Mobile Penetration Testing Flashcards
What does IMEI stand for?
International Mobile Equipment Identifier
What does TAC stand for? What is it?
The Type Allocation Code (TAC) is the initial eight-digit portion of the 15-digit IMEI and 16-digit IMEISV codes used to uniquely identify wireless devices.
The Type Allocation Code identifies a particular model (and often revision) of wireless telephone for use on a GSM, UMTS or other IMEI-employing wireless network.
Name a free and open source network security tool for man-in-the-middle attacks on LAN. It can be used for computer network protocol analysis and security auditing. It runs on various Unix-like operating systems including Linux, Mac OS X, BSD and Solaris, and on Microsoft Windows.
Ettercap-ng
Name an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets. Alternative to Burp.
mitmproxy
What Linux tool can you use to configure the local firewall?
iptables
What does SCEP stand for?
Simple Certificate Enrollment Protocol
This protocol is designed to make the issuing of digital certificates as scalable as possible. The idea is that any standard network user should be able to request their digital certificate electronically and as simply as possible.
What are the five things that user-agents are supposed to check when validating SSL/TLS certificates?
- The client is trying to use the certificate for its intended purpose (client or server)
- Is the certificate issued to the resource that the client is requesting
- Is the certificate issued by a certification authority (CA) that I trust
- Is the certificate still valid, according to the expiration date.
- The certificate is not on the revocation list.
What does OCSP stand for?
Online Certificate Status Protocol
What is one way that Ettercap is better than BetterCap, when performing a MITM attack?
Like Cain, Ettercap is capability of certificate impersonation. It allows the user to change certificate details to make it look legitimate.
BetterCap’s certificate is static (*.bettercap.org)
What does HSTS stand for?
HTTP Strict Transport Security
Name the file that grants iOS apps an exception to the App Transport Security requirement.
Info.plist
Name the file that allows Android apps to communicate without TLS.
cleartextTrafficPermitted
What is a RAT?
Remote Access Trojan
What does UDID stand for?
Unique Device Identifier
What does ARP stand for?
Address Resolution Protocol
