Module 04 - Enumeration ( EC Mode ) Flashcards
In which of the following enumeration techniques does an attacker take advantage of different error messages generated during the service authentication process?
A. Extracting information using default passwords
B. Brute-force Active Directory
C. Extracting usernames using email IDs
D. Extracting usernames using SNMP
Answer: B. Brute-force Active Directory
Explanation:
Here are some methods attackers can use to extract usernames:
Using SNMP: Attackers can use the SNMP API to extract usernames by guessing read-only or read-write community strings.
Using email IDs: Every email address contains a username and a domain name in the format username@domainname. Attackers can take advantage of the first part to extract usernames.
Brute force Active Directory: A design error in the Microsoft Active Directory implementation allows attackers to brute force usernames by exploiting the “logon hours” feature, which results in different error messages.
Extracting information using default passwords: Users often fail to change the default usernames and passwords provided by the manufacturer or developer of a product. Attackers can use these default passwords to launch attacks on the target network or device.
Which of the following protocols uses TCP port 179 to enable routers for establishing sessions between them?
A. BGP
B. LDAP
C. SNMP
D. SIP
Answer: A (BGP)
Explanation:
Here are some protocols and their associated port numbers:
LDAP: LDAP uses TCP or UDP as its transport protocol over port 389.
BGP: BGP routers establish sessions on TCP port 179.
SIP: SIP typically uses TCP/UDP port 5060 for non-encrypted signaling traffic or port 5061 for encrypted traffic with TLS when communicating with servers and other endpoints.
SNMP: The agent receives requests on port 161 from the managers and responds to the managers on port 162.
Which of the following port numbers is used by the Windows NetBIOS session service for both null-session establishment as well as file and printer sharing?
A. TCP/UDP 53
B. TCP/UDP 389
C. TCP 139
D. TCP 23
Answer: C (TCP 139)
Explanation:
Here are some ports and their associated protocols:
TCP 139: This port is used for null-session establishment as well as file and printer sharing on Windows systems.
TCP/UDP 53: DNS clients communicate with DNS servers on this port during the DNS resolution process.
TCP 23: This port is used by the Telnet protocol for managing networked devices remotely.
TCP/UDP 389: LDAP uses this port for accessing and maintaining distributed directory information services over an IP network.
Which of the following ports provides a name-resolution service for computers running NetBIOS that is also known as the Windows Internet Name Service (WINS)?
A. TCP 22
B. UDP 161
C. UDP 137
D. TCP 135
Answer: C (UDP 137)
Explanation:
UDP 137: NBNS, also known as the Windows Internet Name Service (WINS), provides a name-resolution service for computers running NetBIOS.
TCP 135: Microsoft RPC Endpoint Mapper listens on TCP/IP port 135.
UDP 161: SNMP is widely used in network management systems to monitor network-attached devices such as routers, switches, firewalls, printers, and servers.
TCP 22: Secure Shell (SSH) is a command-level protocol mainly used for managing various networked devices securely.
Jake, an attacker, is performing an attack on a target organization to gather sensitive information. In this process, he exploited the protocol running on port 23 to perform banner grabbing on other protocols, such as SSH and SMTP, as well as brute-forcing attacks on login credentials.
Which of the following protocols is running on port 23?
A. File Transfer Protocol
B. Secure Shell
C. Telnet
D. Border Gateway Protocol
Answer: C. Telnet
Explanation:
Secure Shell:
Secure Shell (SSH) is a command-level protocol mainly used for managing various networked devices securely. It is generally used as an alternative protocol to the unsecure Telnet protocol. SSH uses the client/server communication model, and the SSH server, by default, listens to its client on TCP port 22
File Transfer Protocol:
FTP is a connection-oriented protocol used for transferring files over the Internet and private networks. FTP is controlled on TCP port 21, and for data transmission, FTP uses TCP port 20 or some dynamic port numbers depending on the server configuration
Telnet:
The Telnet protocol is used for managing various networked devices remotely. It is an unsecure protocol because it transmits login credentials in the cleartext format. Therefore, it is mostly used in private networks. The Telnet server listens to its clients on port 23. Attackers can take advantage of the Telnet protocol to perform banner grabbing on other protocols such as SSH and SMTP, brute-forcing attacks on login credentials, port-forwarding attacks, etc.
Border Gateway Protocol:
BGP is widely used by Internet service providers (ISPs) to maintain huge routing tables and for efficiently processing Internet traffic. BGP routers establish sessions on TCP port 179
Which of the following port number is used to exploit vulnerabilities within DNS servers to launch attacks?
A. UDP 137
B. TCP/UDP 53
C. TCP 139
D. TCP/UDP 135
Answer: B. TCP/UDP 53.
Explanation:
The DNS resolution process establishes communication between DNS clients and DNS servers. DNS clients send DNS messages to DNS servers listening on UDP port 53. In case, the DNS message size exceeds the default size of UDP (512 octets), the response contains only data that UDP can accommodate, and the DNS server sets a flag to indicate the truncated response. The DNS client can now resend the request via TCP over port 53 to the DNS server. In this approach, the DNS server uses UDP as a default protocol, and in case of lengthy queries where UDP fails, it uses TCP as a backup failover solution. Some malwares such as ADM worm and Bonk Trojan use port 53 to exploit vulnerabilities within DNS servers. This can help intruders to launch attacks.
Which of the following protocols uses TCP or UDP as its transport protocol over port 389?
A. SIP
B. SMTP
C. SNMP
D. LDAP
Answer: D. LDAP.
Explanation:
LDAP is a protocol for accessing and maintaining distributed directory information services over an Internet protocol (IP) network. By default, LDAP uses TCP or UDP as its transport protocol over port 389.
Simple network management protocol (SNMP) is widely used in network management systems to monitor network-attached devices such as routers, switches, firewalls, printers, servers, and so on. It consists of a manager and agents. The agent receives requests on Port 161 from the managers and responds to the managers on Port 162.
SMTP is a TCP/IP mail delivery protocol. It transfers e-mail across the Internet and the local network. It runs on the connection-oriented service provided by transmission control protocol (TCP), and it uses the well-known port number 25.
Session initiation protocol (SIP) is used in the applications of Internet telephony for voice and video calls. It typically uses TCP/UDP port 5060 (nonencrypted signaling traffic) or 5061 (encrypted traffic with TLS) for SIP to servers and other endpoints.
Which of the following protocols provides reliable multiprocess communication service in a multinetwork environment?
A. SMTP
B. TCP
C. SNMP
D. UDP
Answer: B. TCP.
Explanation:
Transmission control protocol (TCP) is a connection-oriented protocol. It is capable of carrying messages or e-mail over the Internet. It provides reliable multiprocess communication service in a multinetwork environment.
UDP is a connectionless protocol, which provides unreliable service. It carries short messages over a computer network.
SMTP is a TCP/IP mail delivery protocol. It transfers e-mail across the Internet and the local network. It runs on connection-oriented service provided by TCP.
Simple network management protocol (SNMP) is widely used in network management systems to monitor network-attached devices such as routers, switches, firewalls, printers, servers, and so on.
An attacker identified that port 139 on the victim’s Windows machine is open and he used that port to identify the resources that can be accessed or viewed on the remote system. What is the protocol that allowed the attacker to perform this enumeration?
A. SNMP
B. SMTP
C. NetBIOS
D. LDAP
Answer: C. NetBIOS.
Explanation:
An attacker who finds a Windows OS with port 139 open can check to see what resources can be accessed or viewed on the remote system. However, to enumerate the NetBIOS names, the remote system must have enabled file and printer sharing.
What is the default port used by IPSEC IKE protocol?
A. Port 4500
B. Port 500
C. Port 51
D. Port 50
Answer: B. Port 500.
Explanation:
IPSEC IKE: IP Security Internet Key Exchange Protocol is used for establishing Security Association for IPsec Protocol Suite. IKE uses UDP port 500 for establishing security association.
UDP port 4500 is used IPsec NAT-T
Remote Mail Checking Protocol uses UDP/TCP port 50
Port 51 is reserved by IANA
Which of the following protocols is widely used by Internet service providers (ISPs) to maintain huge routing tables and efficiently process Internet traffic?
A. SIP
B. BGP
C. TFTP
D. FTP
Answer: B. BGP (Border Gateway Protocol).
Explanation:
Border Gateway Protocol (BGP): BGP is widely used by Internet service providers (ISPs) to maintain huge routing tables and for efficiently processing Internet traffic. BGP routers establish sessions on TCP port 179. The misconfiguration of BGP may lead to various attacks such as dictionary attacks, resource-exhaustion attacks, flooding attacks, and hijacking attacks.
Trivial File Transfer Protocol (TFTP): TFTP is a connectionless protocol used for transferring files over the Internet. TFTP depends on connectionless UDP; therefore, it does not guarantee the proper transmission of the file to the destination. TFTP is mainly used to update or upgrade software and firmware on remote networked devices
File Transfer Protocol: FTP is a connection-oriented protocol used for transferring files over the Internet and private networks. FTP is controlled on TCP port 21, and for data transmission, FTP uses TCP port 20 or some dynamic port numbers depending on the server configuration
Session Initiation Protocol (SIP): The Session Initiation Protocol (SIP) is a protocol used in Internet telephony for voice and video calls. It typically uses TCP/UDP port 5060 (non-encrypted signaling traffic) or 5061 (encrypted traffic with TLS) for SIP to servers and other endpoints
Jake, an attacker, is performing an attack on a target organization to gather sensitive information. In this process, he exploited the protocol running on port 23 to perform banner grabbing on other protocols, such as SSH and SMTP, as well as brute-forcing attacks on login credentials. Which of the following protocols is running on port 23?
A. File Transfer Protocol
B. Telnet
C. Border Gateway Protocol
D. Secure Shell
Answer: B. Telnet.
Explanation:
Secure Shell: Secure Shell (SSH) is a command-level protocol mainly used for managing various networked devices securely. It is generally used as an alternative protocol to the unsecure Telnet protocol. SSH uses the client/server communication model, and the SSH server, by default, listens to its client on TCP port 22
File Transfer Protocol: FTP is a connection-oriented protocol used for transferring files over the Internet and private networks. FTP is controlled on TCP port 21, and for data transmission, FTP uses TCP port 20 or some dynamic port numbers depending on the server configuration
Telnet: The Telnet protocol is used for managing various networked devices remotely. It is an unsecure protocol because it transmits login credentials in the cleartext format. Therefore, it is mostly used in private networks. The Telnet server listens to its clients on port 23. Attackers can take advantage of the Telnet protocol to perform banner grabbing on other protocols such as SSH and SMTP, brute-forcing attacks on login credentials, port-forwarding attacks, etc.
Border Gateway Protocol: BGP is widely used by Internet service providers (ISPs) to maintain huge routing tables and for efficiently processing Internet traffic. BGP routers establish sessions on TCP port 179
Which of the following information is collected using enumeration?
A. Network resources, network shares, and machine names
B. Operating systems, location of web servers, users, and passwords
C. Open ports and services
D. Email recipient’s system IP address and geolocation
Answer: A. Network resources, network shares, and machine names.
Explanation:
Enumeration is the process of extracting user names, machine names, network resources, shares, and services from a system or network.
Enumeration allows you to collect following information:
Network resources
Network shares
Routing tables
Audit and service settings
SNMP and FQDN details
Machine names
Users and groups
Applications and banners
Which of the following command-line tools displays the CPU and memory information or thread statistics?
A. PsLogList
B. PsFile
C. PsGetSid
D. PsList
Answer: D. PsList.
Explanation:
PsLogList: The default function of PsLogList is to display the contents of the System Event Log on the local computer with visually friendly formatting.
PsList: It is a command-line tool that displays a central processing unit (CPU) and memory information or thread statistics.
PsFile: It is a command-line utility that shows a list of files on a system that opened remotely, and it can close opened files either by name or by a file identifier.
PsGetSid: It translates SIDs to their display name and vice versa. It works on built-in accounts, domain accounts, and local accounts
Which of the following tools supports the nbstat.nse script that allows attackers to retrieve the target’s NetBIOS names and MAC addresses?
A. Netcraft
B. Wireshark
C. Nmap
D. OpUtils
Answer: C. Nmap.
Explanation:
OpUtils: SNMP enumeration protocol that helps to monitor, diagonise, and troubleshoot the IT resources.
Wireshark: Wireshark lets you capture and interactively browse the traffic running on a computer network.
Nmap: Attackers use the Nmap Scripting Engine (NSE) for discovering NetBIOS shares on a network. The nbstat script of NSE allows attackers to retrieve the target’s NetBIOS names and MAC addresses.
Netcraft: Netcraft provides Internet security services, including anti-fraud and anti-phishing services, application testing, and PCI scanning. They also analyze the market share of web servers, operating systems, hosting providers and SSL certificate authorities, and other parameters of the Internet.
Which of the following NetBIOS service codes is used to obtain information related to the master browser name for the subnet?
A. <1D>
B. <1E>
C. <20>
D. <03>
Answer: A. <1D>.
Explanation:
Here are the NetBIOS service codes and the information obtained through them:
Name: , NetBIOS Code: <03>, Type: UNIQUE, Information Obtained: Messenger service running for the computer.
Name: , NetBIOS Code: <03>, Type: UNIQUE, Information Obtained: Messenger service running for the logged-in user.
Name: , NetBIOS Code: <20>, Type: UNIQUE, Information Obtained: Server service running.
Name: , NetBIOS Code: <1D>, Type: GROUP, Information Obtained: Master browser name for the subnet.
Which of the following Nbtstat parameters is used to display the count of all names resolved by a broadcast or WINS server?
A. -n
B. -r
C. -R
D. -RR
Answer: B. -r.
Explanation:
Here are the Nbtstat parameters and their functions:
Parameter: -n, Function: Displays the names registered locally by NetBIOS applications such as the server and redirector.
Parameter: -r, Function: Displays a count of all names resolved by a broadcast or WINS server.
Parameter: -R, Function: Purges the name cache and reloads all #PRE-tagged entries from the Lmhosts file.
Parameter: -RR, Function: Releases and re-registers all names with the name server.
Which of the following tools is not a NetBIOS enumeration tool?
A. Hyena
B. NetScanTools Pro
C. SuperScan
D. OpUtils
Answer: D. OpUtils.
Explanation:
Among the given options, Hyena, SuperScan, and NetScanTools Pro can be used to perform NetBIOS enumeration, whereas OpUtils is an SNMP enumeration tool.
Which of the following Windows utilities allow an attacker to perform NetBIOS enumeration?
A. nbtstat
B. GetRequest
C. ntpdate
D. SetRequest
Answer: A. nbtstat.
Explanation:
The nbtstat utility in Windows displays NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS names tables for both the local and remote computers, and the NetBIOS name cache. An attacker can run the nbtstat command, “nbtstat.exe –c” to get the contents of the NetBIOS name cache, the table of NetBIOS names, and their resolved IP addresses. An attacker can also run the nbtstat command, “nbtstat.exe –a ” to get the NetBIOS name table of a remote computer.
Which of the following management information bases (MIBs) contains object types for workstation and server services?
A. WINS.MIB
B. MIB_II.MIB
C. HOSTMIB.MIB
D. LNMIB2.MIB
Answer: D. LNMIB2.MIB
Explanation:
WINS.MIB: For the Windows Internet Name Service (WINS)
HOSTMIB.MIB: Monitors and manages host resources.
MIB_II.MIB: Manages TCP/IP-based Internet using a simple architecture and system.
LNMIB2.MIB: Contains object types for workstation and server services.
Robert, a professional hacker, was tasked with retrieving critical information from a target network. For this purpose, Robert employed a command-line tool to fetch information from all the network sub-nodes such as routers and switches in the form of an object identifier (OID), which is part of the management information base (MIB). Identify the tool employed by Robert in the above scenario.
A. SnmpWalk
B. Spokeo
C. Factiva
D. Tor Browser
Answer: A. SnmpWalk.
Explanation:
Spokeo: Attackers can use the Spokeo people search online service to search for people belonging to the target organization. Using this service, attackers obtain information such as phone numbers, email addresses, address history, age, date of birth, family members, social profiles, and court records.
Tor Browser: Tor Browser is used to access the deep and dark web, where it acts as a default VPN for the user and bounces the network IP address through several servers before interacting with the web. Attackers use this browser to access hidden content, unindexed websites, and encrypted databases present in the deep web.
Factiva: Factiva is a global news database and licensed content provider. It is a business information and research tool that gets information from licensed and free sources and provides capabilities such as searching, alerting, dissemination, and business information management.
SnmpWalk: SnmpWalk is a command-line tool that allows attackers to scan numerous Simple Network Management Protocol (SNMP) nodes instantly and identify a set of variables that are available for accessing the target network. Using this tool, attackers target the root node so that information from all the sub-nodes such as routers and switches can be fetched. The information can be retrieved in the form of an object identifier (OID), which is part of the management information base (MIB) associated with the devices having SNMP enabled.
Which of the following SnmpWalk commands allows an attacker to identify configured software on the target network node?
A. snmpwalk -v2c -c public hrMemorySize
B. snmpwalk -v2c -c public
C. snmpset -v2c -c public <target_device> <OID> <datatype> <value>
D. snmpwalk -v2c -c public hrSWInstalledName</value></datatype></OID></target_device>
Answer: D. snmpwalk -v2c -c public hrSWInstalledName.
Explanation:
SnmpWalk Commands:
Command to search for installed software:
snmpwalk -v2c -c public hrSWInstalledName
Command to enumerate SNMPv2 with a community string of public:
snmpwalk -v2c -c public
Command to determine the amount of RAM on the host:
snmpwalk -v2c -c public hrMemorySize
Command to change an OID to a different value:
snmpwalk -v2c -c public
Which of the following commands allows attackers to fetch the SNMP server type and operating system?
A. nmap -sU -p 161 –script=snmp-processes
B. nmap -sU -p 161 –script=snmp-sysdescr
C. nmap -p 25 –script=smtp-enum-users
D. nmap -p 25 -script=smtp-open-relay
Answer: B. nmap -sU -p 161 –script=snmp-sysdescr .
Explanation:
Nmap commands to perform SNMP enumeration:
nmap -p 25 –script=smtp-enum-users à Enumerate all the mail users on the SMTP server.
nmap -p 25 -script=smtp-open-relay à Identifies SMTP open relays
nmap -sU -p 161 –script=snmp-processes à List of all the running SNMP processes along with the associated ports on the target host.
nmap -sU -p 161 –script=snmp-sysdescr à Retrieves information regarding SNMP server type and operating system details.
Alfred, a professional hacker, was performing SNMP enumeration on a target network. In this process, he executed an nmap command that lists all the running SNMP processes along with the associated ports on the target host. Identify the command executed by Alfred in the above scenario.
A. nmap -sU -p 161 –script=snmp-processes
B. snmpwalk -v2c -c public
C. nmap -p 25 –script=smtp-enum-users
D. nmap -p 25 -script=smtp-open-relay
Answer: A. nmap -sU -p 161 –script=snmp-processes .
Explanation:
Nmap commands to perform SNMP enumeration:
nmap -p 25 –script=smtp-enum-users -> Enumerate all the mail users on the SMTP server.
nmap -sU -p 161 –script=snmp-processes -> List of all the running SNMP processes along with the associated ports on the target host.
Command to change an OID to a different value:
snmpwalk -v2c -c public
nmap -p 25 -script=smtp-open-relay -> Identifies SMTP open relays.
Which of the following commands is used by an SNMP agent to meet a request made by the SNMP manager?
A. GetResponse
B. GetNextRequest
C. SetRequest
D. Trap
Answer: A. GetResponse.
Explanation:
The following are some commands associated with SNMP.
GetRequest: Used by the SNMP manager to request information from an SNMP agent
GetNextRequest: Used by the SNMP manager continuously to retrieve all the data stored in an array or table
GetResponse: Used by an SNMP agent to satisfy a request made by the SNMP manager
SetRequest: Used by the SNMP manager to modify the value of a parameter within an SNMP agent’s management information base (MIB)
Trap: Used by an SNMP agent to inform the pre-configured SNMP manager of a certain event
Which protocol enables an attacker to enumerate user accounts and devices on a target system?
A. SNMP
B. TCP
C. NetBIOS
D. SMTP
Answer: A. SNMP
Which of the following SnmpWalk commands helps attackers change the object identifier of a network node?
A. snmpwalk -v2c -c public
B. snmpwalk -v2c -c public hrSWInstalledName
C. snmpwalk -v2c -c public
D. snmpwalk -v2c -c public sysContact
Answer: C. snmpwalk -v2c -c public .
Explanation:
SnmpWalk Commands:
Command to enumerate SNMPv2 with a community string of public:
snmpwalk -v2c -c public
Command to search for installed software:
snmpwalk -v2c -c public hrSWInstalledName
Command to change an OID to a different value:
snmpwalk -v2c -c public
Command to change the sysContact OID:
snmpwalk -v2c -c public sysContact
Which of the following LDAP enumeration tools is used by an attacker to access the directory listings within Active Directory or other directory services?
A. XOIC
B. Slowloris
C. HULK
D. AD Explorer
Answer: D. AD Explorer.
Explanation:
The major MIBs are as follows:
AD Explorer: Used to access the directory listings within Active Directory or other directory services. Using the LDAP enumeration tool, attackers can enumerate information such as valid usernames, addresses, and departmental details from different LDAP servers.
Slowloris, XOIC, and HULK are tools for performing DoS attacks.
Which of the following protocols is responsible for accessing distributed directories and access information such as valid usernames, addresses, departmental details, and so on?
A. DNS
B. SMTP
C. LDAP
D. NTP
Answer: C. LDAP (Lightweight Directory Access Protocol).
Explanation:
Lightweight directory access protocol (LDAP) is an Internet protocol for accessing distributed directory services. Directory services may provide any organized set of records such as corporate e-mail directory, often in a hierarchical and logical structure. An attacker queries LDAP service to gather information such as valid user names, addresses, departmental details, and so on that can be further used to perform attacks.
Which of the following tools can be used to perform LDAP enumeration?
A. SoftPerfect Network Scanner
B. SuperScan
C. Nsauditor Network Security Auditor
D. AD Explorer
Answer: D. AD Explorer.
Explanation:
Among the given options, AD Explorer can be used to perform LDAP enumeration, whereas SoftPerfect network scanner, SuperScan, and Nsauditor network security auditor are tools that are used to perform NetBIOS enumeration.
Edward, a professional hacker, was tasked with hacking critical information of a target organization. For this purpose, Edward initiated an LDAP enumeration process. Using a Python script, he successfully established a connection with the target LDAP server and executed the following script:
> > > connection.search(search_base=’DC=DOMAIN,DC=DOMAIN’, search_filter=’(&(objectClass=))’, search_scope=’SUBTREE’, attributes=’’)
True
> > connection.entries
Which of the following did Edward accomplish using the above Python script?
A. Created a connection object
B. Retrieved all directory objects
C. Listed all applications
D. Retrieved the DSA-specific entry (DSE) naming contexts
Answer: B. He searched for objects with the search filter set to ‘objectClass=*’.
Explanation:
After obtaining the naming context, retrieve all the directory objects using the script given below:
> > > connection.search(search_base=’DC=DOMAIN,DC=DOMAIN’, search_filter=’(&(objectClass=))’, search_scope=’SUBTREE’, attributes=’’)
True
> > connection.entries
Which of the following tools allows attackers to perform LDAP enumeration on the target network?
A. nbtstat
B. DNSRecon
C. AD Explorer
D. Euromonitor
Answer: C. AD Explorer.
Explanation:
AD Explorer: AD Explorer allows attackers to perform LDAP enumeration.
DNSRecon: Attackers use DNSRecon to check all NS records of the target domain for zone transfers.
Euromonitor: Euromonitor provides strategy research capabilities for consumer markets. It publishes reports on industries, consumers, and demographics. It provides market research and surveys focused on the organization’s needs.
§nbtstat: nbtstat is a Windows utility that helps in troubleshooting NETBIOS name resolution problems.
