Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IST-294 IT & DATA ASSURANCE > test3 > Flashcards

test3 Flashcards

1
Q

When would a penetration tester need to use a privilege escalation attack?

A

When they gain access to a shell but it isn’t root or admin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

If you had the ability to overwrite any file on a Linux system, which one would be the easiest to overwrite to gain root-level privileges?

A

Etc/shadow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

When performing a penetration test, what can you offer your clients far beyond simple Nessus and pentest puppy mills?

A

Give them actionable feedback that will help them feel more secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How can history files be used for privilege escalation attacks?

A

Passwords, secret files, and other hosts can be caught in command history.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who is Trevor the Roach? On what day was Trevor murdered?

A

A roach was sucked up through a straw and died, became famous on Twitter. Sept 23, 2017.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does sudo allow you to do on a Linux host?

A

It allows you run commands as either root or a privileged user that has been configured.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What should you include in your penetrating testing reports to help your audience understand the risks you are attempting to communicate?

A

Visuals and images help drill your point home

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a cron job?

A

Does regularly scheduled actions like backups or report generation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the full command you can use on a Linux host to find any SUID / SGID program (any program with the SUID or SGID bits sets)?

A

Find / -perm -4000 -o -perm -2000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the ltrace command do?

A

Calls and searches for libraries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are two privilege escalation techniques that can be used to get full administrative access on most Windows systems?

A

DLL Hijacking by inserting a DLL in a path and Windows will run it. Missing DLLs when a DLL tries to load and nothing is there, the code takes another path.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  1. What tool can be used to find phantom or ghost DLLs?
A

Process Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What port is ssh and what is the correct way to sign in via ssh?

A

Port 22

ssh (username)@(ip)
input password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How to find the kernel version on linux?

A

uname -r

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How to load just the server headers on curl?

A

curl -i

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Hydra and what are some commands for it?

A

Hydra is a password cracking tool.
-L (text file of usernames) -P (password list) ssh://(ip) ftp://(ip):(port)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

John the Ripper? and commands

A

Password cracker

john file.txt

john –show –format=Raw-SHA1 file.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some common nmap switches?

A

-sC is a script scan -sV is a version scan
-Pn is ping sweep -p- pings all ips

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is cewl?

A

Cewl spiders (scans) a URL to a certain depth, and returns a list of words that can be used by password crackers like John the Ripper.

20
Q

netcat?

A

Lets you read and write through network connections.

21
Q

IEEE 802.11

A

is the LAN technical standard for WiFi.

22
Q

What are the two types of Wireless Networks?

A

Ad Hoc Mode, broadcasts a signal from router to ISP (home wifi)
Infrastructure mode, connect to a wireless Access Point (enterprise wifi)

23
Q

Airmon-ng?

A

Lets you view broadcast id’s for wireless networks in your area.

24
Q

What is a BSSID?

A

The MAC Address of an access point. The first 3 sets of characters gives information on the device manufacturer. Example- 70:DB:98 is from Cisco Systems.

25
Q

Difference between monitor mode and promiscuous mode?

A

Promiscuous mode covers wired and wireless networks.

Monitor mode is only wireless.

26
Q

How to kill off processes with airmon-ng and why would you do that?

A

sudo airmon-ng check kill

Ensures the WiFi card is clear for you to sniff packets and look for AP’s

27
Q

What is the command to put a WiFi card into monitor mode?

A

sudo airmon-ng start wlan0

28
Q

What tool and command is used to look for WiFi APs?

A

Airodump

sudo airodump-ng wlan0mon

29
Q

What is an aerodump-ng command that can connect to an AP and watch all clients connected to that AP.

A

airodump-ng -c 1 -bssid () -w /root wlan0mon

30
Q

All devices on a wireless network ______ and ______ data via _____ communication.

A

send, receive, broadcast

31
Q

If a WiFi network is not encrypted, what happens?

A

Other systems can easily read the unencrypted traffic.

32
Q

What is WEP and what does it do?

A

Wired Equivalent Privacy,

An old encryption protocol (RC4). Trivial to decrypt.

33
Q

What was added to WEP to raise the encryption?

A

Temporal Key Integrity Protocol (TKIP) was added.

It raised the encryption to 128-bit (still trivial to decrypt)

34
Q

What is WPA and how does it function?

A

Wi-Fi Protected Access

Uses RC4 encryption (incredibly broken)

35
Q

What is the best wireless protocol to use?

A

WPA3 the best
WPA2 acceptable
WPA no way
WEP heck no

36
Q

How does deauthenticating a Wifi Client work?

A

An active WiFi client can be forced to deauthenticate from an AP by the attacker kicking the client from the network.
Client will automatically reconnect WITH packets that can be captured.

37
Q

What is the chmod command?

A

The chmod command is used to edit read, write, and execute permissions for files and directories.

38
Q

What is the numeric method?

A

The numeric method is a way to symbolize file changes for the chmod command.

read=4
write=2
execute=1

User Group Other
rw- r-x —
6 4 0

chmod 640 file.txt (Read and write for user, read and execute for group, nothing for other.)

39
Q

What do these commands do?

cat
ls
cd
cp
rm
uname

A

cat-displays the contents of a file or files
ls-lists directory contents of files and directories. -l displays detailed information
cd-changes working directory
cp-copies file from one location to another
rm-deletes a file or directory
uname-displays system information

40
Q

Where are the wordlists located in Kali?

A

/usr/share/wordlists

41
Q

What is an LM hash?

A

The LM hash splits the password into 7-character chunks, with padding as necessary. 128 bits

42
Q

What is an NT hash?

A

A hash that is calculated based on the entire password the user entered. 128 bits

43
Q

What is an NTLM hash?

A

A cryptographic format where user passwords are stored on Windows systems in the SAM (Security Account Manager). 128 bit

44
Q

How many bits in SHA512?

A

512-bits

45
Q

How many bits in MD5?

A

128-bit

46
Q

How many bits in sha1?

A

160 bits

47
Q

How many bits in SHA256?

A

256 bits

IST-294 IT & DATA ASSURANCE (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions