Security Plus Flashcards
(39 cards)
Attack an account with the top three (or more) passwords. If they don’t work, move to the next account. No lockouts, no alarms, no alerts.
Spraying attack
They identify patterns in data and improve their predictions.
Machine Learning
Gain higher-level access to a system. Horizontal privilege escalation User A can access user B resources.
Privilege escalation
Attacker embeds malicious scripting commands on a trusted website.
Cross-Site Scripting (XSS)
Attempts to get data provided by the attacker to be saved on the web server by the victim. Attacker posts a message to a social network with malicious payload.
Cross-Site Scripting (Stored/Persistent)
Attempts to have a non-persistent effect activated by a victim clicking a link on the site. Attacker emails a link that takes advantage of this vulnerability. Runs a script that sends credentials/session IDs/cookies to the attacker.
Cross-Site Scripting (Reflected)
Attack consisting of the insertion or injection of an SQL query data from the client to a web application.
SQL injection
Insertion of additional information or code through data input from a client to an application. Examples, SQL, HTML, XML, and LDAP.
Injection Attack.
What injection attack is prevented through input validation and using least privilege when accessing a database.
SQL injection.
’ OR 1=1
SQL Injection.
Application verify that information received from a user matchers a specific format or range of value.
Input Validation.
Occurs when a process stores data outside the memory range allocated by the developer
Buffer Overflows.
Network-based attack where a valid data transmission is fraudulently or malicious rebroadcast, repeated, or delayed.
Replay Attack.
A technique that allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LM hash instead of requiring the associated plaintext password.
Pass the Hash.
Attacker intercepts the session ID and uses it to access the server with the victim’s credentials.
Session Hijacking.
Occurs when an attacker forces a user to execute actions on a web server for which they are already authenticated.
Cross-site Request Forgery (XSRF/CSRF)
Shimming (filling space between two objects) and Refactoring (different program each times its downloaded.
Driver Manipulation
Time synchronization
Network Time Protocol (NTP)
Vulnerability is found where multiple threads are attempting to write a variable or object at the same memory locations.
Race condition
Able to read file from a web server that are outside of the websites file directory.
Directory traversal.
A library of programming utilities used to enable software developers to access functions of another application.
API (Application Programming Interface.
An unauthorized WAP or Wireless Router that allows to the secure network.
Rogue Access Point.
A rogue, counterfeit, and unauthorized WAP with the same SSID as your valid one.
Evil Twin.
Sending of unsolicited messages to BLuetooth enabled devices such as mobile phones and tablets.
Bluejacking
