Packet Analysis 1 Flashcards
What helps move code into the next memory address?
NOP Sled
What is the storage region that holds data while being transferred called?
Buffer
In a buffer overflow attack what gets over-written?
Memory of an Application
How many bytes make up a shellcode?
25 bytes
If an attacker knew how a program organizes its memory how could it attack that system?
Inputting too much information for the buffer to handle
Logically remote into the areas of memory
Replicate the application to learn its weaknesses
Attack it with disorganized information
Inputting too much information for the buffer to handle
What does a multi-byte sled have to support?
single opcode inside
In what type of sled can the opcode jump straight to the shell code?
Trampoline
In a reverse shell who establishes the connection?
Remote Machine
What is it called when data stored in the heap is overwritten?
Heap Overflow
What was the first big buffer overflow attack?
Morris
What is the structure that stores data held on the stack?
Stack Frame
_____ is a form of buffer overflow attack.
Heap overflows
Return to System call
Replacement stack frame
All of the Above
All of the Above
What is a method used to get a target machine to initiate an outgoing connection?
malicious website
A buffer can be located _____
In the heap
On the stack
In the data section of the process
All of the Above
All of the Above
What is a data structure that is used to store values in a particular order and processes the dynamic variables used in the program?
Stack
What is the process called of setting a port number to a socket?
Binding
What type of an attack is it when the user-supplied input is used to construct a SQL request to retrieve information from a database?
SQL Injection
Servers can find it inconvenient to have ____ ____ port numbers assigned.
Short Term
True/False You can determine in advance exactly where the targeted buffer will be located in the stack frame.
True
False
False
What are the three places a buffer overflow usually targets? (use format xxx, xxx, xxx)
Stack, Heap, Data Section
What are the locations in the stack area used to store the values referring to one invocation of a routine?
Stack Frame
What type of an attack is it, when the input is used in the construction of a command that is subsequently executed by the system with privileges of the Web server.
Command Injection
What is the code supplied by the attacker which is often saved in the buffer being overflowed so that it can be executed?
Shellcode
True or False Shellcode is not specific to a particular processor architecture?
True
False
False
What is a Run-Time defense that blocks an attacker’s ability to find out where the stack is by placing it in a random spot in memory?
Address Space Randomization
