Mod 4: CNO Methodology - PE Flashcards
What CNE attack places the attacker in the flow of traffic with the ability to view, Modify, or drop frames in real-time?
- ARP Poisoning
- DNS Poisoning
- DNS Spoofing
- MitM Attack
MitM Attack
What exploit/attack includes a Rogue Access Point?
evil twin attack
This attack type involves and attacker disguising themselves as an application by altering packet headers in an IP address. As a result, users attempting to access a URL connected to the application are sent to the attackers website.
IP spoofing
This is the process of linking attackers MAC address with the IP address of a legitimate user on a Local Area Network using fake ARP messages. As a result, data sent by the user to the host IP address is instead transmitted to the attacker.
ARP spoofing
This attack involves infiltrating a DNS server and altering a website’s address record. As a result, users attempting to access the site are sent by the altered DNS record to the attackers site. ALSO, this is attack is also referred to as what?
DNS spoofing
When assigned or searching for a new target, analysts will source as much intel as possible from all available databases and sources. This is called:
Initial intel dump
This attack affects the stations other than the intended targets, and limits or totally blocks the availability of network resources.
- CTS Attack
- CBTC Attack
- Denial of Service (DoS)
- Man in the Middle (MitM)
Denial of Service (DoS)
This attack sends spoofed CTS frames or sends repeated RTS frames to an AP forcing the AP to send CTS commands.
- CBTC Attack
- Denial of Service (DoS)
- CTS Attack
- IP Spoofing
CTS Attack
This attack causes a client to have to reauthenticate/reassociate with their AP.
- ARP poisoning
- Denial of Service (DoS)
- Deauthentication Attack
- CTS Attack
Deauthentication Attack
The intentional use of RF energy to deny or degrade wireless communications.
- Jamming
- RF theory
- 802.11ab
- Evil Twin Attack
Jamming
Taking multiple LOBs (Line of Bearing) from different directions/angles creates what’s known as a _____, similar to triangulating a position.
fix
How many LOBs (Line of Bearing) are needed to produce an effective fix?
3
What is considered much more accurate than a DF, and uses algorithms to produce an MGRS?
Geolocation
Jamming is associated with the unintentional degradation of wireless communication efforts.
[True / False]
False
When an analyst is provided with a new target, what surveys should the analyst begin with?
- 2.4GHz band and all associated channels
- 5GHz band and all associated channels
- MAC addresses, IP addresses, SSIDs, encryptions and channels
- All the above
All the above
