Module 13 - Hacking Web Servers

Question 1

___ ______ is a computer system that stores, processes and delivers web pages to clients via HTTP.

a. DNS Server
b. Web Server
c. Exchange Server
d. SCCM Server

Answer 1

b. Web Server

Question 2

Web Server Concepts:

Internet Information Services (IIS) is used on which system?

a. Linux
b. Unix
c. Solaris
d. Microsoft

Answer 2

d. Microsoft

Question 3

Web Server Concepts:

Apache web services are used on which system?

a. Linux
b. Unix
c. Solaris
d. Microsoft

Answer 3

a. Linux

Question 4

Web Server Attacks:

• Attacker uses compromised PCs with spoofed IP address to amplify the DDoS attacks on victims’ DNS server by exploiting DNS recursive method.
• 2 or more computers attack a DNS server
  a. DNS Attack
  b. Directory Traversal Attack
  c. DNS Amplification Attack
  d. Man-in-the-Middle Attack (MITM)

Answer 4

c. DNS Amplification Attack

Question 5

Web Server Attacks:

Attackers gain access to restricted directories outside of the web server root directory.

a. DNS Attack
b. Directory Traversal Attack
c. DNS Amplification Attack
d. Man-in-the-Middle Attack (MITM)

Answer 5

b. Directory Traversal Attack

Question 6

Web Server Attacks:

• Allows an attacker to access sensitive information by intercepting and altering communications between an end-user and server.
• Can lead to a Replay Attack.
  a. DNS Attack
  b. Directory Traversal Attack
  c. DNS Amplification Attack
  d. Man-in-the-Middle Attack (MITM)

Answer 6

d. Man-in-the-Middle Attack

Question 7

Web Server Attack Methodology:

Implement _____________ ____ scan to identify weaknesses in a network and determine if the system can be exploited.

a. Banner Grab
b. Exploit Scan
c. Service Scan
d. Vulnerability Scan

Answer 7

d. Vulnerability Scan

Question 8

Web Server Attack Tools:

________ is an exploit tool which supports fully automated exploitation of web servers, by abusing known vulnerabilities and leveraging weak passwords via Telnet, SSH, HTTP, and SNMP.

a. Metasploit
b. Nessus
c. IntelLink
d. Lexus Nexus

Answer 8

a. Metasploit

Question 9

Patch Management:

A ________ adds functionality to a system.

a. Service Pack
b. Patch
c. Exploit
d. Hotfix

Answer 9

b. Patch

Question 10

Patch Management:

A _________ is a combination of 100+ hotfixes and patches for a system.

a. Service Pack
b. Patch
c. Exploit
d. Hotfix

Answer 10

a. Service Pack

Question 11

Patch Management:

A ________ fixes things or something on a system.

a. Service Pack
b. Patch
c. Exploit
d. Hotfix

Answer 11

d. Hotfix

Question 12

Method that compare binary signatures of know attacks to dettect misuse and a intrusion.

Answer 12

Signature Recognition

Question 13

Dettect a intrusion when an event occurs outside the baseline off normal traffic. Based on bahavioral.

Answer 13

Anormaly detection