Security: Information Gathering PEs Flashcards
PFC Tyler is attempting to execute a dig query on a site, but he misspelled the website name and accidentally spelled a non-existent website name instead. What status will PFC Tyler see when he attempts this query? Hint: the domain name queried does not exist
NXDOMAIN
A traceroute is a network command that can be run on your computer if you experience routing problems. It traces the “hops” between your computer and the final destination. For each hop, the traceroute will diagnose where the problem is.
True
When in the Information Gathering/Reconnaissance phase, an attacker should gather the least amount of data possible so they can reduce the number of attack vectors, which will reduce the probability of being detected.
False. You want to gather as much data as possible and increase the number of attack vectors
What phase of the Cyber kill chain would be considered the most important phase? This would be paramount to successfully continue all the other phases.
reconnaissance
What are the two modes Nslookup can be used in? Format (xxx, xxx-xxx)
Interactive, non-interactive
_______________ mode allows a user to execute queries back-to-back without typing the entire command for each query.
interactive
_______________ mode involves typing the entire command for each query.
Non-interactive
What command queries a DNS (Domain Name System) server for DNS records relating to IP addresses, mail exchanges, and name servers?
Dig
What is the name of the website using the address 63.147.161.50?
goarmy.com (hint use nslookup)
What is IPv4 address is the webpage text-lb.esams.wikimedia.org using?
91.198.174.192 (hint use nslookup)
If there are no errors with a dig query, what status will the user see?
No Error
What query status might a user see if they attempt a dig query on a site that has security settings configured so that zone transfers are not permitted or the zone does not exist at the request authority?
Refused
SGT Gray wants to verify that the H&S Company printer is able to respond to network connections. The IP address of the printer is 192.168.0.105? What command will SGT Gray execute to perform this task?
Ping 192.168.0.105
How many times will the remote host 192.168.1.101 be ping’d if the following command is executed? ping -c 6 192.168.1.101
6
Target Development includes all of the following EXCEPT:
- Understanding potential vulnerabilities
- Obtaining or developing scripts
- Deliver brief derived from mission analysis
- Planning execution of exploit
- Testing in a controlled environment
Deliver brief derived from mission analysis
It is possible to exploit a target without gathering any information on the target.
False
Which of the following is NOT one of the 4 Ds:
- Deny
- Degrade
- Destroy
- Delay
- Disrupt
Delay
Some information cannot be found within the IP address alone. Select the group of tools that can used in the information gathering phase:
ping, dig, traceroute, nslookup
What is an example of nslookup syntax:
nslookup www.google.com
These __________ packets are sent and all routers involved receives these particular packets. These determine if the information in the packets are able to transfer the data effectively.
ICMP
The ____________ is a series of steps that trace stages of a cyber attack from the early reconnaissance stages to exfiltration. Understanding this process can help users understand and combat ransomware, security breaches, and advanced persistent attacks (APTs)
Cyber Kill Chain
What specifies the number of pings?
-c
When using the dig command, you may see multiple IP’s from your query. This could be an indication that a __________ may be present?
Load Balancer
SSG Thomas needs to see the gateways that packets pass through to reach the destination amazon.com. What command can SSG Thomas use to see this?
traceroute www.amazon.com
___________ is built into both Windows and UNIX operating systems, and is a universal way of testing network response time and performance.
ping
What is it called when an attacker probes for weakness including harvesting login credentials or information that is useful in phishing attacks?
Reconnaissance
This type of exploitation is taking advantage of a system’s setting that allows it to be manipulated by an unintended source.
Misconfiguration
This type of exploitation is taking advantage of poor OPSEC, cyber training, or restrictions in place.
Human
What command queries DNS servers for relating information such as name servers, mail exchanges and IP addresses.
Dig
What is an example of the a Cyber Kill Chain?
A planned process of cyber attacks
