Packet Analysis 1 PEs Flashcards
How many bytes make up a shellcode?
25
If an attacker knew how a program organizes its memory how could it attack that system?
Inputting too much information for the buffer to handle
In a buffer overflow attack what gets over-written?
Memory of an Application
What does a multi-byte sled have to support?
single opcode inside
What is a method used to get a target machine to initiate an outgoing connection?
Connect Back (reverse shell)
A buffer can be located _____
- In the heap
- On the stack
- In the data section of the process
- All of the Above
All of the above
In a reverse shell who establishes the connection?
remote
What is the storage region that holds data while being transferred called?
buffer
True/False You can determine in advance exactly where the targeted buffer will be located in the stack frame.
False
What is it called when data stored in the heap is overwritten?
Heap Overflow
What type of an attack is it, when the input is used in the construction of a command that is subsequently executed by the system with privileges of the Web server.
Command Injection
In what type of sled can the opcode jump straight to the shell code?
Trampoline Sled
What is a Run-Time defense that blocks an attacker’s ability to find out where the stack is by placing it in a random spot in memory?
Address Space Randomization
What are the three places a buffer overflow usually targets? (use format Alpha, Bravo, Charlie)
What are the three places a buffer overflow usually targets? (use format Alpha, Bravo, Charlie)
stack, heap or data section
What are the locations in the stack area used to store the values referring to one invocation of a routine?
What helps move code into the next memory address?
NOP Sled
What type of an attack is it when the user-supplied input is used to construct a SQL request to retrieve information from a database?
SQL Injection
What is the structure that stores data held on the stack?
UNKNOWN
True or False Shellcode is not specific to a particular processor architecture?
False
Servers can find it inconvenient to have ____ ____ port numbers assigned.
Short Term
What is the code supplied by the attacker which is often saved in the buffer being overflowed so that it can be executed?
Shellcode
_____ is a form of buffer overflow attack.
- Heap overflows
- Return to System call
- Replacement stack frame
- All of the Above
All of the aboce
What is the process called of setting a port number to a socket?
Binding
What is a data structure that is used to store values in a particular order and processes the dynamic variables used in the program?
stack
