Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Networking > Intrusion Analysis > Flashcards

Intrusion Analysis Flashcards

1
Q

ngrep purpose, strengths, weakness

A

Simple packet pattern matcher
Quick Commandline execution
Has no notion of anything but packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ngrep -i

A

case insenstive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ngrep -I

A

read from pcap file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ngrep -x

A

print out file in hex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ngrep -X

A

treat match expression as hex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ngrep examine readable chars in payload

A

ngrep -I trace.pcap -W byline “”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ngrep examine for .exe

A

ngrep -I trace.pcap -W byline “.exe” -i

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ngrep for NOPs

A

ngrep -I trace.pcap -xX “0x909090”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Unix Strings + grep

A

strings trace.pcap | grep “.exe”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is p0f

A

passive OS fingerprinting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

p0f pupose, strengths, weakness

A

Passive OS identification
Command line execution
Easily fooled, OS fingerprints not kept up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

p0f use to get OS

A

p0f -s trace.pcap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

tcpflow purpose, strength, weakness

A

Display/Store tcp conversations
command line execution
Not as sophisticated as wireshark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

tcpflow use

A

tcpflow -C -r http.pcap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

tcpreplay purpose, strength, weakness

A

replay captured packets out on network

light weight command line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

tcpreplay uses

A

emulate attacker and victim
tests are repeatable
replay at arbitrary speeds
use to test IDS/IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Chaosreader purpose, strength, weakness

A

Present application data for some protocols
Good visual analysis of sessions, times, packets, protocols
Not maintained and short on some protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Netwitness purpose, strength, weakness

A

Reconstruct session for analysis
Can reconstruct, content search, filtering
commercial and free versions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Wireshark purpose, strength, weakness

A

Capture/view traffic
Free
Handles large pcaps slowly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is pcap ring buffer

A

Wireshark or Tshark

buckets of defined size rotate in ring defined by time or size before each bucket rotates. Can use HDD or memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Tshark ring buffer switch

A

-b

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a flow

A 
source IP
source Port
dst IP
dst Port
Protocol
TCP Flags
Total Bytes and Packets
Times
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Flow terminates when

A

FIN/RST
Inactivity for 63 seconds (depends on vendor)
Activity more than 30 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SiLK tools

A

rwfilter - converts flow record for use by other tools. Output is not real human readable
rwp2yaf2silk - convert pcap to silk flow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the result of the following command?

tcpreplay -l 0 0i eth0
file.pcap

A

play file until Ctrl-C is pressed

26
Q

What is the result of the following command?

ngrep -wi ‘user|pass’
tcp port 25

A

Wrong - Search for case insensitive exact match of “user|pass” over tcp port 25

27
Q

Which protocol is specified in the following capture filter?

rwfilter sample.silk –proto=17 –fail=stdout | rwcut –f 1-5

A

UDP

28
Q

Which command will extract TCP flows and pass them to rwstat to show the
top 5 destination ports by number of flows?

A

rwfilter attack.silk –proto=6 –pass=stdout |rwstats –dport –count=5 –flows

29
Q

Which of the following commands will convert the ‘attack.pcap’ file to
‘attack.silk’?

A

rwp2yaf2silk –in=attack.pcap –out=/tmp/attack.silk

30
Q

What tool may be used in order to reformat tcpdump pcaps into SiLK data for
analysis?

A

rwp2yaf2silk

31
Q

Which of the following Ngrep commands will display packets containing ‘GET’
requests for ‘.jpg’ files?

A

ngrep -i “get.*.jpg”

32
Q

Which SiLK command acts as the primary selection vehicle for processing and
filtering traffic flows?

A

rwfilter

33
Q

Which protocol is specified in the following capture
filter?

rwfilter sample.silk –proto=1 –fail=stdout | rwcut –f 1-5

A

icmp

34
Q

Which of the following filters will focus on a source address of 10.0.0.15,
using TCP with a destination port of 25?

A

rwfilter sample.silk –saddress=10.0.0.15 –proto=6 –dport=25 –pass=stdout | rwcut –f 1-8

35
Q

Which SiLK command acts as the primary selection vehicle for processing and
filtering traffic flows?

A

rwfilter

36
Q

What built-in feature of Wireshark can be used to help identify and reveal
atypical protocol behaviors?

A

Expert System

37
Q

Which BPF filter would be used to only capture a SYN packet?

A

tcp[13]=2

38
Q

Aggregation Tap

A

Port - Aggregates split traffic before sending to monitor device

39
Q

Span tap

A

plug into switch span port

40
Q

Regeneration taps

A

permit multiple monitoring devices to view same traffic

41
Q

Which of the following nmap OS tests is a SYN to a closed port with
options?

A

T5

42
Q

Which packet crafting tool allows you to create your own python modules for
simulating network traffic?

A

scapy

43
Q

Which security tool has a ‘decoy’ option and utilizes a scripting engine
written in LUA?

A

nmap

44
Q

Which of the following nmap OS tests is a Null packet with options to an
open port?

A

T2

45
Q

Which filter would be used in order to identify SYN segments with a windows
size of less than 256?

A

tcp[13] = 2 and tcp[14:2] < 256

46
Q

Which of the following is NOT a reason to craft a packet?

To provide workarounds for IP shortcomings
To evade detection by an IDS
To fingerprint a remote operating system
To elicit a response for mapping live hosts

A

To provide workarounds for IP shortcomings

47
Q

Which of these statements about nmap are NOT true?

A

???

48
Q

Which of the following filters will filter traffic where there are no TCP
flags, the DF bit is set, and the window size is 128?

A

‘tcp[13] = 0 and ip[6] & 0x40 =0x40 and tcp[14:2] = 128’

49
Q

What appears to be abnormal with the following packet?

10.1.1.1.43887 > 10.1.1.2.80: Flags [], win 128, options [wscale
10,nop,mss 265, TS val 4294967295 ecr 0, sackOK], length 0

A

The mss and wscale tcp options should be set only on a segment that has a SYN flag.

50
Q

Which of the tools was NOT designed to have any packet-crafting capabilities

scapy
hping2
nmap
tcpdump

A

tcpdump

51
Q 
One of the tests used by Nmap to do OS fingerprinting is the TCP sequence
ability test (Tseq). What does Tseq do?

It sequentially probes TCP ports 1-65,535 in search of likely entry points in the target.
It observes TCP initial sequence numbers generated by the target’s TCP/IP stack.
It sequences the target’s TCP/IP stack in search of faults to exploit.
It determines whether the target’s TCP/IP stack is configured to process the segments in sequence or in order of arrival.

A

It observes TCP initial sequence numbers generated by the target’s TCP/IP stack.

Examines TCP sequence # generation, TCP timestamp Option

52
Q

Which of the following techniques does nmap NOT use in operating system
detection?
Sending a UDP packet to a closed port
Examines ICMP error message responses
Sending fragmented TCP packets and monitoring the reply
Setting several TCP options and seeing the order of the reply

A

Sending fragmented TCP packets and monitoring the reply

53
Q

Which nmap file contains expected responses for various different operating
systems?

A

nmap-os-db

54
Q

What header fields are mostly used for OS fingerprinting with nmap, in
IPv6?

A

IP

55
Q

What is one advantage of the IP checksum scheme?
Its computational simplicity allows for speedy calculation.
It uses only eight bits, in order to cut overhead.
Its robust design protects against all possible errors.
The IP header cannot be spoofed, since the checksum protects against it.

A

Its computational simplicity allows for speedy calculation.

56
Q

What is an evasion attack?

A

Sending packets that bypass the NIDS’ filters but that the target host accepts.

57
Q

What is the tool ‘Nikto’ used to do?

A

Evades a NIDS by obfuscating strings and does an application-layer attack on a web server.

58
Q

What is the purpose of the UDP pseudo-header?

A

The IP header data stored in the UDP pseudo-header mitigates the risk of a packet being delivered to the wrong host or protocol stack.

59
Q

What are the IP and protocol checksums in the following datagram?

4500 0026 8acc 0000 0111 76af c0a8 0102
c0a8 0103 8acb 829b 0012 1797 0101 2edb
7439 756a 0900 0457 0015 3f9f 2328 0000

A

IP: 0x76af and UDP: 0x1797

60
Q

If a packet is passing through a router and the router puts the first two
octets of the source IP in the first two octets of destination IP field, and
the router puts the first two octets of the destination IP in the first two
octets of the source IP field, what will happen to the packet?

A

The packet corruption will be undetected and delivery will be attempted by the next router in the path.

61
Q

How do the IP and TCP checksums differ conceptually?

A

The IP checksum protects the integrity of the IP header; the TCP checksum protects the TCP header and the TCP data.

Networking (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions