Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

OSCP > Information Gathering > Flashcards

Information Gathering Flashcards

1
Q

What is the first lookup tool to run against a domain like www.megacorpone.com?

A

whois megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What Google hack would allow you to just filter search results to those pages on www.megacorpone.com?

A

site:megacorpone.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What Google hack would allow you to just filter search results to php pages on www.megacorpone.com?

A

site:megacorpone.com filetype:php

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What Google hack would allow you to exclude HTML pages on www.megacorpone.com?

A

site:megacorpone.com -filetype:html

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is recon-ng?

A
  • module-based framework for web-based information gathering.
  • stores results in a database
  • startup by typing “recon-ng”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Recon-ng: what command allows you to find modules?

A

marketplace search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Recon-ng: what command allows you to find out information about a module?

A

marketplace info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Recon-ng: what command allows you to install a module?

A

marketplace install

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Recon-ng: what command allows you to use an installed module?

A

modules load

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Recon-ng: what command allows you to find out information about a module after it has been loaded?

A

info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Recon-ng: what is the Google module that uses the “site:” search operator?

A

recon/domain-hosts/google_site_web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Recon-ng: what command in the Google module to find all subdomains for a site?

A
  • options set SOURCE megacorpone.com

- run

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Recon-ng: what command allows discovered subdomains in the database to be displayed?

A

show hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Recon-ng: what module allows you to resolve IP addresses to host domain names?

A

recon/hosts-hosts-resolve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does SSL Server Test do?

A
  • analyzes a server’s SSL/TLS configuration and compares it against current best practices
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the name of the public site for storing and sharing text, that does not require an account for usage?

A

pastebin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is theHarvester?

A

information gathering tool that gathers, emails, names, subdomains, IPs, and URLs from multiple public data sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What command would allow the use of theHarvester to search for information about the domain megacorpone.com?

A

theHarvester -d megacorpone.com -b google

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the site that allows you to search social media sites for users or a keyword?

A

social-searcher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the process of DNS?

A
  1. Hostname entered into browser
  2. Browser passes the hostname to the OS’ DNS client, and the OS then forwards the hostname to the external DNS server configured for use
  3. The first server in the chain is known as the DNS recursor and is responsible for interacting with the DNS infrastructure and returning the results to the DNS client.
  4. The DNS recursor contacts one of the servers in the DNS root zone.
  5. The root server then responds with the address of the server responsible for the zone containing the TLD (.com TLD)
  6. Once the DNS recursor server receives the address of the TLD DNS server, it queries for the address of the authoritative nameserver for the .com domain.
  7. The authoritative nameserver is the final step in the DNS lookup process and contains the DNS records in a local database known as the “zone file”.
  8. Once the DNS recursor provides the DNS client with the IP address for the hostname, the browser can contact the correct web server at its IP address and load the webpage.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the Zone File?

A
  • The authoritative nameserver contains a zone file.
  • The Zone File is a local database that contains DNS records
  • Their are typically two zones for each domain:
    1) the forward lookup zone used to find the IP Address of a specified hostname
    2) the reverse lookup zone used to find the hostname of a specific IP Address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DNS Records: NS

A
  • Nameserver record

- contains the name of the authoritative servers hosting the DNS records for a domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DNS Records: A

A
  • A record (aka host record)

- contains the IP address of a hostname

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

DNS Records: MX

A
  • Mail Exchange record

- contains the names of the servers responsible for handling email for the domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

DNS Records: PTR

A
  • Pointer record

- used in reverse lookup zones and are used to find the records associated with an IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

DNS Records: CNAME

A
  • Canonical name record

- used to create aliases for other host records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

DNS Records: TXT

A
  • Text records

- contain any arbitrary data and can be used for various purposes, such as domain ownership verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What command can be used to find the IP address for megacorpone.com

A

host www.megacorpone.com

29
Q

What does the ‘host’ command look for?

A

A record

30
Q

How would you look for the MX and TXT records for megacorpone.com?

A
  • host -t mx megacorpone.com

- host -t txt megacorpone.com

31
Q

What are some example hostnames to query against a domain such as megacorpone.com?

A
  • www
  • ftp
  • mail
  • owa
  • proxy
  • router
32
Q

If you had a list of possible hostnames in a list named “list.txt”, what is a one-liner to try Forward Lookup Brute Force against megacorpone.com?

A

for ip in $(cat list.txt); do host $ip.megacorpone.com; done

33
Q

What project has a comprehensive hostname wordlist? How can it be installed?
Where does it install?

A
  • SecLists project
  • sudo apt install seclists
  • /usr/share/seclists
34
Q

What is a one-liner for Reverse Lookup Brute Force for IP addresses in the range 38.100.193.50-100?

A

for ip in $(seq 50 100); do host 38.100.193.$ip; done

grep -v “not found”

35
Q

What is the DNS Zone Transfer command?

A

host -l

36
Q

DNSRecon

A
  • Kali tool

- advanced, modern DNS enumeration script written in Python

37
Q

Namp: Syn Scan

A
  • nmap -sS
  • default Nmap scan
  • Sends a SYN packet to various ports
  • If a port is open, a SYN-ACK packet is received back
  • the ACK packet is NOT sent back
38
Q

What is a benefit of the Syn scan?

A
  • Since there is not an ACK packet (three-way handshake is never completed) the information is not passed to the application layer.
  • This means that the traffic will never appear in any application logs
  • Syn scans are also faster
39
Q

Nmap: TCP Scan

A

nmap -sT

40
Q

Nmap: UDP Scan

A

nmap -sU

41
Q

Nmap: Network Sweep

A

nmap -sn 10.11.1.1-254

42
Q

Nmap: OS Fingerprint

A

nmap -0

43
Q

Nmap: Banner Grabbing/Service Enumeration

A

nmap -sV -sT -A

44
Q

Where are Nmap Scripts located?

A

/usr/share/nmap/scripts

45
Q

What does the NetBIOS service on TCP 139 do?

A

Session layer protocol and service that allows computers on the local network to communicate with each other.

46
Q

Nmap: Scanning for NetBIOS Service

A

nmap -v -p 139,445

47
Q

Tool used for identifying NetBIOS information?

A
  • nbtscan

- sudo nbtscan -r 10.11.1.0/24

48
Q

How do you search for SMB Nmap Scripts?

A

ls -1 /usr/share/nmap/scripts/smb*

49
Q

What is NFS?

A
  • Network File System
  • Distributed file system protocol
  • Allows a user on a client computer to access files over a computer network as if they were on locally-mounted storage
  • Often used with Unix systems
  • Very insecure
50
Q

How do you scan for NFS Shares?

A
  • By using RPCbind on TCP port 111
  • nmap -v -p 111 10.11.1.1-254
  • nmap -sV -p 111 –script=rpcinfo 10.11.1.1-254
51
Q

How do you search for NFS Nmap Scripts?

A

ls -1 /usr/share/nmap/scripts/nfs*

52
Q

How do you run all NFS Nmap Scripts at the same time?

A

nmap -p 111 –script nfs* 10.11.1.72

53
Q

If your Nmap NFS scan uncovered a NFS mount (RPCbind) name “home”, how would you mount it to your machine?

A
  • mkdir home

- sudo mount -o nolock 10.11.1.72:/home ~/home

54
Q

You locate a file on a mounted file share, that you don’t have access to, and belongs to user “1014”.
How could you access this share?

A
  • Add a local user to our machine (where we have mounted the file share) using the “adduser” command
  • Change the UUID to “1014”
55
Q

How do you change a user’s UUID from 1001 to 1014?

A

sudo sed -i -e ‘s/1001/1014/g’ /etc/password

56
Q

Why is SNMP a useful protocol for penetration testing?

A
  • Simple Network Management Protocol
  • Not well-understood by network administrators
  • Often results in SNMP misconfigurations, which can result in information leaks
  • SNMP is based on UDP, and is therefore susceptible to IP Spoofing and replay attacks
  • SNMP protocols 1, 2, 2c offer no traffic encryption
  • SNMP has weak authentication schemes and is commonly left configured with default public and private community strings
57
Q

What is SNMP MIB?

A
  • SNMP Management Information Base
  • Database containing information usually related to network management
  • organized like a tree, where branches represent different organizations or network functions
  • the leaves of the tree (final endpoints) correspond to specific variable values that can then be accessed, and probed, by an external user.
58
Q

Nmap: Scan for SNMP

A

sudo nmap -sU –open -p 161 10.111.1.1-254

59
Q

SNMP Brute Force Tool?

A

onesixtyone

60
Q

How to brute force a network with onesixtyone?

A

echo public > community
echo private&raquo_space; community
echo manager&raquo_space; community

for ip in $(seq 1 254); do echo 10.11.1.$ip; done > ips

onesixtyone -c community -i ips

61
Q

Once you find SNMP services, what can you do from there?

A

Start querying the discovered SNMP services for MIB data

62
Q

What is an SNMP Community String?

A
  • similar to a user ID or password that is sent along with each SNMP Get-Request to get access to a devices’ information
  • if the community string is correct, you’re given access to the devices’ statistics
63
Q

How do you use snmpwalk to enumerate the Entire MIB Tree of a discovered SNMP service?

A
  • snmpwalk
  • snmpwalk -c public -v1 -t 10 10.11.1.14
    • -c = specifies the community string
    • -v = specifies the SNMP version
    • -t = specifies the timeout value (seconds)
64
Q

How do you use snmpwalk to enumerate Windows users?

A
  • snmpwalk -c public -v1 10.11.1.14 1.3.6.1.4.1.77.1.2.25

- 1.3.6.1.4.1.77.1.2.25 == MIB value for Windows User Accounts

65
Q

How do you use snmpwalk to enumerate Windows Processes?

A
  • snmpwalk -c public -v1 10.11.1.73 1.3.6.1.2.1.25.4.2.1.2

- 1.3.6.1.2.1.25.4.2.1.2 = MIB value for Windows Process Path

66
Q

How do you use snmpwalk to enumerate Windows ope TCP ports?

A
  • snmpwalk -c public -v1 10.11.1.14 1.3.6.1.2.1.6.13.1.3

- 1.3.6.1.2.1.6.13.1.3 = MIB value for Windows TCP Local Ports

67
Q

How do you use snmpwalk to enumerate installed software on a Windows machine?

A
  • snmpwalk -c public -v1 10.11.1.50 1.3.6.1.2.1.25.6.3.1.2

- 1.3.6.1.2.1.25.6.3.1.2 = MIB value for Windows running programs

68
Q

What nmap one-liner shows what services are running?

A

sudo nmap 10.11.0.128 -p- -sV -vv –open –reason

OSCP (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions