Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Pentest+ PT0-002 > Network-Based Attacks > Flashcards

Network-Based Attacks Flashcards

1
Q

What is a set of formal rules that describe the functionality of how to send and receive data?

A

A protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a software implementation that executes the formal rules of a protocol for a specific computing platform?

A

A service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Through what method does Linux implement protocols such as DNS?

A

Daemons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which Nmap enumeration script can assist with conducting cache snooping against an internal DNS server?

A

dns-cache-snoope.nse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What kind of attack is characterized by an attacker knowing the websites an organization frequents, and infecting the webpage with malware?

A

Waterholing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which attack method is characterized by impersonating a victim’s DSN server, forcing them to navigate to a malicious website?

A

DNS spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which attack method is characterized by overwriting the DNS resolver cache on a DNS server with a malicious web address, sending the user a malicious site instead of the intended one?

A

DNS cache poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a type of attack where a malicious device sends a false ARP message to other hosts on the network in an attempt to impersonate another machine, thus linking its MAC address with another host IP on the network?

A

ARP poisoning/spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What kinds of services does NetBIOS provide?

A

Protocol management, messaging, data transfer, hostname resolution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which protocol mimics the functionality of DNS for IPv4 and IPv6 hostname resolution for hosts operating on small networks, and what port does it operate on?

A

LLMNR, on port 5355/UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which tool is a Python script that acts as a poisoner for LLMNR, NBT-NS and MDNS and aids pentesters by poisoning name resolution and compromising usernames and hash values with a rogue authentication server?

A

Responder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What sequence of protocols do most Windows hosts follow for hostname resolution?

A

Windows hosts will try DNS first, then LLMNR, and if that is unavailable, then NetBios Name Service (NBNS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What service do Microsoft Windows clients connect to to obtain and configure the automatic web proxy settings for Internet Explorer, and is a popular vector for Responder attacks?

A

WPAD (Windows Proxy Auto-Discovery Protocol)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are two methods to mitigate WPAD (Windows Proxy Auto-Discovery) protocol attacks?

A

1) Create an entry in your DNS server to point to your organization’s proxy server 2) Disable auto-detect settings in Internet Explorer, preferably with a group policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which built-in tool in Responder allows you to perform relay attacks against NTLM?

A

Multi-Relay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are three attacks against user passwords?

A

Brute-Force & Dictionary Attacks, Password Spraying, and Hash Cracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which password attack targets many users with a single, well-known password?

A

Password spraying

18
Q

What are the advantages and disadvantages of password spraying?

A

Advantages - less likely to trigger account lockouts, faster to go through 1,000 accounts with 1 or 2 passwords than a dictionary of 100 guesses. Disadvantages - heavily relies on luck and good education about how people think

19
Q

What kind of attack involves intercepting and collecting password hashes that are sent over the wire or found stored?

A

Hash Cracking

20
Q

Why do some vendors compute hashes for their software releases?

A

To give consumers confidence that the software they are downloading originated from a trusted source.

21
Q

What is the default hashing function for later revisions of Linux?

A

sha516crypt

22
Q

What kind of tool computes all the possible hash values for plaintext values, up to a certain length, and are typically tailored to specific hash requirements such as MD5 and SHA-1?

A

Rainbow table

23
Q

What kinds of tools help to increase the likelihood of successful password exploitation?

A

John The Ripper, Hashcat, Cain & Abel

24
Q

According to US-CERT, what is the most common stress testing attack method?

A

Flooding

25
Q

What kind of attack is made up of many Internet-connected computing devices that are used in conjunction to carry out coordinated tasks, such as DoS attacks

A

Botnet

26
Q

What two tools come pre-installed in Kali and allow a pentester to analyze network packets?

A

Wireshark and tcpdump

27
Q

What kind of Python program can assist you with packet manipulation by forging and decoding packets?

A

Scapy

28
Q

What is a protocol that is used to define a standard for how operating systems, processes, and applications generate messages or notifications?

A

Syslog

29
Q

What is a layer 2 protocol that runs on network devices and prevents looping in networks that have redundant paths by placing only one switch in forwarding mode?

A

Spanning Tree Protocol (STP)

30
Q

What is the Bridge Protocol Data Unit (BDPU)

A

Updates that are multicast between switches over the network every so often to determine if a port is in the forwarding or blocking state

31
Q

What is a type of VLAN hopping attack that occurs when an attacker can emulate a valid trunking switch on the network by speaking 802.1Q.

A

Switch spoofing

32
Q

How can you mitigate switch spoofing attacks?

A

By preventing ports on a switch from negotiating trunks and configuring ports to be access ports.

33
Q

What kind of VLAN hopping attack occurs as a result of a switch port being configured to use native VLANs, where an attacker can craft a packet and prepend a false VLAN tag along with its native VLAN?

A

Double-tagging

34
Q

How can you mitigate double-tagging switch spoofing attacks?

A

By not associating any hosts to the native VLAN or by disabling the native VLAN on all trunk ports

35
Q

What are three methods a pentester can use to bypass Network Access Control (NAC)?

A

Violating trust relationships, exploiting implementation weaknesses, or taking advantage of configuration weaknesses

36
Q

What is a native Exploit-DB command-line tool in Kali Linux that lets you search for known exploits?

A

Searchsploit

37
Q

What is the implementation of CIFS (Common Internet File System) that allows file and print sharing among Windows and Unix systems?

A

Samba

38
Q

What separates NFS3 from previous versions of NFS?

A

NFSv3 and earlier will will map numeric UIDs and GIDs to files and directories on the NFS file system. When you mount an NFS share from a client using NFSv3, you will see the UID or GID in place of a username or group because your local operating system cannot map to them, either because you are not on the domain or the user does not exist.

39
Q

Your Nmap scan identifies port 445/tcp open on a Windows server with one of the common shares available and accessible anonymously. This share allowed the scanner to enumerate additional users and services on the domain. Which network share were you likely to have enumerated during the scan?

A

IPC$. IPC$ is a null session connection which Microsoft allows anonymous users to do things like enumerate users and network shares.

40
Q

Which command flag tells hping3 to use a random-source IP address?

A

–rand-source

Pentest+ PT0-002 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions