Section 15: Network Attacks Flashcards

1
Q

FTP

A

File Transfer Protocol Port 21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SSH, SCP, SFTP

A

Port 22 Secure Shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

23 TCP/UDP

A

Telnet Unencrypted method to remotely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SMTP

A

Port 25 using TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

DNS

A

Port 53 TCP/UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

TFTP

A

Simplified version of FTP Port 69 UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

HTTP

A

80 TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Kerberos

A

88 TCP Used for network authentication using a system of tickets within a Windows domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

POP3

A

110 TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NNTP

A

119 TCP Network News Transfer Protocol is used to transport Usenet articles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

135

A

RPC/DCOM-scm Remote Procedure Call

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

137-139

A

NetBIOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

143

A

IMAP Internet Message Access Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SNMP

A

161 UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SNMPTRAP

A

162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

LDAP

A

389 TCP/UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

HTTPS

A

443 TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SMB

A

Server Message Block 445 TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SMTP

A

465/587 TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Syslog

A

Syslog is used to conduct computer message logging, especially for routers and firewall logs Port 514 UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

LDAP SSL/TLS

A

636 TCP/UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

iSCSI

A

860 TCP

23
Q

FTPS

A

989/990 YCP

24
Q

IMAP4 with SSL/TLS

A

993 TCP

25
Q

POP3 SSL/TLS

A

995

26
Q

Ms-sql-s

A

1433 TCP

27
Q

RADIUS

A

1645/1646 UDP

28
Q

L2TP

A

1701 UDP

29
Q

PPTP

A

1723 TCP/UDP

30
Q

RADIUS

A

1812/1813 (default ports)

31
Q

FCIP

A

3225 TCP.UDP

32
Q

iSCSI Target

A

3260 TCP

33
Q

RDP

A

3389 TCP/UDP

34
Q

Diameter

A

3868 TCP

35
Q

Syslog over TLS

A

6514 TCP

36
Q

How do you stop using certain ports?

A

Turn off the service via task manager, command line net stop service, block the ports at the firewall

37
Q

Denial of Service

A

Any attack to make a computer’s resources unavailable

38
Q

Flood attack

A

sending tons of requests to a server

39
Q

Ping flood

A

Flooding a server with two many pings

40
Q

Smurf attack

A

Sends a ping to subnet broadcast address and devices reply that way

41
Q

Fraggle Attack

A

Attacker sends a UDP echo packet to port 7 (ECHO) and port 19 (CHARGEN) to flood a server with UDP packets - fairly uncommon for today

42
Q

SYN Flood

A

Variant on a DOS attack with just SYN requests

43
Q

Fork Bomb

A

Attack that creates a large number of processes to use up the available processing power of a computer

44
Q

DDOS

A

A group of compromised systems attack a single target simultaneously to create a Denial of Service (DOS)

45
Q

DNS Amplification

A

Attack which relies on the large amount of DNS information that is sent in response to a spoofed query on behalf of the victimized server

46
Q

How do you stop a DDOS?

A

Blackholing or Sinkholing - identifies any attacking IP addresses and routes all their traffic to a non-existent server through the null interface; have an elastic cloud structure that scales up when the load gets heavier

47
Q

Replay Attack

A

Network-based attack where a valid data transmission is fraudulently or maliciously rebroadcast, repeated, or delayed

48
Q

Null Connection

A

A connection to the Windows interprocess communications share (IPC$)

49
Q

Transitive Attacks

A

More of a concept; focuses on the idea of trust, if an attacker can get into one network, they can probably get into the other networks that are similar or connected to that one

50
Q

DNS Poisoning

A

Occurs when the name resolution information is modified in the DNS server’s cache

51
Q

DNSSEC

A

helps protect your cache from poisoning

52
Q

Unauthorized Zone Transfer

A

Occurs when an attacker requests replication of the DNS information to their systems for use in planning future attacks

53
Q

Altered Hosts Files

A

Occurs when an attacker modifies the host file to have the client bypass the DNS server and redirects them to an incorrect or malicious website