1.8 Flashcards
Explain the techniques used in penetration testing.
Is a cybersecurity assessment methodology used to identify and exploit security vulnerabilities in a system, network, or application.
Penetration testing
Refers to an environment for which comprehensive information and documentation are available, including system configurations, network architecture, and security controls. Penetration testing in a _____________ involves testing against well-understood systems and known vulnerabilities.
Known environment
Refers to an environment for which limited or incomplete information is available. Penetration testing in an ________________ involves exploring and discovering vulnerabilities through reconnaissance, scanning, and enumeration techniques.
Unknown environment
Refers to an environment for which some information is available, but critical details or configurations are missing or incomplete. Penetration testing in a _________________ involves leveraging available information while conducting additional reconnaissance and analysis to uncover hidden vulnerabilities.
Partially known environment
__________________ in cybersecurity define the scope, objectives, limitations, and rules governing a cybersecurity assessment, exercise, or operation, such as penetration testing. __________ outline the permissible actions, targets, and methodologies that participants are allowed to use and establish guidelines to ensure the safety, legality, and effectiveness of the activity.
Rules of engagement (ROE)
Refers to the techniques used by attackers to move horizontally across a network after gaining initial access to a system. Allows attackers to escalate privileges, explore the network, and compromise additional systems to achieve their objectives.
Lateral movement
Is the process of gaining higher levels of access than originally granted by exploiting vulnerabilities in a system.
Privilege escalation
Is the ability of an attacker to exist beyond a machine reboot or after disconnection.
Persistence
Are mechanisms where companies pay hackers for revealing the details of vulnerabilities that they discover.
Bug bounty
Where an attacker moves to a new location in a network and begins the attack process over again.
Pivoting
Involves gathering information about a target system, network, or environment without directly interacting with it.
Passive reconnaissance
Involves actively probing, scanning, or interacting with target systems to gather information, such as port scanning, network mapping, or service enumeration.
Active reconnaissance
The act of using a drone to fly over a facility and capture wireless network traffic.
War flying
Involves driving or walking around urban or suburban areas to detect and map wireless networks and access points.
War driving
Is the process of gathering information about a target system, network, or organization to identify potential attack vectors, vulnerabilities, or points of entry.
Footprinting
