SECFND 10: Common Endpoint Attacks Flashcards
Local Exploit
requires prior access to the vulnerable system
Remote Exploit
works over the network without any prior access to the target system.
Best buffer overflow avoidance
Patching
Idle Scan
Uses an idle “zombie” host to veil recon from attacking system.
Password spraying
Using very weak passwords one or two times to not generate a lockout
IRC
Often used to control botnets
Smishing
SMS Phishing
XSS consequences
Steal session cookies, redirecting the victim to another site, or retrieve data from the victim’s computer
Exploit kit
automated framework attackers use to discover and exploit vulnerabilities in an endpoint, infect it with malware, and execute malicious code on it
Domain shadowing
compromising domain registration information for legitimate domains, and registering malicious second-level subdomains such as ek.example.com.
Web based exploit kit
Typically uses PHP scripts hosted on exploit kit server and provides management console to attacker
Exploit kit functionality
Scans host for vulns. Once identified, it sends request to server for exploit code to compromise vuln SW. Code then connects victim to download server to download payload.
../ in uri
Indication of directory traversal
whoami
show the user account and domain information as applicable
netstat -anop
how all active, listening, and closed network connections.
