J02: Packet Analysis (PE) Flashcards
What helps move code into the next memory address?
NOP sled
How many bytes make up a shellcode?
25
What is the storage region that holds data while being transferred called?
buffer
In a buffer overflow attack what gets over-written?
memory
If an attacker knew how a program organizes its memory how could it attack that system?
- Inputting too much information for the buffer to handle
- Logically remote into the areas of memory
- Replicate the application to learn its weaknesses
- Attack it with disorganized information
Inputting too much information for the buffer to handle
What does a multi-byte sled have to support?
single opcode inside
In what type of sled can the opcode jump straight to the shell code?
trampoline
In a reverse shell who establishes the connection?
remote machine
What is it called when data stored in the heap is overwritten?
heap overflow
What was the first big buffer overflow attack?
morris internet worm
What is the structure that stores data held on the stack?
stack frame
_____ is a form of buffer overflow attack.
- Heap overflows
- Return to System call
- Replacement stack frame
- All of the Above
All of the Above
What is a method used to get a target machine to initiate an outgoing connection?
phishing email
A buffer can be located _____
- In the heap
- On the stack
- In the data section of the process
- All of the Above
All of the Above
What is a data structure that is used to store values in a particular order and processes the dynamic variables used in the program?
stack
What is the process called of setting a port number to a socket?
binding
What type of an attack is it when the user-supplied input is used to construct a SQL request to retrieve information from a database?
SQL injection
Servers can find it inconvenient to have ____ ____ port numbers assigned.
short term
True/False You can determine in advance exactly where the targeted buffer will be located in the stack frame.
- True
- False
False
What are the three places a buffer overflow usually targets? (use format xxx, xxx, xxx)
stack, heap, data section
What are the locations in the stack area used to store the values referring to one invocation of a routine?
stack frame
What type of an attack is it, when the input is used in the construction of a command that is subsequently executed by the system with privileges of the Web server.
command injection
What is the code supplied by the attacker which is often saved in the buffer being overflowed so that it can be executed?
shellcode
True or False Shellcode is not specific to a particular processor architecture?
- True
- False
False
What is a Run-Time defense that blocks an attacker’s ability to find out where the stack is by placing it in a random spot in memory?
address space randomization
