Misc

Question 1

What are the nmap switches for outputting to a file

Answer 1

Save default output to file - nmap -oN outputfile.txt 192.168.1.1
Save results as XML - nmap -oX outputfile.xml 192.168.1.1
Save results in a format for grep - nmap -oG outputfile.txt 192.168.1.1
Save in all formats nmap - -oA outputfile 192.168.1.1

Question 2

What are the common nmap switches

Answer 2

• sS - TCP SYN scan
• sT - Connect scan
• sA - ACK scan
• sW - Window scan
• sM - Maimon scan
• sU - UDP Scan
• sN - TCP Null scan
• sF - FIN scan
• sX - Xmas scan

--scanflags
Customize TCP scan flags
-sI zombie host[:probeport]
Idle scan
-sY - SCTP INIT scan
-sZ - COOKIE-ECHO scan

• sO - IP protocol scan
• b “FTP relay host” FTP bounce scan

Question 3

Which part of a SQL hash is the salt?

0200b3baedc103b6a07bbee0b059c98d0006xxxxxxx775b

1 - 00b3
2 - 775b
3 - 0200
4 - bbee0

Answer 3

1 - 00b3

the first two bytes is just a prefix, then it’s four bytes of salt, and then we are using SHA2-512 to generate the hash of the password

0200b3baedc103b6a07bbee0b059c98d0006xxxxxxx775b

Question 4

What are the ping commands

Answer 4

-t Pings the specified host until stopped.
To see statistics and continue - Type Control-Break;
To stop - press Ctrl+C.
-a Resolve addresses to hostnames.
-n count Number of echo requests to send.
-l size Send buffer size.
-f Set Don’t Fragment flag in packet (IPv4-only).
-i TTL Time To Live.
-v TOS Type Of Service (IPv4-only. This setting has been deprecated and has no effect on the type of service field in the IP Header).
-r count Record route for count hops (IPv4-only).
-s count Timestamp for count hops (IPv4-only).
-j host-list Loose source route along host-list (IPv4-only).
-k host-list Strict source route along host-list (IPv4-only).
-w timeout Timeout in milliseconds to wait for each reply.
-R Use routing header to test reverse route also (IPv6-only).
Per RFC 5095 the use of this routing header has been deprecated. Some systems may drop echo requests if this header is used.
-S srcaddr Source address to use.
-4 Force using IPv4.
-6 Force using IPv6.
Windows XP and lower syntax
ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS] [-r count] [-s count] [[-j host-list] | [-k host-list]] [-w timeout] destination-list
Options:
-t Pings the specified host until stopped.
To see statistics and continue - Type Control-Break;
To stop - press Ctrl+C.
-a Resolve addresses to hostnames.
-n count Number of echo requests to send.
-l size Send buffer size.
-f Set Don’t Fragment flag in packet.
-i TTL Time To Live.
-v TOS Type Of Service.
-r count Record route for count hops.
-s count Timestamp for count hops.
-j host-list Loose source route along host-list.
-k host-list Strict source route along host-list.
-w timeout Timeout in milliseconds to wait for each reply.

Question 5

What overflow vulnerability is associated with Symantec 3.1?

Heap Based
Stack Based
Memory Based
All of the above

Answer 5

Stack Based

Question 6

What overflow vulnerability affects ProFTP 1.2?

Heap Based
Stack Based
Memory Based
All of the above

Answer 6

Stack Based

Question 7

What are the wireless frequencies?

Answer 7

802. 11a - 3.7/5GHz - 54MBps
803. 11b - 2.4Ghz - 11MBps
804. 11g - 2.4 GHz - 54 MBps
805. 11n - 2.4/5GHz - 150 MBps