Mod 14 Flashcards
PORT 445
SMB Direct | TCP
WINDOWS HASH:
___ - A secure asymmetric algorithm. Passwords up to 256 characters (all ASCII characters, 211 unique characters).
NT LAN Manager (NTLM) Hash
NETCAT Options:
__ = Help; provides all options
-h
PAYLOAD TYPES:
___ - Opens a port on the target system and listens for incoming connections. The attacker initiates the connection (call-in) to the target. Firewalls often block the connection.
Bind TCP
___ gathers information about a target of interest without actually probing the target.
Passive Analysis
Syntax for Nikto
nikto -host
- host = specific target host
- H = list all options
PORT 110
POP3 | TCP
___ ties directly into the target development aspect of the Target Research/SIGINT Analysis Module.
Information Gathering
___ - Designed to target a specific vulnerability in an application. Most common method of execution in use is the Buffer Overflow.
Code-Based Exploit
Active Exploitation skills are also employed in the civilian sector by network security professionals who perform ___.
Penetration Tests (pentests)
SCAN EXTENSIONS:
___ = Version detection communicates with ports to determine what is actually running.
-sV
___ is a technique that involves connecting to common applications on target host to identify version of running applications. Can be done suing Nmap, Telnet, and Netcat.
Banner Grabbing
PORT 513
RLOGIN | TCP
PAYLOAD TYPES:
Staged systems:
___ - Fully functional remote shell loaded by the Stager. Offers the availability to run commands on the target system through a remote shell.
Stage (s1)
NETCAT Options:
__ = Indicates verbose details; it only reports open ports.
-v
___ is a command used to generate and output various types of shellcode payloads. Used for standalone custom payloads, used outside of Metasploit framework.
msfpayload
HOST DISCOVERY:
___ = Disable host discovery. Does not ping hosts at all before scanning them; allows scanning of networks through firewalls that block ICMP.
-Pn
PORT 3389
RDP | TCP
PORT 53
DNS | TCP & UDP
Exploits used through ___ do not use encryption so, when traversing a hop, the exploit and payload is vulnerable to exposure and capture.
Satellite Hops
Linux:
Syntax for ping with record route.
ping -R
-R = invokes record route option
United Stated Codes (USC)
Title 18 ___ - Store Wire and Electronic Communications and Transactional Records Access. Unlawful Access to Stored Communications.
Title 18 USC 2701
Cisco IOS Passwords:
Type 7 is ___ and type 5 is ___.
Symmetric
Asymetric
NETCAT Options:
__ = Reports all responses within the range
-vv
OS: Linux
Example: CentOS, Kali
TTL: ___
TTL = 64
UNIX/Linux hashes are store in the ___ file.
/etc/shadow
NORMAL PROGRAM EXECUTION:
___ - When a program needs to perform a specific procedure, the program’s main routine call out a subroutine.
Function Call
PORT 80
HTTP | TCP
The _ program is the purpose of the exploit. It gets execution from the NOP sled and provides access to interact with the OS across the network.
Payload
___ is available in most Unix/Linux variations and can perform zone transfers. ___ take IP addresses or server names as arguments.
dig
PORT 135
RPC | TCP
United Stated Codes (USC)
Title 18 ___ - Fraud and Related Activity in Connection with Computers.
Title 18 USC 1030
___ uses UDP by default for traceroutes.
UNIX/Linux
METERPRETER COMMANDS:
___ - List running processes.
ps
Common tools for online password cracking include: ___ and ___.
THC Hydra
L0phtCrack
PORT 138
NetBios Datagram | UDP
PORT 3306
MYSQL | TCP
The ___ parameter is set to the target IP address where the payload is running (these options may change when using tunnels).
RHOST
Three types of traceroute are:
ICMP, UDP, TCP
___ Includes activites taken to minimize the exploitation footprints in a target network, discovering and documenting information about targets of interest, and remain undetectable by using obfuscation techniques.
Tradecraft
SCANLINE Options:
- n =
- b =
- p =
- t =
- u =
- z =
- ? =
SCANLINE Options:
- n = No port scanning
- b = Get port banners
- p = Do not ping before scanning
- t = TCP ports to scan
- u = UDP ports to scan
- z = Randomize IP and port scan order
- ? = Help
United Stated Codes (USC)
Title 18 ___ - Fraud and Related Activity in Connection with Access Devices.
Title 18 USC 1029
METERPRETER COMMANDS:
___ - Displays target system information.
sysinfo
Metasploit Module Categories:
___ - Contains code that exploits run on targets, such as command shell access.
Payloads
A small assembly program called ___ makes up the payload.
shellcode
Ports:
6667 = ___
Linux
___ is an extremely versatile tool designed for network and password auditing. Uses dictionary and brute force BUT also uses cryptanalysis attacks to break hashing schemes.
Cain and Abel
The ___ modernised US Cybercrime legislation and mandates life sentences for offenders who knowingly or recklessly cause or attempt to cause the death of other by attacking transportation systems, power companies, or other public services or utilities.
Cyber Security Enhancement Act of 2002
Metasploit Module Categories:
___ - Contains advanced scanners and server modules.
Auxiliary
PORT 111
SunRPC PORTMAPPER | TCP
NETCAT Options:
__ = No DNS resolution
-n
___ is an offline password cracker. It’s primary configuration file is located at /etc/john.conf.
John the Ripper
TIMING:
__ - __ = Default scanning method. Runs as quickly as possible without overloading.
3 - Normal
PORT 443
HTTPS | TCP
PORT 25
SMTP | TCP
NETCAT Options:
__ = Specifies port to listen on (TCP by default)
-p
METERPRETER COMMANDS:
___ - List out files or contents of a directory.
ls
Ports:
88, 389, and 445 = ___
2K3
Syntax for Nmap
nmap
FILE PLACEMENT:
___ - places files onto target. Useful for putting tools or modified log files onto the target filesystem.
upload
Metasploit Commands:
___ - Set exploit parameters.
set
WINDOWS HASH:
___ - A weak symmetric algorithm. Passwords are limited to 14 characters (A-Z, 0-9, 36 unique characters).
LAN Manager (LM) Hash
PAYLOAD TYPES:
___ - Creates a connection (callback) back to the attacker. Firewalls often allow this connection.
Reverse TCP
PORT 20/21
FTP | TCP
PAYLOAD TYPES:
___ - Self contained and standalone. Exploit delivers a payload in one shot. Most ___ are functional remote shells that offer the ability to run commands on the target system.
Single
