Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Pentest+ PTO-002 > Tool Round Up > Flashcards

Tool Round Up Flashcards

1
Q

WHOIS

A

TAG: OSINT

A query and response protocol that’s widely used for querying databases that store the registered users or assigness of an internet resource
* Anyone who buys a domain name is listed in WHOIS

USE
whois domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Nslookup

A

TAG: OSINT
A network admin CLI tool for querying DNS to obtain the mapping between domain names and IPs, or other DNS records
* Most basic form finds IP with a given domain name

Use
nslookup domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

FOCA

A

TAG: OSINT
Fingerprinting Organizations with Collected Archives
* Used to find metadata and hidden information in collected documents from an org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

theHarvester

A

TAG: OSINT
A program for gathering emails, subdomains, hosts, employee names, emails, PGP key entries, open ports, and service baners from servers

Use
theharvester -d domain[.]com -l 500 -b google

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Shodan

A

TAG: OSINT
A website search engine for web cams, routers, servers, and other devices that are considered part of the IoT
* Search for anything that’s a vulnerable asset online

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Maltego

A

TAG: OSINT
A piece of commercial software used for OSINT that visually connects the relationships between data points
* What things are linked to other things
* It can automate the querying of public sources of data and then compare it with other information from various sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Recon-ng

A

TAG: OSINT
A system of modules to add additional features and functions for your use
* Cross-platform web recon framework
* Like metasploit but for recon shit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Censys

A

TAG: OSINT
A website search engine used for finding hosts and networks acros the internet with data about their configuration
* Like Shodan
* Cloud, shared, and other infrastructure used
* Finding vulns associated with targets you go after

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Nikto

A

TAG: Scanning
A web vulnerability scanner that’s used to assess custom web apps that a company may have coded themselves
* Identifies outdated versions or server misconfigurations
* Vuln scanner for web servers

Use
perl nikto.pl -h [ IP address of target ]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OpenVAS

A

TAG: Scanning
Open-source vulnerability scanner that’s used to identify vulns and assign a risk rating for the targeted assets
* Scans entire network and shows results in a chart
* Very noisy and easy to detect
* Select just vulns you want to verify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Nessus

A

TAG: Scanning
A proprietary vulnerability scanner used to conduct basic, advanced, and compliance vuln scans to measure the effectiveness of the system’s security controls
* A lot like OpenVAS
* Commercial product with many plugins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Open SCAP

A

TAG: Scanning
Security Content Automation Protocol
* A tool created by NIST that’s used to create a predetermined security baseline that can be used to determine vulnerabilities or deviations in a system
* Choose baseline you want or create your own

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SQLmap

A

TAG: Scanning
Open-source database scanner that searches for SQL injection vulnerabilities that can be exploited
* This is a Python script
* Focus is the SQL database beneath the website to see if vulnerable to injection

Use
python sqlmap.py -u website –batch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Wapiti

A

TAG: Scanning
A web app vulnerability scanner which automatically navigates a web app looking for areas it can inject data to target different vulnerabilities
* It runs various modules against a given web app
* Tests APIs more than anything inside web apps

Use
wapiti -u target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Brakeman

A

TAG: Scanning
Static code analysis security tool that’s used to identify vulnerabilities in apps written in Ruby on Rails
* Load code into the tool, then it assesses
* Helpful with known environment test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

WPScan

A

TAG: Scanning
A WordPress site vulnerability scanner that identifies the plugins used by the website against a database of known vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Wireshark

A

TAG: Networking
Open-source protocol analysis tool that can conduct packet sniffing, decoding, and analysis
* Capture packets thru wireless or wired network and cap all traffic
* If plaintext, you’ve got it now

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ScoutSuite

A

TAG: Scanning
Open-source tool written in Python that can be used to audit instances and policies created on multicloud platforms by collecting data with API calls
* Scans cloud servers
* Also relevant for cloud tools section

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Tcpdump

A

TAG: Networking
A CLI protocol analysis tool that can conduct packet sniffing, decoding, and analysis
* Basically like wireshark but CLI
* Can filter through all the input easily to search with Python and grep
* Can be faster than wireshark with automation and scripting to find specific things in the traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Hping

A

TAG: Scanning
Open-source packet crafting tool used to exploit vulnerable firewall and IDS/IPS
* Can craft TCP, UDP, ICPM, or RAW-IP protocols
* Used during enumeration for fingerprinting
* Change the way you send packets and analyze the way they’re sent back, which helps identify which services and versions are being run

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Aircrack-ng

A

TAG: Wireless
Open-source wireless exploitation toolkit that has
* airomon-ng: Monitor wireless frequencies to identify access points and clients
* airodump-ng: Captures network traffic and safe to pcap file
* aireplay-ng: Conducts deauth attack by sending spoofed deauth requests to the access point
* airocrack-ng: Conducts protocol and password cracking of wireless encrypting (brute forcing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Kismet

A

TAG: Wireless
Open-source tool that contains a wireless sniffer, network detector, and IDS
* Works passively and doesn’t send packets into the network
* Stealthy for recon
* Cross-platform for all OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Wifite

A

TAG: Wireless
Wireless auditing tool that can be used to conduct a site survey to locate rogue and hidden access points
* Audits WEP or WAP encrypted networks
* Also audits WPS
* Uses tools like aircrack-ng and Reaver in the background
* Automated wireless attack tool

Use
wifite
* Puts card in monitor mode, scans, and has you pick a number based on what it finds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Rogue Access Point

A

TAG: Scanning
Any wireless access point that’s been installed on a secure network without explicit authorization from a local network admin
* Wi-Fi pineapple can do this and cap all traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

EAPHammer

A

TAG: Wireless
Python based toolkit that can be used to steal EAP authentication credentials used in a WPA2-Enterprise network
* Executes credential theft evil twin attacks against WPA and WPA2 EAP networks
* Goal is to steal victim RADIUS credentials by creating evil twin attack
* Pretend to be victimized client and auth to the trusted network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

mdk4

A

TAG: Wireless
Wireless vulnerability exploitation toolkit that can conduct 10 typs fo 802.11 exploitation techniques
* Injects frames in order to exploit
* Used against 2.4 and 5 ghz bands
* Beacon flooding
* Auth DoS
* SSID probing and brute forcing
* Deauth and disassociation
* Michael countermeasures exploit
* EAPOL start and logoff packet injection
* Attacks for IEEE 802.11s mesh networks
* WIDS confusion confuse/abuse
* Packet fuzzer
* POC of WiFi protocol implementation vulnerability testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Spooftooph

A

TAG: Wireless
Automates the spoofing or cloning of a Bluetooth device’s name, class, and address
* Can be used by attacker to pretend to be victim so the attacker’s BT device can hid in plain sight
* BT scanning software will only list one of each device it finds with same name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Reaver

A

TAG: Wireless
Tool that conducts brute force attack against an access point’s WPS PIN to recover the WPA PSK
* Once pin is found, PSK can be found easily
* Can reconfigure AP settings once it’s in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

WiGLE

A

TAG: Wireless
Wireless Geographic Logging Engine
* A wireless OSINT tool that consists of a website and database dedicated to mapping and indexing all known wireless access points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Fern

A

TAG: Wireless
Tests wireless networks by conducting password recovery through brute force and dictionary attacks, as well as session hijacking, replay, and on-path attacks
* WEP, WPA, and WPS keys
* GUI based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

SET

A

TAG: Social Engineering
Social Engineering Toolkit
* Python-based collection of tools and scripts that are used to conduct social engineering during a pentest
* Menu-driven selection for modules like zphisher, metasploit, etc, etc
* EXAM NOTE: Helps automate the process of technical social engineering attacks

29
Q

BeEF

A

TAG: Social Engineering
Browser Exploitation Framework
* Used to access the security posture of a target environment using cross-site attack vectors
* Tool that’s focused on the victim’s web browser
* Can attack DOM based exploits
* Hooks a web browser for launching command modules against the given browser
* Can do clickjacking, XSS, and other attacks
* Great tool for testing browsers and associated web servers and apps

30
Q

SSH

A

TAG: Remote Access
Secure Shell
* CLI tool that’s used to remotely control another workstation over a LAN or WAN
* Encrypted secure tunnel between cient and server

31
Q

nc

A

TAG: Remote Access
Netcat: A CLI utility used to read from or write to TCP, UDP, or Unix domain socket network connections
* Can sweep a network to find machines it contains, enumeration, banner grabbing, fingerprinting, etc
* Best use is that it’s an access tool that lets us read, write, redirect, and encrypt data over the network
* BIND SHELL: Set up listener on one machine and connect from our target machine
* REVERSE SHELL: Victim machine calls back to listener set up on attacker machine, can answer the call and take remote control

32
Q

Ncat

A

TAG: Remote Access
An improved version of netcat which can also act as a proxy, launch executables, transfer files, and encrypt all comms to and from the victim machine

Use
ncat -C domain 90
* Banner grab

Can also use this for remote C2 just like with netcat

33
Q

ProxyChains

A

TAG: Remote Access
A CLI tool that enables pentesters to mask their identity and/or source IP by sending messages through proxy servers or other intermediaries
* Often used on attacking machine as it conducts tests
* Forces all TCP connections to run through a given proxy
* Can also chain together multiple proxies

34
Q

Hashcat

A

TAG: Credential Testing
A modern password and hash cracking tool that supports the use GPUs for parallel processing when conducting dictionary, brute force, and hybrid attacks
* One of the fastest tools available

35
Q

Medusa

A

TAG: Credential Testing
A parallel brute force tool that’s used against network logins to attack services that support remote authentication
* Supports logins and remote auth protocols like rlogin, SSH, Telnet, HTTP, and many more
* Supports mutli-threaded operations and can attempt a lot of simultaneous logins

36
Q

Hydra

A

TAG: Credential Testing
A parallel brute force tool that also supports a pw-inspect module to only attempt password from a dictionary that meets the minimum password requirements for a given system
* Defenders will see the attempts in logs as it runs
* This is an online password cracker

37
Q

CeWL

A

TAG: Credential Testing
Used to generate word lists based on the automatic crawling of a website to collect words and metadata from the site
* Search a target website, crawl through it for however long it needs, however deep we tell it, and search for keywords
* Makes wordlist based on what it finds which can be used for brute force

38
Q

John the Ripper

A

TAG: Credential Testing
Password cracking tool that supports large sets of hashes, dictionary, and brute force attacks
* Offline tool

39
Q

Cain

A

TAG: Credential Testing
Legacy password cracking and hash dumping toolthat can conduct network sniffing to identify hashes that may be vulnerable to cracking
* Windows based tool with GUI

40
Q

Mimikatz

A

TAG: Credential Testing
Tool that gathers credentials by extracting key elements like cleartext passwords, hashes, and PIN codes from the memory of a system
* Critical tool to use against Windows
* Pass the hash, pass the ticket, and golden ticket
* Focused on Kerberos protocol

41
Q

Patator

A

TAG: Credential Testing
Multi-purpose brute force tool that supports several methods including ftp, ssh, smb, vnc, and zip password cracking
* Similar to Medusa and Hydra
* Remember this is just another password cracker

42
Q

DirBuster

A

TAG: Credential Testing
Brute force tool that runs against a web app or server to identify unlisted directories and file names that may be accessed
* GUI based tool
* Finds files and folders that aren’t supposed to be publically visible, but are

43
Q

w3af

A

TAG: Credential Testing
Web Application Attack and Audit Framework
* Tool used to identify and exploit a large set of web-based vulnerabilities like SQL injection and XSS
* Think of it like Nessus, Nikto, or OpenVAS but for web apps
* Has an embedded plugin to brute force and crack or bypass authentication credentials in a web app
* EXAM NOTE: Considered password cracking tool for web apps

44
Q

OWASP ZAP

A

TAG: Web Applications
OWASP Zed Attack Proxy
* An open-source web app security scanner and attack proxy used in automated and manual testing and identification of web app vulnerabilities
* Connect our browser to the ZAP proxy, and then out to the victim server
* We can then manipulate traffic running through the proxy, even HTTPS sessions
* Can change session IDs, parameters, and other variables

45
Q

Burp Suite

A

TAG: Web Applications
Used in raw traffic interception, inspection, and modification during automated testing, manual request modification, and passive web app analysis
* Most commonly used by pentesters
* Allows for interception, inspection, and modification of raw traffic passing through, much like ZAP
* But Burp is more heavily used by pentesters because we can modify all the different factors like session keys, passwords, hidden forms, etc
* Easier to use than ZAP

46
Q

Gobuster

A

TAG: Web Applications
Brute force dictionary, file, and DNS identification tool used to identify unlisted resources in a web app
* Text-based tool installed by default on Kali
* Scans websites or web apps to identify any hidden directories, files, or subdomains that exist
* Used heavily in recon and enumeration phase

47
Q

ScoutSuite

A

TAG: Cloud
Open-source tool written in Python that can be used to audit instances and policies created on multicloud platforms by collecting data using API calls
* Suite of cloud based tools that can be used across multiple clouds like MS, Google, AWS, etc
* Other cloud tools are focused on single cloud

48
Q

CloudBrute

A

TAG: Cloud
Used to find a target’s infrastructure, files, and apps across the top cloud service providers including Amazon, Google, MS, DigitalOcean, Alibaba, Vultr, and Linode
* Covers more cloud types that ScoutSuite
* CLI tool

49
Q

Pacu

A

TAG: Cloud
Exploitation framework used to assess the security configuration of an AWS account
* Includes several modules that helps focus on things like gaining API keys or taking control of different VM instances
* Focuses on post-compromise phase
* Drill into the system, escalate privileges, launch additional attacks, and install backdoors
* Dion thinks of this as a tool used during attack and exploit phase

50
Q

Cloud Custodian

A

TAG: Cloud
Open-source cloud security, governance, and management tool designed to help admins create policies based on different resource types
* Stateless rules engine that manages AWS instances
* EXAM NOTE: Think governance and policy inside the AWS environment

51
Q

OpenStego

A

TAG: Steganography
Free steganography solution to conduct data hiding within a file and watermarking of files with invisible signatures to detect unauthorized file copying
* GUI-based
* Can encrypt contents while embedding in the file

52
Q

Steghide

A

TAG: Steganography
Open-source steganography tool used to conceal a payload by compressing, concealing, and encrypting its data in an image or audio file
* GUI
* Can also encrypt

52
Q

Snow

A

TAG: Steganography
CLI tool that conceals a payload within the whitespace of an ASCII formatted text file in plaintext or encrypted format
* Purely based on text files

53
Q

Coagula

A

TAG: Steganography
An image synthesizer tool that can be used to create a sound file (.wav) from a given image
* You want to hide a picture, which is turned into an audio file
* Can view the wav visualizer to see the secret words

54
Q

Sonic Visualizer

A

TAG: Steganography
Open-source application for viewing and analyzing the contents of music audio files
* This could read the data you compress in Coagula

55
Q

TinEye

A

TAG: Steganography
A website that can be used to conduct reverse iage searches using image recognition

56
Q

Metagoofil

A

TAG: Steganography
A Python tool that can search for metadata from public documents located on a target’s website
* Metadata is a form of steganography because data will be hidden in here some times

57
Q

Online SSL Checker

A

TAG: Steganography
Web application that can be used to test the validity, strength, and security of an SSL or TLS digital certificate for a given web server
* Not sure why it’s in steganography, but it is
* SSL labs website

58
Q

OllyDbg

A

TAG: Debuggers
Linux debugger that can be used to analyze binary code foundin 32-bit Windows apps
* If you don’t have access to source code this is helpful
* Can reverse engineer malware
* Can develop custom exploits based on binaries found in the wild

59
Q

Immunity Debugger

A

TAG: Debuggers
A debugger built specifically for pentesters to write exploits, analyze malware, and reverse engineer binary files using Python scripts and APIs
* Difference between OllyDbg is that Immunity uses a Python API plugin that allows execution of Python code from within the debugger
* This allows pentesters to work more quickly
* Favorite for pentesters who do custom coding

60
Q

GNU Debugger (GDB)

A

TAG: Debuggers
Open-source, cross-platform debugger for Unix, Windows, and MacOS
* Supports Ada, C, C++, Objective-C, Pascal, Fortran, Go, Java, and many other languages
* Text based that works inside Linux console, not very user friendly

61
Q

WinDbg

A

TAG: Debuggers
Free debugging tool that’s distributed by Microsoft for use in the Windows OS
* Can debug kernel-mode and user-mode code, analyze crash dumps, and examine the CPU registers while the code is executing on a Windows host

62
Q

IDA

A

TAG: Debuggers
The Interactive Disassembler
* A commercial disassembler and debugging tool that generates assembly language source code from machine-executable code
* GUI can map out the program and what function calls go where
* Can read exe from multiple OS, even though it’s used in Windows

63
Q

Covenant

A

TAG: Debuggers
An open-source .NET framework focused on pentesting that also has a dev and debugging component
* More of a .NET C2 framework written in C#
* Aims to highlight the attack surface of the .NET code and to make the use of offensive .NET tradecraft easier for pentesters
* Has a debugger built in, but way more capabilities beyond that

64
Q

SearchSploit

A

TAG: Debuggers
A tool used to find exploits available on Exploit-DB
* Often used while reading different malware in a debugger so we can understand what a particulare piece of exploit code might be doing
* Not a debugger, but used with debuggers
* Can carry an offline copy of the database with you so you can do offline searches through a local repository

65
Q

PowerSploit

A

TAG: Misc
A collection of PowerShell modules that create an extensive exploitation framework for use against Windows systems
* Post-exploit framework
* You can use the scripts to further exploit a machine once you break in
* LOTL technique that uses pre-built ps1 scripts

66
Q

Responder

A

TAG: Misc
CLI tool in Kali that’s used to poison NetBIOS, LLMNR, and MDNS name resolution requests
* If you break into a Windows network it uses LLMNR, NetBIOS, or local DNS for name resolution
* Responder listens for when people call out for a certain machine, like the AD server
* Poisons the DNS call or the nameserver call
* Instead of going to the AD server, they come to attacker instead
* On-path, and allows for other exploits against victims

67
Q

Impacket Tools

A

TAG: Misc
Open-source collection of Python classes for working with network protocols and the exploitation of Windows systems, lets you do things like
* Remote execution
* Kerberos attacks
* Windows Secrets
* On-path attacks
* Interacting with WMI
* Taking advantage of SMB/MSRPC protocols
* Useful tool to create your own exploits inside of Python
* Focuses on low level program access to the different functions and services used by the network you need to call while using your tools

68
Q

Empire

A

TAG: Misc
C2 framework that uses PowerShell for common post-exploitation tasks on Windows systems and Python for post-exploitation tasks on Linux systems
* Post-exploit framework

69
Q

Metasploit

A

TAG: Misc
Multipurpose computer security and pentesting framework that uses modularized attacks against known software vulnerabilities to exploit systems
* Post-exploit framework

70
Q

mitm6

A

TAG: Misc
An IPv6 DNS hijacking tool that attempts to set the malicious actor as the DNS server by replying to DHCPv6 messages and then redirecting the victim to another malicious host
* Exploits the default configuration of a Windows system to take over the default DNS server

71
Q

CrackMapExec

A

TAG: Misc
A post-exploitation tool to identify vulnerabilities in AD environments
* Helps automate the security assessment of large AD networks
* LOTL by using built in AD features and protocols

72
Q

TruffleHog

A

TAG: Misc
Git secrets search tool that automatically crawls through a repo looking for accidental commits of secrets to the GIt repo
* Runs behind the scenes to scan for private keys and credentials
* Goes through the entire commit history of each branch and checking each Git for each commit
* Checks for secrets with regex and entropy checks

Pentest+ PTO-002 (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions