Lecture1 Introduction

Question 1

Zero Day Attack

Answer 1

One for which there is currently no fix available

- code for these types of attacks advertised on special websites

Question 2

Ping sweep followed a day later by a port scan…

Answer 2

administrators know their systems may soon be under attack.

Question 3

Hacking tools are really just …

Answer 3

software tools that carry out some specific types of procedure to achieve a desired result.

• The tools can be used for good (defensive) purposes or for bad (offensive) purposes.
• good and bad guys use the same exact toolset; the difference is their intent

Question 4

During a vulnerability assessment, some type of automated scanning product is used to …

Answer 4

to probe the ports and services on a range of IP addresses

Question 5

The problem with most vulnerability scans is, ….

Answer 5

although they indicate the severity of a vulnerability, they rarely indicate its impact.

Question 6

Vulnerability scanning allows you to identify a piece of software as being vulnerable to exploit; a penetration test takes this further by ….

Answer 6

exploiting vulnerabilities and, for example, accessing sensitive information.

Question 7

Most vulnerability scanners indicate what might be vulnerable based on versioning and some more invasive checks, but a penetration test indicates …

Answer 7

whether the vulnerability scanner finding is real or a false positive.

Question 8

Penetration testers leverage identified vulnerabilities until …

Answer 8

until they own the domain or environment.

Question 9

Being “owned” means …

Answer 9

means either having root privileges on the most critical Unix or Linux system or owning the domain administrator account that can access and control all of the resources on the network.

Question 10

Statement of Work (SOW)

Answer 10

written agreement, including scope, signatures, and legal requirements

Question 11

2 - Passive Scanning

Answer 11

gather as much information about the target as possible while maintaining zero contact
- also known as Open Source Intelligence (OSINT),

Question 12

3 - Active Scanning and Enumeration

Answer 12

probe the target’s public exposure with scanning tools,

- War dialling, Wireless war driving, DNS zone transfers, Sniffing traffic, network mapping, Banner grabbing

Question 13

4 - Fingerprinting

Answer 13

Perform a thorough probe of the target systems to identify:

• Operating system type and patch level
• Applications and patch level
• Open ports
• Running services
• User accounts

Question 14

5 - Select Target System

Answer 14

Identify the most useful target(s).

Question 15

6 - Exploiting the Uncovered Vulnerabilities

Answer 15

Execute the appropriate attack tools targeted at the suspected exposures

Question 16

7 - Exploiting Privilege

Answer 16

Escalate the security context so the ethical hacker has more control.

Question 17

8 - Documenting and Reporting

Answer 17

Document everything