Lesson 5: Analyzing Vulnerability Scans Flashcards
dpkg -l | grep chkrootkit is used to
find if the chkrootkit file is installed on the system.
locate chkrootkit is used to
find the chkrootkit file.
echo $PATH is used to check if the /usr/sbin:
path is known to the command interpreter.
chkrootkit is used to
detect rootkits.
The Common Vulnerability Scoring System (CVSS) is an industry-standard for
assessing the severity of security vulnerabilities. It provides a technique for scoring each vulnerability on a variety of measures.
The attack vector metric describes how an attacker would exploit the vulnerability there are 4 of them?
Physical (P)
Local (L)
Adjacent Network (A)
Network (N)
The attack complexity metric describes
the difficulty of exploiting the vulnerability
The privileges required metric describes the type of
account access that an attacker would need to exploit a vulnerability
The user interaction metric describes whether the attacker needs to
involve another human in the attack
The confidentiality metric describes the type of
information disclosure that might occur if an attacker successfully exploits the vulnerability
The integrity metric describes the type of
information alteration that might occur if an attacker successfully exploits the vulnerability.
When a scanner reports a vulnerability that does not exist, this is known as a
false positive error.
When a vulnerability scanner reports a vulnerability, this is known as a positive report. This report may either be an accurate
(true positive report) or inaccurate (a false positive report).
When a scanner reports that a vulnerability is not present, this is know as a
negative report.
Buffer overflow: when an attacker manipulates a program into placing
more data into an area of memory than is allocated for that program’s use.
The goal of Buffer Overflow is to overwrite other information in memory with
instructions that may be executed by a different process running on the system.
Privilege escalation attacks exploit vulnerabilities that allow the
transformation of a normal user account into a more privileged account, such as the root superuser account.
Rootkits are hacking tools designed to automate
privilege escalation attacks.
Remote code execution allows the attacker to exploit the vulnerabilities over
a network connection without having physical or logical access to the target system.
Insecure Protocol Use
THIS IS WHERE YOU STOPPED
When an attacker has access to a single virtual host and then manages to leverage that access to intrude on resources assigned to a different virtual machine.
VM escape attack
When an attacker embeds scripting commands on a website that will later be executed by an unsuspecting visitor accessing the site.
Cross-site scripting (XSS) attack
