Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SEC504-Book 5 > Privleged Network Insider Attacks > Flashcards

Privleged Network Insider Attacks Flashcards

1
Q

What is the most common hacker tool used after gaining inital network access?

A

sniffers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Privileged network position

A

an attacker on the same LAN in an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How are many attacks discovered

A

only when a sniffer log consumes all available file space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is promiscuous mode

A

when an Ethernet interface is gathering all traffic regardless of its destination hardware addresss.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a hardware address

A

MAC Address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a MAC Address

A

each Ethernet card is programmed with a unique Mac Address?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Traditional Ethernet

A

Implemented in a hub, is a broadcast medium, which broadcasts ALL data to ALL systems connected to the LAN segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is Traditional Ethernet sniffable?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Switched Ethernet

A

Does not broadcast all information to links of the LAN segment. It is more intelligent than the hub(traditional ethernet) by looking at the destination MAC address, only sending the data to the required port on the switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Traditional Ethernet VS Switched Ethernet

A

Tradtional is a hub, Switched is a switch. Traditional broadcasts to all systems connected on LAN. Switched looks at the destination MAC address and only sending data required for that address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How does switch operate in Switched Ethernet?

A

observes the source MAC address of frames going from each physical port to learn which MAC addresses are connected on that port. The switch rememberes this mapping of MAC address(layer 2) to physical address (layer1) in memory on the switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Does the switch remember the mapping of MAC address (layer 2) to physical address (layer 1) in memory on the switch?

A

yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Content Table Addressable Memory (CAM) table

A

Used in Switch Ethernet when the switch remembers the mapping of MAC address(layer 2) to physical address (layer 1) in memory on the switch. When new frames arrive at the switch, the device can consult its CAM table to determine which physical interface to send this packet to so it arrives at its destination.
https://www.youtube.com/watch?v=TIHvWb-gruc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Ethernet frame?

A

is primarily responsible for the correct rule making & successful tranmission of Data Packets when transmitting data over the ethernet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Ethernet?

A

Ethernet is a family of wired computer networking technologies commonly used in local area networks,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Using the CAM table the switch switches?

A

True.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

two ways to sniff a switched environment?

A

redirect the flow of traffic on the LAN by 1. attacking th e switch directly 2. going after the machine sending the traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sniffers?

A

Gather all information transmitted accross a line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Broadcast media

A

(non switched ethernet or Wi-Fi networks) allow an attacker to gather passwords and more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Wi-Fi networks are akin to hubs?

A

True. (Pre switch days.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Wireshark

A

Sniffing tool.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Wireshark abilities?

A
  • parse traffic from network or read, parse, display packet capture
  • read files in TCPDumps/Libpcap native format
  • convert dozens other popular sniffer file formats
  • Parse over 500 different protocols
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Should you install wireshark on a compromised system?

A

NO. use built in tools to take a packet capture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Scenario. Need to take a packet capture of a compromised windows system. How do I do it?

A

Use built in tool netsh to take the packet capture, it will be propietary so transfer the .etl file to analysis workstation and use et12pcapng.exe to convert the .etl capture to a .pcapng to be compatible with Wireshark.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

netsh

A

Built in tool on windows can create packet capture.
netsh trace start capture=yes maxsize=1000 tracefile-pcap.etl
netsh trace stop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

.etl and .etl12pcapng.exe

A

.etl : is microsoft windows propitary packet capture format

.etl12pcapng.exe : is used to convert the etl file to a compatile packet capture type for wireshark such as .pcapng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what does etl stand for?

A

Event Trace Log (ETL) File

28
Q

How to take a packet capture of compromised Linux system?

A

tcpdump

29
Q

tcpdump

A

used to take packet capture of a UNIX/Linux system

30
Q

Should you install tcpdump if not installed already on comrpomised system?

A

yes but be careful, download and run a STATIC binary (requires no additional libraries) to prevent log detection.

31
Q

apt-get install tcpdump

A

will generate numerous logs and could disclose attackers presence on system. use STATIC binary.

32
Q

Static Executable

A

is one where the external libraries needed for the binary to run are built into the executable directly.

33
Q

Benefit of running a static executable

A

makes the binary independent, and will run on most Linux distributions without additional modifications to the system

34
Q

Does tcpdump require root access?

A

Yes.

35
Q

Where is tcpdump most valuable?

A

to obtain unencrypted passwords from weak protocols such as (FTP, HTTP, SNMP, Telnet)

36
Q

tcpdump -n

A

turn off name resolution

37
Q

tcpdump -i

A

listen on interface (eth0)

38
Q

tcpdump - s 0

A

is the snap length set to 0 to capture the entire packet

39
Q

creating a file with a leading .

A

makes the filename hidden from normal view on the system

40
Q

./tcpdump -n -i eth0 -s 0 -w .packets.pcap

A

turn off name resolution
listen on interface eth0
capture entire packet with snap length set to 0
save capture to hidden file .packets.pcap

41
Q

What is ARP used for?

A

Dynamic IP to MAC address resolution

42
Q

is ARP essential?

A

Yes. because tells clients on the same LAN how to reach eachother

43
Q

Scenario of ARP

A

client A wants to talk to client B on the LAN. Client A sends ARP request messsage “ hey 172.x.x.x who is this, who is responsible for this IP address?” Client B responds with MAC address & “thats me , send me your data”.

44
Q

ARP Cache

A

when a corresponding system sends me their MAC address after when I first initially sent out the my ARP request message “who is responsible for IP x.x.x.x”. Their MAC address will be cached for up to 10 min

45
Q

Data sent across a LAN must be directed to the ___?

A

hardware address (MAC address)

46
Q

How many bits is the MAC address of the Ethernet card?

A

48-bits

47
Q

What protocol is known for when a machine must determine the MAC address corresponding to a given IP address?

A

ARP mapping IP to MAC Address.

48
Q

how long is ARP cached?

A

10 min

49
Q

is ARP secure?

A

NO. no way to tell/veriify if the ARP response came from the proper machine.

50
Q

Is ARP routed between LANS?

A

no. ARP messages are only sent across a single LAN.

51
Q

are ARP messages sent across a single LAN.

A

Yes. only a single LAN.

52
Q

Gratuitous ARP? layman

A

a client who thinks they are very important tells other people on the network. “At some point if you want to talk to me this is my ip 172.x.x.x and this is my MAC xxxx…” its a built in feature in ARP. A client will accept whatever the last ARP message was to its ARP cache w/ ip to mac address mappings. this poses a vulnerability known as ARP Cache poisining.

53
Q

Gratuitous ARP?

A

Anyone can send ARP responses, even though no - one sends an ARP request. ( so sending a response of IP and MAC address)

54
Q

how do systems respond to someone sending a gratuitous arp?

A

machines greedily take this data, devour it for their system caches (ARP cache) and even overwrite previous entries of IP to MAC mapping entries.

55
Q

What is a vulnerability ARP faces with gratuitous ARP?

A

ARP Cache poising.

56
Q

two things that happen if send an ARP response when noone asks a question (known as Gratuitous ARP)

A
  1. flood a switches memory

2. poisin the victims system ARP cache

57
Q

If a machine wants to talk to another machine on a LAN what must first happen?

A

which hardware address to use for a specific ip address.

58
Q

scenario. explain ARP Alice wants to talk to Bob.

A
  1. Allice sends an ARP request to determine which hardware address corresponds to Bobs IP address. “hey who is responsible for IP x.x.x.x” Bobs system responds with his MAC address. So now alice knows where to send the message. Alice stores bobs answer in her ARP cache.
59
Q

“MAC address for IP address x.x.x. is AA.AA.AA.AA.AA.AA (48 bits long MAC) “ without a presceding query

A

Gratuitous ARP

60
Q

ARP Cache Poisoning

A

an attack technique where an adversary can tell other people on the network to impersonate another persons ip address which facilitates a MITM attack

61
Q

Bettercap

A

ARP cache poisoning tool. runs different parsers and interception tools to hijack traffic. must run as root.

62
Q

remove noise from bettercap

A

sudo bettercap -eval “events.ignore endpoint”; set $&raquo_space; {reset}”

63
Q

net.show

A

bettercap : disclose hosts on the network. will passively identify network hosts by looking for broadcast and multicast traffic.

64
Q

Better cap default runs actively or passively?

A

passively

65
Q

repeating net.show?

A

could disclose additional hosts as they join/leave the network

66
Q

Steps to bettercap MITM attack?

A
  1. choose victim 192.168.86.40 as target for ARP spoofing.
    $set arp.spoof.targets 192.168.86.40
  2. record a packet capture
    $net.sniff.output saving data to output packet capture .pcap
  3. turn on network sniffer
    $arp.spoof on
  4. start to see evidence of victim system browsing thorugh the attacler, disclosing hostname of encrypted website theyre visiting thorugh the plaintext server name identification (SNI) field in the HTTPS request.

SEC504-Book 5 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions