Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Pentest+ Tools > Pentest+ Tools > Flashcards

Pentest+ Tools Flashcards

General idea of the Tools on the Pen-test+ objectives

1
Q

Nikto

A

An opensource vulnerability scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Open vulnerability assessment
scanner (Open VAS)

A

An opensource vulnerability scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

SQLmap

A

A tool used to find and automate SQLinjection in webapplications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Nessus

A

Propitiatory Vulnerability Scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Open Security Content
Automation Protocol (SCAP)

A

Comprises a number of open standards that are widely used to enumerate software flaws and configuration issues related to security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Wapiti

A

Opensource web-application vulnerability scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

WPScan

A

WordPress security scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Brakeman

A

Open-source Static Analysis Security Tool designed for apps running on Ruby on Rails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Scout Suite

A

Cloud Security Auditing Tool. Assess security posture of cloud environments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Hashcat

A

Password cracker. Can be used to perform dictionary attacks against hashes to find a password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Medusa

A

Password Brute forcing tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Hydra

A

Password Brute forcing tool, can also be used against some webapp logins.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CeWL

A

Tool used to build wordlist that can be used in a dictionary password attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Cain

A

Cain and Abel (often abbreviated to Cain) was a password recovery tool for Microsoft Windows. It could recover many kinds of passwords using methods such as network packet sniffing, cracking various password hashes by using methods such as dictionary attacks, brute force and cryptanalysis attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Mimikatz

A

A tool that can be used to pull password hashes from memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Patator

A

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DirBuster

A

A tool that can be used to find hidden directories on websites.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

W3af

A

w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

OllyDb

A

OllyDbg was an x86 debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants and strings, as well as locates routines from object files and libraries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Immunity Debugger

A

Debugger for Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

GNU Debugger (GDB)

A

The GNU Debugger is a portable debugger that runs on many Unix-like systems and works for many programming languages, including Ada, Assembly, C, C++, D, Fortran, Haskell, Go, Objective-C, OpenCL C, Modula-2, Pascal, Rust, and partially others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

WinDbg

A

Debbuger; Ships with Windows systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Interactive Disassembler (IDA)

A

The Interactive Disassembler is a disassembler for computer software which generates assembly language source code from machine-executable code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Covenant

A

C2 is very helpful for maintaining persistent access between attacker and compromised machine and easy to exfiltrate data. Run on ASP.NET Core.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

SearchSploit

A

A tool that can be used to find exploits available from multiple sources. This tool can also be used offline, assuming it is installed and up to date.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

WHOIS

A

Whois records are available for most domains, can be used to gather information such as who is the hosting the domain or who administrates it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Nslookup

A

A tool to lookup DNS records. Can be used to get the IP of a domain name. If the PTR record is setup, it can also be used to find a domain name from an IP. This tool can also search mail (MX records) and txt records as well.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Fingerprinting Organization
with Collected Archives (FOCA)

A

Fingerprinting Organizations with Collected Archives

FOCA is a tool used mainly to find metadata and hidden information in the documents it scans. These documents may be on web pages, and can be downloaded and analyses with FOCA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

theHarvester

A

An OSINT tool to collect data from multiple sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Shodan

A

Provides detailed information about each device, including IP address, operating system, software and open ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Maltego

A

OSINT tool. Can be used to map relationships or emails, domains, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Recon-ng

A

Popular OSINT tool with multiple modules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Censys

A

Very similar to shodan: provides detailed information about each device, including IP address, operating system, software and open ports. Unlike Shodan, Censys also focuses on device security and provides information about known vulnerabilities and SSL certificates

34
Q

BeEF

A

BeEfF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser. Asses and can exploit vulnerabilities within web browsers.

35
Q

SSH

A

Secure shell - Encrypted remote access tool. Port 22

36
Q

Ncat

A

Ncat is an enhanced version of the traditional netcat utility developed as a part of the Nmap project. It aims to combine the best features of different netcat versions into one advanced tool.

37
Q

Netcat (NC)

A

a versatile networking utility that can perform a wide range of tasks, including establishing and managing network connections, transferring files, and conducting network diagnostics. We can use it for fulfilling diverse objectives involving TCP, UDP, or UNIX-domain sockets.

Commonly used for bind or reverse shells.

38
Q

ProxyChains

A

ProxyChains is a UNIX program, that hooks network-related libc functions in dynamically linked programs via a preloaded DLL and redirects the connections through SOCKS4a/5 or HTTP proxies.

39
Q

Wireshark

A

Packet analyzer or packet sniffing tool. Has a GUI.

40
Q

Hping

A

hping is an open-source packet generator and analyzer for the TCP/IP protocol created by Salvatore Sanfilippo. It is one of the common tools used for security auditing and testing of firewalls and networks, and was used to exploit the idle scan scanning technique

41
Q

PowerSploit

A

Exploitation Framework, build for Powershell

42
Q

Responder

A

Responder an LLMNR, NBT-NS and MDNS poisoner. It will answer to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix (see: http://support.microsoft.com/kb/163409). By default, the tool will only answer to File Server Service request, which is for SMB.

The concept behind this is to target our answers, and be stealthier on the network. This also helps to ensure that we don’t break legitimate NBT-NS behavior. You can set the -r option via command line if you want to answer to the Workstation Service request name suffix.

43
Q

Impacket Tools

A

mpacket is a collection of Python3 classes focused on providing access to network packets. Impacket allows Python3 developers to craft and decode network packets in simple and consistent manner. It includes support for low-level protocols such as IP, UDP and TCP, as well as higher-level protocols such as NMB and SMB.

Python tools that can be used for Kerberos attacks

44
Q

Empire

A

Exploitation Framework build in PowerShell

45
Q

Metasploit

A

Multi-platform exploitation framework. Build in Ruby.

46
Q

mitm6

A

mitm6 is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server. It does this by replying to DHCPv6 messages, providing victims with a link-local IPv6 address and setting the attackers host as default DNS server. As DNS server, mitm6 will selectively reply to DNS queries of the attackers choosing and redirect the victims traffic to the attacker machine instead of the legitimate server.

47
Q

CrackMapExec

A

This package is a swiss army knife for pentesting Windows/Active Directory environments.

From enumerating logged on users and spidering SMB shares to executing psexec style attacks, auto-injecting Mimikatz/Shellcode/DLL’s into memory using Powershell, dumping the NTDS.dit and more.

The biggest improvements over the above tools are:

Pure Python script, no external tools required
Fully concurrent threading
Uses ONLY native WinAPI calls for discovering sessions, users, dumping SAM hashes etc…
Opsec safe (no binaries are uploaded to dump clear-text credentials, inject shellcode etc…)

Additionally, a database is used to store used/dumped credentals. It also automatically correlates Admin credentials to hosts and vice-versa allowing you to easily keep track of credential sets and gain additional situational awareness in large environments.

48
Q

TruffleHog

A

TruffleHog is a free security tool designed to root around for sensitive information exposure within version control systems, CI, cloud assets, and file systems. Specifically, it helps identify and mitigate security risks related to the inadvertent storage of credentials, secrets, and other sensitive data.

49
Q

Open steg

A

Steganography tool to hide or extract information hidden in images

50
Q

Steghide

A

Steganography tool to hide or extract information hidden in images

51
Q

Snow

A

SNOW exploits the Steganographic Nature Of Whitespace. Locating trailing whitespace in text is like finding a polar bear in a snowstorm

52
Q

Coagula

A

Tool to make sounds form images

53
Q

Sonic Visualizer

A

Analyze music files

54
Q

TinEye

A

Reverse image search

55
Q

Metagoofil

A

Metagoofil is an information gathering tool designed for extracting metadata of public documents (pdf,doc,xls,ppt,docx,pptx,xlsx) belonging to a target company.

Metagoofil will perform a search in Google to identify and download the documents to local disk. Metagoofil does no longer extract the metadata. See /usr/share/doc/metagoofil/README.md.gz.

56
Q

Online SSL Checkers

A

Tools that can inspect SSL certificates

57
Q

CloudBrute

A

A tool to find a company (target) infrastructure, files, and apps on the top cloud providers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode). The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike.

58
Q

Pacu

A

Aws exploitation framework

59
Q

Cloud Custodian

A

Cloud Custodian is a rules engine for managing public cloud accounts and resources. It allows users to define policies to enable a well managed cloud infrastructure, that’s both secure and cost optimized. It consolidates many of the adhoc scripts organizations have into a lightweight and flexible tool, with unified metrics and reporting.

60
Q

Aircrack-ng suite

A

Aircrack-ng is a complete suite of tools to assess WiFi network security.

It focuses on different areas of WiFi security:

Monitoring: Packet capture and export of data to text files for further processing by third party tools
Attacking: Replay attacks, deauthentication, fake access points and others via packet injection
Testing: Checking WiFi cards and driver capabilities (capture and injection)
Cracking: WEP and WPA PSK (WPA 1 and 2)
61
Q

Kismet

A

Kismet is a sniffer, WIDS, and wardriving tool for Wi-Fi, Bluetooth, Zigbee, RF, and more, which runs on Linux and macOS.

62
Q

Wifite

A

Wifite is a tool to audit WEP or WPA encrypted wireless networks. It uses aircrack-ng, pyrit, reaver, tshark tools to perform the audit.

This tool is customizable to be automated with only a few arguments and can be trusted to run without supervision.

63
Q

Rogue access point

A

A rogue access point — or rogue AP — is a wireless access point plugged into an organization’s network that the security team does not know exists

64
Q

EAPHammer

A

EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks

65
Q

mdk4

A

This package contains a proof-of-concept tool to exploit common IEEE 802.11 protocol weaknesses.

MDK4 is a new version of MDK3. MDK4 is a Wi-Fi testing tool from E7mer of 360PegasusTeam, ASPj of k2wrlz, it uses the osdep library from the aircrack-ng project to inject frames on several operating systems.

66
Q

Spooftooph

A

Spooftooph is designed to automate spoofing or cloning Bluetooth device Name, Class, and Address. Cloning this information effectively allows Bluetooth device to hide in plain site. Bluetooth scanning software will only list one of the devices if more than one device in range shares the same device information when the devices are in Discoverable Mode (specificaly the same Address).

67
Q

Reaver

A

Reaver performs a brute force attack against an access point’s Wi-Fi Protected Setup pin number. Once the WPS pin is found, the WPA PSK can be recovered and alternately the AP’s wireless settings can be reconfigured. This package also provides the Wash executable, an utility for identifying WPS enabled access points

68
Q

Wireless Geographic
Logging Engine (WiGLE)

A

Wifi heatmap ontop of a map

69
Q

Fern

A

Wifi Cracker
The program is able to crack and recover WEP/WPA/WPS keys and also run other network based attacks on wireless or ethernet based networks

70
Q

OWASP ZAP

A

Similar to Burpsuite, this is a web testing toolkit.

71
Q

Social Engineering Toolkit (SET)

A

The Social-Engineer Toolkit is an open-source penetration testing framework designed for social engineering. SET has a number of custom attack vectors that allow you to make a believable attack quickly.

72
Q

Burp Suite

A

Webtesting toolkit

73
Q

Drozer

A

Android security framework

74
Q

Needle

A

Needle is an open source, modular framework to streamline the process of conducting security assessments of iOS apps.

NOTE: This tool has been decomissioned and is no longer maintained. We are leaving the original project up for archival purposes.

75
Q

Mobile Security Framework (MobSF)

A

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. Pentesting, malware analysis, and security assessments. Static and dynamic analysis.

76
Q

Postman

A

The Postman API client is the foundational tool of Postman, and it enables you to explore, debug, and test your APIs while also enabling you to define complex API requests for HTTP, REST, SOAP, GraphQL, and WebSockets.

77
Q

Ettercap

A

Ettercap is a free and open source network security tool for man-in-the-middle attacks on a LAN. It can be used for computer network protocol analysis and security auditing

78
Q

Frida

A

Opensource; Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

79
Q

Objection

A

Objection is a runtime mobile exploration toolkit, powered by Frida. Assess security posture of mobile apps.

80
Q

Android SDK tools

A

Android SDK Platform-Tools is a component for the Android SDK. It includes tools that interface with the Android platform, primarily adb and fastboot.

81
Q

ApkX

A

A Python wrapper to popular free dex converters and Java decompilers. Extracts Java source code directly from the APK. Useful for experimenting with different converters/decompilers without having to worry about classpath settings and command line args.

82
Q

APK Studio

A

Open-source, cross platform Qt based IDE for reverse-engineering Android application packages. It features a friendly IDE-like layout including code editor with syntax highlighting support for *.smali code files.

Pentest+ Tools (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions