Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Comptia Pentest+ > Domain 2: Info Gathering and Vulnerability Identification > Flashcards

Domain 2: Info Gathering and Vulnerability Identification Flashcards

1
Q

What is Domain 2 of the Pentest+?

A

This domain covers information gathering and vulnerability identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the five main functions of Domain 2?

A
  1. Conduct information gathering
  2. Perform Vulnerability Scanning
  3. Analyzing Results of Vuln Scan
  4. Leveraging Information for Exploitation
  5. Weaknesses in specialized systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is information gathering also known as?

A

This is also know as Reconnaissance or foot printing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are some techniques of foot printing?

A

These are all techniques of this:

  • Internet or open-source research
  • Social Engineering
  • Dumpster Diving
  • Email Harvesting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What kind of information are we looking for during reconnaissance?

A

During this step,we are looking for:

  • Phone numbers
  • Contact Names
  • Email Addresses
  • security-related information
  • information systems used (windows, linux, apache, etc)
  • jobs postings
  • Resumes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are some reconnaissance tools?

A

These are tools for this step in the pentesting process:

  • nslookup
  • traceroute
  • ping
  • whois
  • Domain Dossier
  • Email Dossier
  • Google
  • Social Networking (FB, Linkedin, etc)
  • Discover.sh
  • Maltego
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What tools does centralops.net provide?

A

This website provides:

  • Email Dossiers
  • Domain Dossiers
  • Owner of the domain name
  • Technical Details
  • Network Ranges for the domain
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is to be done after footprinting & reconnaissance?

A

Scanning and enumeration is done after this step.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is scanning?

A

When we actively connect to a system and get a response. Identify open ports and services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the types of scanning?

A

These are types of this:

  • Hosts
  • Systems
  • Networks
  • Computers
  • Mobile Devices
  • Applications
  • Printers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is enumeration?

A

Actively connecting to the systems to determine open shares, user accounts, software versions, and other detailed info.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What types of enumerations are there?

A

There are types:

  • hosts
  • Networks
  • Domains
  • Users/Groups
  • Network Shares
  • Web Pages
  • Application
  • Services
  • Tokens
  • Social Networks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is fingerprinting?

A

This is identifying an operating system, server, service that is being used by a particular service or network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Banner Grabbing?

A

This is manual enumeration and fingerprinting. Using program such as telnet or netcat to connect to a target host. Commonly used for FTP, SSH, Telnet, & HTTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is packet crafting also known as?

A

This is also known as packet manipulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is packet crafting?

A

This entails sending modified packet headers to gather information from a system or host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is packet inspection?

A

This is manual enumeration performed by analyzing the captured packets to determine information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When using nmap/zenmap, where do you typically want to start?

A

With these tools you’ll typically want to start with the least intrusive scan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is one of the least intrusive scans you can perform?

A

This type of scan would be a ping scan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When scanning a network w/ nmap/zenmap, how would you list out a network with a /24? How about /16?

A
  1. 168.52.0/24

192. 168.52.0/16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When scanning a network with nmap/zenmap, how would scan a list of addresses?

A
  1. 168.52.0-254

192. 168.52.0-224

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What would be the nmap command to run a simple ping scan on a network?

A

nmap -sn [network address]

nmap -sn 192.168.52.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What information will a ping scan provide?

A

This type of scan will provide information on what machines are up or down on a given network. Provides IP addresses and MAC addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

We have two machines with the following IP addresses:

  1. 168.52.100
  2. 168.52.101

What would be the nmap command to run a quick scan?

A

nmap -T4 -F 192.168.52.100-101

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does it mean to have ports filtered?

A

This means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

With Nmap, what would be an intrusive scan?

A

With this tool this would be considered an intense scan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

We have two machines with the following IP addresses:

  1. 168.52.100
  2. 168.52.101

What would be the nmap command to run an intense scan?

A

nmap -T4 -A -v 192.168.52.100-101

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is cryptographic Inspection?

A

This determines the indentification of the type of encryption being used by machines/hosts/services/etc during information gathering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is certificate inspection?

A

Identify what type of encryption a web server is using. ie. SSL 2.0, TLS? Tools exist for this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Eavesdropping is considered what?

A

This is considered a method of information gathering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How can you eavesdrop on a network?

A

You can do this by sniffing network traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does it mean to sniff network traffic?

A

Intercepting and logging network traffic that can be seen via the wired or wireless network interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Can you capture network information about other parts of a network if you gain access to a particular host?

A

Yes, if you can sniff additional network information by doing this.

34
Q

What are two commonly known tools to capture packets from a network & hosts?

A

Wireshark and TCP are this.

35
Q

When using Wireshark to capture packet, what type of file can be created to log the information?

A

This is a pcap file.

36
Q

What is decompiling?

A

This is the process of reverse engineering software using a decompiler.

37
Q

What is an issue with a Decompiler?

A

This tool will not always turn executables back into their source code, but can turn it back to Byte code or assembly.

38
Q

In pentesing, when can a decompiler be helpful?

A

This can be helpful during a pentest when you’re testing custom built tools or applications.

39
Q

What does CERT stand for?

A

Computer Emergency Response Team

40
Q

What are some open source resources that can be used for info gathering?

A

These resources can be used for this:

  • CERT
  • JPCERT
  • NIST
  • CVEs (mitre)
  • CWE (mitre)
  • CAPEC (mitre)
  • Full Disclosure (nmap)
41
Q

When you see ‘CVE-2018-11232’, what does that mean?

A

This means that it is the 11232nd vulnerability of 2018.

42
Q

Who submits their Common Vulns into the CVE database?

A

All major vendors submit these to this location.

43
Q

What does CAPEC stand for?

A

Common Attack Pattern Enumeration & Classification

44
Q

What does -sC mean in Nmap?

A

This option is the default script scan

45
Q

What does -sV mean in Nmap?

A

This option probes open ports to determine service/version info

46
Q

What is a vulnerability scan?

A

This is a scan of a host, system, or network to determine what vulnerabilities exist.

47
Q

What is the primary thing to keep in mind in regards to vulnerabilities scanning?

A

The tools used to do this are only as good as their configurations.

48
Q

What types of vuln scans are there?

A

For this, there are two types of scans:

  • Credentialed
  • non-credentialed
49
Q

What are the four types of vuln scans?

A

For this, there are four types:

  • Discovery Scan
  • Full Scan
  • Stealth Scan
  • Compliance Scan
50
Q

What is the least intrusive type of vuln scan? What does it do?

A

This is a discovery scan. Used to create a network map to show connected devices on architecture.

51
Q

what would be the nmap command to run a simple discovery command?

A

This type of scan would be:

-nmap -sn 192.168.52.0

52
Q

What does a full scan vuln scan do?

A

This type of in-depth vuln scan includes ports, services, and vulns.

53
Q

What needs to be considered when running a full scan?

A

This type of scan is likely to set off alarms (IDS, NDS, etc).

54
Q

What is the purpose of a stealth scan? What does it do?

A

This type of scan is designed to not get picked up by the IDS. Sends SYN packets and then analyzes responses. If SYN/ACK response received, packet with RST is sent to attempt to connect on a port.

55
Q

What is the intent of a compliance scan? Where can this be done easily?

A

This type of scan is used to identify vulnerabilities that may affect compliance with regulations or policies. Commonly set up as a scanning template in your vulnerability scanner (PCI-DSS within Nessus)

56
Q

What are some common vuln scanners?

A

These are types of this:

  • QualysGuard
  • OpenVAS
  • Nessus
  • Nexpose
  • Nikto (Web Application Scanner)
57
Q

What are some important scanning considerations?

A

These are…:

  • When do you run the scan?
  • What protocols will be used?
  • Where do you scan from?
  • How much bandwidth is dedicated to the scan?
  • Should we scan or exempt these (systems)?
58
Q

How do you throttle a query in nmap?

A

To do this, you’ll use the ‘-T’ option within Nmap.

59
Q

What are the two types of application scanning?

A

The two types of this are:

  • Dynamic
  • Static
60
Q

What is dynamic application scanning?

A

This is a type of scan that occurs while application is running. Program is run in sandbox and changes noted.

61
Q

What is static application scanning?

A

This type of scan occurs in a non-runtime environment for applications. It inspects programming code; can be doen line-by-line.

62
Q

What are containers similar to?

A

These are similar to mini virtual machines

63
Q

What are some examples of containers?

A

These are examples of this:

  • Docker
  • Puppet
  • Vagrant
64
Q

Do Containers require security? What could be a major issue?

A

Yes, these still require security. They all run on a single, standardized OS. A flaw in this OS would mean vulnerabilities across multiple containers.

65
Q

What are some ways to analyze your vulnerability scans?

A

These are ways to do this:

  • Asset Categorization
  • Adjudication
  • Prioritize Vulnerabilities
66
Q

When categorizing assets, what do we typically want to categorize first?

A

When doing this, we want to identify high-value assets first. Domain controllers, Web Servers, Databases, etc

67
Q

What does Adjudication mean with respect to pentesting?

A

This is the process of considering which vulnerabilities to attack.

68
Q

What is a false positive relative to a vuln scan? What should be done with them?

A

This is a vulnerability that shows up in your scan, but is not an actual vuln on the system. False positives should filtered out of scan results.

69
Q

When scanning for vulns, what is important to find?

A

During this, it is important to find common themes. Common vulns, common lack of best (weak) practices, Observations.

70
Q

What is an important step after a vuln is found and has been categorized? What is a good question to ask?

A

Researching that particular vulnerability and find any/all exploits that exist. Does metasploit or nmap already have known exploits for this vuln?

71
Q

What are some examples of common attack techniques (vectors)?

A

These are some examples:

  • cross-compiled code
  • exploit modification
  • exploit chaining
  • proof-of-concept dev
  • social engineering
  • credential brute forcing
  • dictionary attacks
  • Rainbow tables
  • Deception
72
Q

How can you create windows binary on a linux system?

A

This can be done with tools like Mingw-w64.

73
Q

What is an example of an exploit chain?

A

These are examples of this:

  • Exploit to break past firewall
  • Gain access to user system
  • Escalate the privileges
74
Q

What does it mean to have a proof-of-concept development?

A

This involves building out and attacking a virtual environment that mimics the real system/environment.

75
Q

What does ICS stand for?

A

Industrial Control System

76
Q

What does SCADA Stand for?

A

Supervisory Control and Data Acquisition

77
Q

What does PLC stand for?

A

Programmable Logic Controller

78
Q

What does ICS, SCADA, & PLC all work together with?

A

These three work together with HVAC, Factories, pumps, etc. These three are old technologies that are integrated with old operating systems.

79
Q

Where are ICS, SCADA, & PLC often located?

A

These three things are often located off of and separate of a network.

80
Q

What items contain embedded devices? What do embedded devices contain?

A

Cars, ICS/SCADA contain These. These contain a special purpose computing system.

81
Q

What is an RTOS? Where are they found?

A

This is a Real-Time Operating system. These are often found in embedded devices. Usually stripped down version of linux.

ag-Comptia Pentest+ (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions