovery
Lessons Learned
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Places to share incident information?

A

BUGTRAQ (securityfocus.com)
Internet Storm Center (isc.com)
Dshield sensor network, part of SANS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Reviewing contingency plans, DR plans, and testing the technology and user base (phishing) that protect systems/networks from incidents is done during what phase?

A

Preparation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Warning banners NEED to include what?

A
  1. Consent to monitoring the use of its networks and systems
  2. Prohibits unauthorized access, use, or modification of resources
  3. If monitoring reveals evidence of criminal activity, the company can provide records to law enforcement.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Privacy laws can impact the ability of incident responders to

A

Effectively monitor and record system activity. Can be a problem in Europe.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are some of the broad reasons you may be obligated to notify law enforcement for an incident?

A
  1. Threat to public safety or health
  2. Substantial impact to a third party
  3. Legal requirement for your industry
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What types of protected data may require notifying the public when breached?

A

PII, PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is your obligation to provide evidence to Law enforcement as part of THEIR investigation?

A

None, without a court order; have to balance need to conduct YOUR investigation, with theirs.

(Without any evidence, you’ll significantly hinder their investigation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What SANS resource is available to help with law enforcement coordination?

A

SANS SCORE (sans.org/score/law-enforcement-faq)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Smart practice for policy on employees connecting remotely

A

Make sure the VPN banner includes a consent for remote search by the org.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How to get management buy in for IR capabilities

A
  1. Have a formal plan (with “peer” reporting measures)
  2. Provide monthly or quarterly reports
  3. Graphically illustrate incidents (cartoons, easy to understand stuff)
  4. Collect historical support
  5. Get news articles on similar incidents and how they were handled
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Membership of a good IR team should include

A 
Physical Security
Infosec
Legal
HR
DR
BCP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

two key items for benchmarking and recovering systems

A
  1. A system specific (desktop, file server, app server) build plan/doc
  2. A windows image backup of these that can be diffed against an infected machine
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Your incident handling team construction should have what pyramid-like scheme?

A

An emergency communications plan and on-site team construction.

Similar to a command post; identify who is the engagement lead, who is handling which remote site/function, and what the comms plan is. (and backups are)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is important to hammer out regarding procurement before beginning an IR activity?

A

A) What the procurement permission looks like; what happens if something (like an extra H/D) needs to be procured on site (how to make govt purchase card decisions)

and
B) What the secured communications plan is?

B) What is the plan for food/lodging/etc in case of the engagement going longer than expected?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Top two training issues for IR responders

A
  1. Creating forensic images under fire

2. Keyboard skills under fire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Some tricks for training the IR team

A

Internal honeypots
“War games” (Surprise pen tests)
Quick “drills” for creating images or finding specific log files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Great tool for performing large-scale incident response and hunt team communication/coordination.

Why is this tool good?

A

GRR, by google. Free.

  1. Works with Rekall,
  2. can pull relevant data asyncronously as hosts come on and off network. (helps w/Laptops and mobile)
  3. Can use “flows” (Scripts that run on the server but execute tasks on a host, such as looking for a file with a specific hash)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Contents of a good “jump bag” (Flyaway kit)

A
  1. Fresh/blank media
  2. Evidence collection suite (DD, Imager)
  3. Forensics tools (SIFT, EnCase, Flare, etc)
  4. Network Taps/Montiors
  5. EVery type of network/connection cable
  6. PC repair toolkit
  7. Extra copy of forms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

_____ should be set as the incident handler(s), and they should have ___ for tasking.

A

one person, usually with a helper…..with a discrete set of events on a specifically scoped system to look at.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Why should you control information/need to know for an incident?

A

Details change quickly
incomplete or inaccurate details could get posted online
Folks who are “in the know” might have to testify, and will have an incomplete set of information
Insider threats can be tipped off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Out of Band communications options in the event the system is compromised

A

Off-network phones (no VOIP)
Encrypted email (PGP or GnuPG, Gail Webcast)
Encrypted text
Faxes
Ham radios/walkie talkies
Encrypted cloud storage (Tresorit/Securesafe)
Share keys in advance!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Application logs are most useful from

A

Web apps
App Servers for thick-clients
Cloud based-services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

“Net” commands used to look for suspicious activities

A

Net view: look at shares
Net session: look at inbound connections/smb sessions
net use: look at outbound smb sessions
nbstat -S: NetbBIOS over TCP, sorted by IP connection to our machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Net commands for looking at TCP/IP activity

A

Netstat -na: Unusual TCP activity (continuous refresh)
netstat -naob: important: shows owning process id and associated DLL/executables
netstat -naob 5: same, but with auto refresh every 5 sec
netsh advfirewall show currentprofile: show built in firewall rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

commands to examine windows processes

A

WMIC
wmic process list (brief|full)
wmic process get name,parentprocessid, processid
wmic process where processid=pid, get commandline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

commands to examine services on a windows machine

A

services.msc
net start: running services
sc query | more: get more details about each service
tasklist /svc: MAP EVERY SERVICE TO A PROCESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

command to map which services are running out of each process on your system

A

tasklist /svc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the registry and file locations that start software automatically

A

HKLM\Software\Microsoft\Windows\CurrentVersion:

Run
RunOnce
RunOnceEx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Settings for a registry key can be checked on the command line using

A

reg query regkey

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Manipulating the computer and financial infrastructure of a target for political reasons

A

hacktivism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Allowing political dissidents to communicate on covert channels can be a form of

A

hacktivism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Some ways to use malicious code for profit

A 
Scraping CC numbers out of RAM for POS terminals
Keystroke loggers stealing financials
DoS Extortion
Cryptomining
Spam advertising
Ransomware
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Breakout time is

A

The time from initial compromise to privilege escalation to additional internal network targets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Average time for APTs to breakout

A

20-309 mins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Average time to respond to a breach before you’ve got compromises

A

3.5 hrs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Cumulative (Collective representation) data known about a target online (person, org, etc)

A

OSINT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

WHOIS data stopped being as useful in 2016 with the introduction of

A

European requirements for General Data Protection Regs (GDPR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Used to gather limited domain info (name, creation data, registrar) using registrant name or email address

A

reverse whois (such as viewdns.info)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Who must publish the logs of all issued certificates, and what is this called?

A

CAs, via Certificate Transparency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

How does certificate Transparency help attackers?

A

helps them collect information on an organization, such as the hostname/cname published in the cert. Clues you in on additional target data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Open Source, GPL based OSINT data collection and analysis tool

A

Spiderfoot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

When recon crosses the line into the target site (tools that start sending requests directly to the target organization)

A

Direct recon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

tool to interrogate dns server (deprecated in Linux)

A

nslookup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Easiest way to get as much info from the DNS server as possible

A

zone transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Command to do a zone transfer and get all data

A

nslookup, set type any (will grab A, MX, HINFo, and NS records)

dig AXFR

DO against all associated name servers in an org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

How to brute force DNS zone transfers

A

using nmap with the dns-brute switch, and using a word list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

DNS Recon defenses

A

Dont allow zone transfers from any system
Limit XFR to DNS servers only
Secondary and Tertiary name servers should reject all xfrs
use split dns
Harden all DNS servers
Look for zone transfer in DNS logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is Split DNS?

A

Publish external name info to only external servers, internal name info to only internal servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

to identify DNS zone xfr activity in logs

A

look for packets going to and from TCP port 53 on DNS servers. (Queries use UDP port 53, transfers only use TCP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

The SEC has what tool that’s useful for OSINT

A

EDGAR: Data on publicly traded US companies (addresses, financial statements, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Site that allows you to identify which social networking sites a target user account may be using

A

namechk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Powerful site that allows you to correlate internet presence of an identity

A

pipl.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Social media geolocation tool that uses flickr, twitter and google photo metadata

A

pushpin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

defense against website searching

A

tell your admins to look for aggro web spider/crawler activity
limit info available
make employment ads more general
determine what other sites are linked to your company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Current version of google hacks/dorks queries is stored at

A

exploit db

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Difference in how google cache and archive.org handle images

A

Google cache does NOT save the images; it will load them from where they currently are stored, if they can.

Archive.org keeps a copy and uses the cached copy if they’re not located on the current site. If they’re on the current site, it will load them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Tool that automates process of discovering files w/accessible metadata (pdf, xls, ppt) while also folding support for google hacking, sqli scanning, brute forcing subdirectories, and versions of vulnerable software

A

FOCA/GOCA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Tool used for combining google hacking with bing hacking, shodan, etc into one framework. Also includes modules for searching a site to see if it’s hosting malware, or if its vulnerable to data leakage (DLP)_

A

Search Diggity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Defenses against automated search engine recon, such as google dorks

A

Have google remove you
look for information leakage by using google hacks against yourself
remove pages, snippits, cahed pages via metadata tags (noindex, nofollow, nosnippit)

robots.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Tools for web based recon

A

Shodan
dnsstuff
network-tools.com
securityspace.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What does network-tools.com do?

A

Web based tool that does dns lookups, email checkers, domain name conversion, internet ping, spam blacklist checker for domain names, whois, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

WarVOX is a tool for ______ that requires ________.

A

War dialing VOIP, IAX protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Tool that records MP3 audio files associated witern matchingth each number dialed and answered, for pat

A

Warvox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Defense against war dialing VOIP

A

war dial yourself
conduct training on effective phone passwords
find out-of-band or unlisted numbers
set a policy for out-of-band access. (Make sure you have a full inventory of all remote routers)
secure modems with strong authentication (token, crypto)
use scanning-detection functionality for a PBX system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

difference between active and passive WIFI scanning

A

In active scan, the attacker sends probe requests on all channels of an SSID and observes responses;

Passive, the attacker just listens for beacon frames outbound from the AP.

Both return network info, encryption and auth methods, channels, and manufacturer info.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Difference between Kismet and SSIDer

A

Kismet is completely passive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

PCAP and WiFi analysis is found in what tool

A

Kismet; will produce full packets, pcap can be dumped into wireshark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is Galois Counter Mode

A

A mode of encrypting data in WPA3 that is easy to accelerate in hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What are the 3 modes of authentication for WIFI

A

PSK (pre shared key)
EAP/TLS (Enterprise auth)
SAE (Simultaneous Auth of Equals: PSK, but eliminates offline password-guessing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Why is PSK authentication for WIFI dangerous?

A

EVeryone uses the same pre-shared key for auth, so a stolen device compromises all devices)

Even without the device, offline password guessing attacks can be used on PSK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

How to offline guess a PSK password

A

Capture some packets with Kismet, try to match the hash with a password list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Best tool for password guessing wifi

A

Aircrack-ng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Impersonate and steal creds for WPA2 enterprise networks with a linux machine using

A

Hostpad WFE

Will “dumb down” auth attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

tool for hijacking mouse and keyboards (and what it requires)

A

Jackit ; a crazyradio PA USB stick, or similar)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

defense against wireless ap hacking

A

use WPA2+
deploy EAP/TLS auth or cert based auth
use TLS for critical data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

NMAP 4 packets to identify up hosts

A

ICMP echo
TCP SYN to 443
TCP ACK to 80
ICMP timestamp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

defense against network mapping (4)

A

Disable incoming ICMP echo requests
Disable outgoing ICMP time exceeds
IDS signatures for ping sweeps/tracert
temporarily block a frequent ping sweep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

TCP RESET flag does

A

tears down a connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

TCP PUSH flag does

A

Data should be pushed through the TCP stack(?)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

NMAP ack scans are useful to

A

Do network mapping instead of a ping sweep; good for finding sensitive internal servers.

CANNOT DO PORT SCAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Tool that takes screenshots of websites and tries to quickly identify the purpose of it to find interesting stuff

A

Eyewitness. Looks for things like RDP, servers, indexed web directories, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Four options for disabling a windows service listening on a port

A

kill the process with task manager
kill the process with WMIC
disable the service in control panel
disable the service using sc cmd (best, versatile)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Best two ways to see listening ports on linux

A

lsof

netsat -nap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

disable linux processes listening on ports (5 methods)

A

first, try to stop it with systemctl
then try to kill it if you cant use the first command
disable the service in /etc/rc.d
disable service using systemd
disable service in inetd/xinetd (/etc/*.conf)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Excellent bypass for IDS uses a ______ packet in the middle of an attack

A

TCP reset; tricks the way a target OS/firewall handles TCP checksums.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Defense against IDS/IPS evasion (5)

A 
Up to date/resourced devices
Implement behavioral analytics
used Host-based systems as well
block odd packet fragments
harden ports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Nessus client-server comm port, language

A

8834, HTML 5 (uses HTTPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Nessus plugin to block dangerous plugins

A

Safe checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

SMB ports (2 kinds)

A

445

used to use netbios ports, TCP/UDP 135-139

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Establishing an SMB session from cmd line

A

net use \targetIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Can connect to most SMB shares as long as you

A

Have a non-admin username and password. (Can use this to connect to IPC$)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

command to get a list of smb shares once you’re connected to an IP

A

net use \ip

net view \ip

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

command to get the list of all domain users

A

net user /domain > output.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Tool to bypass authentication and hijack password libraries so that they accept any password

A

Konboot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Attack a computer that it’s suspended or hibernate state with this tool to unlock it it. (Requires firewire/thunderbolt)

A

Inception

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Use this hardware dongle to surreptitiously steal logs using responder, for these services.

A

Lan Turtle

Steals things like kerberos traffic, LLMNR, DNS, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Physical attack medium that Looks like a use thumb drive, but can act as a keyboard and inject strings, scripts, malware

A

Rubber ducky

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

defense against physical access attacks

A 
Full disk encryption
Train users to power down systems
Restrict access to USB ports to only pre approved devices
Password protect BIOS
Disable USB boot
Disable LLMNR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Takes original netcat tool and makes it capable of communicating over pipes. devices, sockets, SSL, and Raw IP

A

Socat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Netcat that can communicate over data frames

A

Linkat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Client mode Netcat traffic is passed by:
Send ______ to standard in
Send ______ to standard out
Send _______ to standard err

A

Keyboard, redirect data from a file or piped from an application to standard in (input)

All data sent back across the network to standard out (response)

All messages from the tool sent to standard err

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Listener mode netcat traffic is passed by:
Send _____ to standard in
Send ______ to standard out
Send ______ to standard err

A

Sends received data to standard in
Sends data to client over standard out

all messages from the tool are sent to standard err

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Uses of netcat

A 
Data transfer
Port scanning
Vuln SCanning
Making connections to open ports
Backdoors
relays
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

How to backpipe a netcat relay

A

use the mknod command (common to linux and unix) to create a special FIFO (first in, first out) file as a “backpipe” for information to flow through. Acts as intermediary, carry data back and forth on the command line.

the 0backpipe at the end (receiver sending data to standard in) is important! drawing on 3:19

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

For name resolution, systems will use ARP, and then what series of name resolution services?

A

ARP –> Dns –> LLMNR –> Netbios Name Service (NBT-NS)

110
Q

Tool that scrapes images out of network flow/PCAP

A

netminer

111
Q

DNS spoofing is possible as long as you (the attacker) are located

A

on a network somewhere between the attacker and the DNS server

112
Q

How does SSLSTRIP work?

A

It intercepts the request (via MITM positioning) of a server redirecting http traffic to “jump” to HTTPS, and interprets all HTTP traffic, sniffs it, and then sends it out to where it goes VIA SSL connection the attacker establishing its own SSL tunnel.

113
Q

Responder is capable of hijacking what types of requests

A

Netbios Name Service (NBT-NS), DNS, and Proxy requests

114
Q

Why does responder try to force a victim onto LANMAN authentication methods?

A

Easier to crack auth creds

115
Q

What is a PAC file, and why do we want to hijack it?

A

A PAC file is something the browser uses to easily identify a Proxy server. Once manipulated, it will cause a browser to send requests through the victims machine

116
Q

defenses against hijacking attacks

A

Active port security on switches
use dynamic arp inspection w/DHCP snooping
Disable LLMNR
Disable WPAD
Encrypt sessions w/strong auth (SSH ver 2+)

117
Q

Buffer Overflows give an attacker the ability to

A

execute arbitrary commands on a system

take over system or escalate priv

118
Q

Buffer overflows must be executed locally (T/F)

A

False; some work over network, too

119
Q

The cyber equivalent of stuffing too much into a box that isn’t large enough to fit it

A

Buffer overflows. Cramming too much data into parts of memory that aren’t sized/conditioned to accept it. (Non-validated input)

May include overflowing integer types or storing the wrong kind of data (string when expecting #’s, etc)

120
Q

A memory stack stores and returns things from memory in what fashion?

A

Push/Pop, LIFO.

Push things onto the stack, pop things from the top of the stack.

121
Q

Variable space that’s allocated in memory to store function variables as part of subroutines

A

The Buffer. (sits on top of the return pointer; when a subroutine is called, it sticks a bookmark (Return pointer) at that place in the stack and then allocates a buffer above it for the subroutine’s function)

122
Q

Two metasploit modules that can scan code, looking for patterns that are sometimes weak to buffer overflow type attacks (string copy, scanf, fgets, get, etc)

A

Msfelfscan
msfpescan

Those commands are usually used for moving data around between memory buffers

123
Q

Finding a buffer overflow vuln in ____________ on linux or _____ on windows is a premium, because….

A

root/SUID/UID 0 level in *nix, and SYSTEM level for Windows. Let sht euser run with the admin level priv, not just program privs.

124
Q

Exploits are tailored for

A

the processor and OS type. Intel (Linux) or Sparc (Solaris) etc

125
Q

Why should buffer overflow exploit code be kept small?

A

to fit in the buffer

126
Q

These characters will be filtered by the OS and wont be loaded fully into the stack for a buffer overflow exploit

A

filtered characters. (Something that, when translated into ASCII, that means something. For example, a 0x00 code is a null characyer, and drops everything received after in the function)

127
Q

What is it when an attacker uses NOPs in front of exploit code, so that if the pointer lands on a NOP, it funnels down to the correct pointer?

A

NOP sled

128
Q

What is the NOP sled, attacker machine code, and return pointer called, when all together

A

an egg

129
Q

4 parts of metasploit

A

exploit
payload
auxillary modules (scanning, DoS, Fuzzing)
post module (post exploitation)

130
Q

MSF can sometimes be used just to check if vulnerability and scan (T/F)

A

true

131
Q

General purpose metasploit payload that carries a DLL to the target box to give specialized command level access

A

meterpreter

132
Q

Why is meterpreter nice?

A

Doesnt create a separate process when executing a shell; runs on the exploited process

Doesnt touch the HD, stays in memory

Incloudes its own set of commands, so doesnt use the target systems commands

Can load new modules and dynamically cahnge its functionality all from the memory of the affected process

133
Q

Meterpreter works on what OS?

A

Windows, PHP (web server, web client w/php) JRE and Linux. MacOSX is under dev.

134
Q

what application discussed in class can generate NOP sleds?

A

Metasploit

135
Q

What application can generate wrappers for shellcode?

A

metasploit

136
Q

Marks certain pages, such as the stack, as non-excutable as well as marking memory areas where legit code is present as non-excutable

A

MS Data Execution Prevention (DEP)

Helps agaionst buffer overflows

137
Q

Two kinds of Data Execution Prevention

A

Hardware based- only works on machines that support it.

Software based - works in essential windows programs and services, such as RPC locator.

138
Q

Little chunks of OS code an attacker wants to execute as part of a buffer overflow is called a _____-

A

gadget

Used to orchestrate attack steps using legit OS libraries instead of trying to insert code into the stack.

139
Q

3 types of code canaries

A

Random - uses random values to protect the return pointer
Terminator - Throws null bytes to protect return pointers, because it will render payloads moot when appended to them`
XOR - Uses non-predictable values for return pointers

140
Q

Grab data from the network (such as python scraping tool) and parse it for an application.

A

Protocol parsers: dangerous

141
Q

Why are protocol parsers dangerous?

A

Its hard to get right
The code that breaks the data down into fields is rife with buffer overflows
Lot of coping things around in memory
Bad bounds checking

142
Q

How can protocol parsers “lie in wait”

A

An attacker can flood a bunch of machines with an exploit for a service that the parser is vulnerable to, and wait for the application to use the protocol parser to view data grabbed from the network

143
Q

Defense against protocol parser vulns

A

Use protocol parsers as little as possible

Pay extra attention to sniffer tools (Wireshark, Snort, Bro, Suricata, tcpdump, etc) Patch these regularly!

144
Q

How do you inject malicious macros in PPT?

A

Key is to have them run the macro when the file opens and when a user interacts with the presentation.

145
Q

How do we trick users with malicious powerpoints?

A

Inject the code we want to run via “Veil-Evasion” MSF module, broken up into digestible bites (macrosafe.py) and then enable the script to run when the user interacts with a slide, using “Run_on_open” or “on mouse click” or “on mouse over” actions. Boom. Evades AV, too.

146
Q

what is ghost writing?

A

Changing assembly code (adding junk) to change signatures and evade AV

147
Q

Easy way to change a files code signature via assembly

A

Create an exe
Convert it to an .asm file
edit the .asm file (add anything)
convert it back to .exe`

148
Q

Easiest thing to add to assembly to just add something (avoiding AV signatures)

A

add a push, pop any time something XOR’s itself (meaning the register is empty)

would look like this:
push eax
pop eax
xor eax, eax

149
Q

Using lesser known languages to write payloads may help them execute because…

A

signatures are more common against known payloads

150
Q

What is an environmentally keyed payload?

A

Where malware searches the runtime environment for strings, such as a directory name, and attempts to decrypt the binary with each, which makes the signature unique.

151
Q

Whats an example of adjusting how malware is executed that can evade AV?

A

Have the malware payload trigger on uninstall, not by execute.

152
Q

Sharpview and Enum tools do what?

A

Enumerate users, groups, etc via SMB/findstr

153
Q

What is Powershell empire?

A

Backdoor for Powershell

Post-exploit; can scan for vulnerabilities and systems to compromise. Enumerate shares and users across domains.

154
Q

What is bloodhound?

A

Tool that finds the quickest way to get domain admin privileges. GRAPHICS!

155
Q

Defenses against manipulation of SMB

A

Block at boundaries/local firewall:
TCP 445, 135, 137, 139
UDP 445, 137, 138

Explicitly allow SMB only from specific places you want it to come from

Check IDS/IPS logs

156
Q

Trying to guess a small number of potential passwords against a large number of target machines (1-2 passwords against a large user base)

A

password spraying

157
Q

determining a password when you only have the password file/ciphertext representation

A

password cracking

matching output of guess+algorithm and comparing against encrypted passwords

158
Q

Unix/Linux friendly password guessing tool

A

Hydra

159
Q

Fastest method for cracking passwords

A

Dictionary

160
Q

3 methods of password cracking

A

Brute force
Dictionary
Hybrid (dictionary with numeric/symbols) baked in

161
Q

Why you shouldn’t use password cracks for migrating users to new platforms

A

non-repudiation. (cant prove its only the user w/a password)

162
Q

Weak password hashing mechanism still in regular use

A

Windows LANMAN. converts everything to UC, padded with null bytes to a fixed length (14 bytes)

Split and used for keys for DES, a weak encryption al;g.

163
Q

Replacement for LANMAN

A

NT Hash: still not great.

164
Q

Why is NT Hash better than LANMAN (2 reasons)

A

Case is preserved

Doesn’t store a LANMAN hash if it’s greater than 14 chars**

165
Q

Why are NT Hashes and LANMAN both inherently insecure?

A

They don’t use salts

166
Q

What is a password Salt

A

A short, randomly selected string added to a password before hashing, adding randomness to the hash

167
Q

Feature that defeats ranbox tables attack

A

Salts

168
Q

built in windows tool that lets you get a backup of AD, which can be used to get hashes (exec and command)

A

ntdsutil.exe

activate instance ntds, ifm

169
Q

What is in NTDS.dit? How is it decrypted?

A

DC Hashes, use the registry hive keys to extract the hashes

170
Q

Empty values in password dumps are easy to recognize by

A

Specific values
aadbb (first letters, LANMAN): Am All Day Baffled By
dcfed (first letters, nthash) Difficult Choices for Encrypted Data

171
Q

The password hash is ______ in /etc/passwd or /etc/shadow

How do you know what hash type is used?

A

The second field, colon delimited

Will be $#, and the number corresponds to a specific type. ($1 is MD5, $5 is SHA-256, no indicator is DES)

172
Q

Order of fields in /etc/shadow

A

user:
$hash type
salt (4 or 8 chars)
hash value.

173
Q

Hashing is still insecure if it doesn’t feature

A

Multiple rounds, salts

174
Q

How to mitigate GPU based powerful password crackers

A

Use PBKDF2, BCRYPT, SCRYPT

Uses multiple rounds, HMAC,

175
Q

Little used powerful (new) hashing algorithm

A

Argon2

176
Q

You must feed John a…

A

encrypted password file

177
Q

For Linux systems you’re cracking with John, if they use /etc/shadow, you must…

A

merge /etc/passwd and /etc/shadow via “unshadow” command

178
Q

How to handle LANMAN hashes being stored

A

Stop storing LANMAN hashes by changing the LSA registry key. (add a “NoLMHash” key. LANMAN goes away next password change)

179
Q

Audit passwords with….

A

Group policy, DOmain Password Audit tool

180
Q

Adds password complexity and additional capability to *Nix systems

A

PAM modules. Works with Kerberos, Radius, etc. Enforces password complexity.

181
Q

Rather than cracking a original passwords once the hashes are stolen, this technique lets you just reuse the hash to authenticate via Challenge/Response, NTLM, or NTLM V2

A

Pass the Hash

182
Q

Pass the hash attacks are usable once the attacker loads the hashes into his memory space and then utilizes….

A

SMB based access, like net use

183
Q

Windows Credential Editor gives you what capability upgrade from a standard from Pass the Hash

A

Pass-the-Ticket

184
Q

Windows 10 defense against pass-the-hash and hash theft

A

Credential guard; virtualization containers abstract from the main operating system.

185
Q

Can do what locally to disable PTH style attacks?

A

Change the TokenFilterPolicy in HKLM\Software\MS\etc to ‘0’ which denies remote users the ability to execute commands on a target system.

Disable the local admin account.

186
Q

What is kerberoasting?

A

Kerberoasting is a technique which exploits a weakness in the Kerberos protocol when requesting access to a service. (Such as IIS)

Doesn’t need to be an active service, just needs to have a service account. (Uses the SPN: Service Principal Name)

Attack gets you a service ticket, which has a portion of the service accounts password hash included.

187
Q

What’s the important artifact to get in a kerberoasting attack?

A

the important part is that the service ticket is encrypted with the hash of the service account, which allows any authenticated user on a Windows domain with the ability to request a service ticket from the TGS to perform an offline bruteforce attack.

188
Q

Tool to extract password hashes from service tickets gained from kerberoasting

A

Impacket and Mimikatz

189
Q

Defenses against pass the hash/kerberoasting

A

Host Firewalls to block SMB in client/client comms (restrict inbound to admins)
Use LAPS to manage unique and complex local admin passwords. (Keeps one admin hash from being used on multiple machines)
Use TPM
Use Credential guard
Look for unusual admin activity/use of Net (use, sessions) commands

190
Q

attack tools that carry multiple exploits and can spread themselves using all of them (and an example)

A

Multi exploit worms, such as Conficker

191
Q

Mechanisms for Conficker to spread

A

Buffer overflow for Windows
Copying itself to a thumb drives
guessing passwords for SMB shares and moving between shares

192
Q

Why was Stuxnet considered a multi platform worm

A

Attacked Windows, but pivoted to Siemens ICS sW, Scada systems

193
Q

Worm that exploited Windows LSASS vulns

A

Sasser

194
Q

Exploits a UPnP flaw

A

Zotob

195
Q

Uses for Bots

A 
Maintaining Backdoor control of a machine
Controlling an IRC channel*
Mail Relays
Providing anonymizing HTTP proxies
DoS floods
196
Q

Collection of bots under the control of a single attacker is called a

A

botherder

197
Q

Bots are particularly useful for spreading through

A

infected web sites that can compromise browser vulnerabilities

198
Q

Attackers communicate with bots via

A

IRC (6667 standard, but can use anything)
HTTPs
DNS
Social networking sites

199
Q

Modern bot comms techniques utilize

A

Non standard IRC ports
3rd party websites (http)
Social networking sites via HTTP (bot surfs to popular sites over port 80 and parses commands from specific profiles)
DNS

200
Q

Bots stay persistent/hidden by (6 methods)

A 
Morphing the code for infection
Run commands with system privs
add/remove file shares
FTP files
add autostart
scan for other vulnerable systems
201
Q

What is GRE?

A

Generic route Encapsulation: lets you set up a direct PTP tunnel, like IPSEC. (used by bots)

202
Q

Defense against bots

A
  1. Harden systems
  2. Set specific plans for quick patching/testing patches
  3. Encrypt hard drives (so stolen data cant be read easily)
  4. EDR tool
  5. App whitelist
  6. Host based IPS
203
Q

Defense against account harvesting

A

Auth messages should be consistent as to not give away whether accounts are valid

Use account lockouts (times

Have “canaries” for multiple bad passwords on different accounts being hit in succession

204
Q

Time inference confirmation is what?

A

Looking at the time delay on command injection when you cant see the response

205
Q

Defense against command injection

A 
Fix flaws in code
Use a WAF
Dont have applications launch shells or execute commands
Validate input
Sanitize input
206
Q

Filter output characters from a website output with this tool

A

Modsecurity for Apache, IIS, and Nginx

207
Q

Server defenses against XSS

A

HttpOnly flag set (limits cookie accessibility)
use COntent Security Policy (CSP) to set what dynamic resources are allowed to load in the browser
Report sanitized content to a specific url if detected

208
Q

What browser is vulnerable due to a lack of content security policy (CSP)

A

IE

209
Q

Where and how can you support browser XSS flaws with CSP turned on?

A

An external URL, via report-uri feature

210
Q

Ways web sites track state (sessions)

A

Sending back a user ID/credential
Hidden form elements on the page
cookies

211
Q

How does a DNS amplification attack work?

A

Utilizes EDNS, a standard that lets DNS packets be bigger than normal DNS packet size.

Attacker gets DNS server to store a 4000 byte txt file, as part of normal DNS operations. (Recursion)

An attack sends fake (spoofed) DNS requests on behalf of the victim, with the EDNS flags set, which amplifies the size (by sending the 4000 byte txt file) of the response by over 60 times. Floods (and DDoS) the victim.

212
Q

How does a DDoS packet flood work?

A

Attacker (via compromised client) sends a bunch of spoofed SYN packets to a high-bandwith server; that server then responds w/SYN-ACK to victim.

213
Q

Why are HTTP floods harder to detect than SYN floods?(DDOS)

A

Syn floods never complete the 3 way handshake, which creates an abormal comms state to track.

HTTP floods (where the attack finishes the request and then executes a command) are normal comms state, and are easier to track (and harder to identify/stop!)

214
Q

Defenses against DoS style attacks

A
  1. Keep DDoS off your machines (IDS/IPS/AV)
  2. Antispoof Egress filtering at border routers
  3. Ensure adequate BW
  4. ISP controls
  5. Use traffic shaping tools against floods
215
Q

How do you secure VNC?

A

Tunnel it through SSH:

ssh -L 5901:localhost:5901 REMOTE_IP

216
Q

VNC servers passively listen on what port, connect outbound on what port?

A

5900, 59001 (management ports)

VNC servers can also listen on ports 5800, and can shovel a session to clients using a small java applet. Clients can listen on port 5500 for a GUI session to be “shoveled” to them.

217
Q

Two modes for VNC

A 
App mode (shows up in tools tray)
Service mode (shows up in service list)
218
Q

Standard capabilities of remote control backdoors (like Poison Ivy, Rat, etc) (7)

A
  1. Keystroke logger
  2. Create dialogue boxes with customizable text/action
  3. Lock up/reboot system
    4, Get system info
  4. Access files
  5. Create VPNs to outbound system
  6. Camera and Audio capture
219
Q

What is scareware?

A

What bob got infected with; “Install our security monitoring software” which is just a trojan.

220
Q

what is a packer?

A

Originally used to just compress code and deliver more in a smaller package for malware, it’s now used to make reversing much harder.

221
Q

Why does a packer make reversing harder?

A

It cant be directly disassembled and doesn’t reveal many interesting strings

222
Q

memory file for virutal vmware hosts

A

.vmem file

223
Q

things you can look at with Rekall

A

Network connections
Processes
Map processes (PIDs) to network connections (netscan)
DLL’s loaded by a process

224
Q

Rootkits dont let a user GET root access, they let an attacker…

A

MAINTAIN root access by affecting existing programs/OS modules on the underlying system.

225
Q

Examples of linux rootkit methods

A

Replace the login, rshd, sshd, inetd, tcpd with ones that have backdoor access built in

Re-write commands to include root level backdoors, like changing the SU process.

226
Q

4 categories of hiding tools found in rootkits

A 
Process hiding (changes to processes like ps/top)
Network Hiding
File Hiding (ls/find commands)
Event Hiding (syslogd, to keep attackers activity from producing events)
227
Q

How does a rootkit DLL injection attack get its code onto a system (4 steps)

A
  1. Allocates space in the process’ memory space, using “VirtualAllocEx” windows process
  2. Writing the name and code of the injectable DLL into the memory space of the victim process (writeProcessMemory)
  3. Create a thread in the victim process to run the new DLL
  4. Free up resources in the victim process after execution (cover tracks)
228
Q

What is API hooking?

A

When an attacker undermines and running process in its interactions with the Windows itself

229
Q

The memory space that privileged (sensitive) software runs at, where it cannot be accessed by code running at less privileged level

A

Ring 0 (most sensitive)

Ring 3 is normal user mode

230
Q

To interact with a kernel, user-mode processes use

A

System calls

231
Q

How do system calls work?

A

A user level process calls a system library, which is full of code and tables. The tables are just arrays mapping system calls to the corresponding kernel parts needed to handle each call. (Collection of pointers)

232
Q

How do you implement a kernel mode rootkit?

A

Loadable kernel modules (*nix) and device drivers (windows)

Altering kernels in memory

Changing out a kernel file on HD

virtualizing systems** (not seen often

233
Q

Windows defense against loading kernel components via drivers

A

Mandatory device driver signing

234
Q

How to circumvent windows device driver signing

A

Steal the private keys for a legitimate software componany

Bypass by manipulating the memory

235
Q

Manipulating the paging file allows what rootkit style attacks?

What does this bypass?

A
  1. Hog system memory
  2. System offloads its functionality to the system page file
  3. Manipulate page file
  4. Release memory, allowing page file to be sucked back up into memory.

(bypasses the driver device signing processes)

236
Q

location of linux and windows kernels. (Where they’d be overwritten by malicious code)

A

Linux: vmlinuz
Windows: ntoskrnl.exe and win32k.sys

237
Q

What other file must be manipulated to get an altered windows kernel file to load?

A

Have to manipulate the NTLDR program, which checks the kernel integrity at bootup. (Use a few language instructions to skip the integrity check)

238
Q

How does network forensic tools (like Security Onion) look for patterns reflective of malware activity?

A

Look for large amounts of client-client traffic, server-server traffic, worm traffic (large bursts of activity)

239
Q

Eradication techniques for rootkits

A

Wipe/reformat
Reinstall O/S
Apply all patches
change all passwords

240
Q

Easiest way to hide files in *.nix

A

renaming files space, ., or ..

241
Q

places to hide files on linux systems

A

/dev
/etc (bad place, usually monitored)
/tmp

OR

Complex/random place on file system, like /usr/man or /usr/src

242
Q

How will sophisticated attackers hide tracks in linux logs?

A

Edit out individual log entries, vice wiping logs

Edit shell history/bash history

243
Q

How to completely kill the shell history file

A
  1. Kill the shell, which prevents the recent shell history from being written
    Kill all bash shells, to do the same
  2. Change the SIZE of the bash history file to zero (unset HISTFILE)
  3. add a space before a command to keep bash from logging it in the first place
244
Q

what do you have to do to edit utmp files, and what do they do?

A

Contain information about logged in users, current and historical

Shows login successes and failures

Need a specific editor that can work with those files, like remove.c or wzap.c, etc.

245
Q

What do tools like wtmped.c, marry.c, cloak.c. ,etc do?

A

Wipe user activity logs on linux, such as /var/run/utmp(current logins) , var/log/btmp (bad logins)

246
Q

WHat are NTFS file streams?

A

Extra “drawers” (like a dresser) that you can throw data into, that are attached to a file. Stream 1 is the contents of the file, Stream 2+ is added streams. Stream 1 is the only thing that will show in windows explorer

247
Q

What file structure is required to write data streams in Windows?

A

NTFS. Doesnt work with FAT, etc.

248
Q

What type of streams does windows store that are visible in windows explorer?

A

Only the main stream (stream 1, the file contents) Additional streams dont show.

249
Q

Do streams copy with a file?

A

yes

250
Q

How do you see alternate streams on NTFS systems? (2 ways)

A

dir /r
Get-Item powershell with -property stream option

some AV can detect it if theres malicious code in it)

251
Q

How do remove an Alternate Data Stream (ADs)

A

move it to a fat partition

no built in windows tool

252
Q

Tool dedicated to finding alternate data streams on NTFS

A

LADS

253
Q

Log file format for windows logs

A

EVT files (not editable directly)

254
Q

Tools for manipulating windows log files?

A

NSA Danderspritz tool, with the evetlogsedit

Metasploit clearev log file wiping utility

255
Q

What is the normal state of windows event logs

A

Immutable files, write protected and cannot be altered by normal means on a running system (but tools are available to do it)

256
Q

Best way to defend manipulation of event logs

A

Use a separate logging server
Use Windows event Forwarding to throw logs to an alternate location
Add integrity checking software to keep an eye on windows log file locations

257
Q

Some behavior analytics toools

A 
MS Advanced Threat Analytics
Rapid7
InsightIDR
Exabeam
JPCERT (open source)
258
Q

Open Source threat hunting tool

A

LogonTracer from JPCERT

259
Q

Hiding network activity

A

Carry one protocol on top of another (encapsulate one protocol inside another)

260
Q

How does a reverse HTTP shell work

A

Connection is established over HTTP from WITHIN the victims network, on a pull basis. At set intervals, the reverse shell reaches out over the internet and tries to connect to the attackers internal machine. Attacker then sends commands back to the origin as HTTP responses.

261
Q

Tools that allow you to tunnel traffic inside ICMP

A

Ptunnel (TCP over echos/replys: Windows or Linux)
Loki (*linux shell)
PingChat (Windows Chat Program)
ICMPCmd (Windows cmd access)

262
Q

Tool that would let you communicate on a network that heavily filters tcp and udp packets

A

ICMP comms via PTUNNEL or PingChat

263
Q

Two components to Ptunnel

A

Client and Proxy
Client listens on a given TCP port, Proxy funnels traffic over ICMP. (has to be reachable by ping)

The proxy sends the ICMP packet outbound with the TCP data in the payload to any TCP based server on the net, and also communicates with the Client on a normal TCP port.

264
Q

Ptunnel uses what for authentication?

A

MD5 challenge/response

265
Q

SCTP and QUIC are good protocols to use for tunneling covert traffic because…

A

they are multiplixed/multihomed, which means multiple hosts can be used as failover.

Not many signatures for newer protocols

266
Q

FUll C+C backdoor where all commands flow over gmail

A

GCAT

267
Q

Defenses against covert channels being used

A

Investigate odd processes, especially with admin privs
Network IDS set to analyze:
Shell commands over HTTP
unusual ICMP messages/size
Unusual changes in IP ID/Seq/Ack fields for TCP covert tunneling

268
Q

Tool for finding stego

A

StegExpose - java utility looks at the Least Significant Bit for techniques where this is a tell

269
Q

Defense against stego

A

get familiar with the tools
File integrity checks
look at hashes for changes in data w/original

270
Q

Netstat command for getting processes and connections

A

netstat -naob

271
Q

What is lsof -i going to produce?

A

Find out if a service is running?

272
Q

Using powershell, creates a stacked analysis of the installed software in your environment

A

Kansa

Exams (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions