Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Pentest+ > 3.3 Attacks & exploits: Network Attacks > Flashcards

3.3 Attacks & exploits: Network Attacks Flashcards

1
Q

Stress testing: what is it and what is tested during it?

A

A software testing method that evaluates how software performs under extreme load:
● Processor load
● Memory load
● Network load
● Storage load

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Stress testing: why should you do it?

A

Stress testing shows a server’s limits and architectural support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Stress testing: how do you do the stress testing?

A

Methods:
● Python or PowerShell scripts
● Open-source software tools
● Software-as-a-Service solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Exploit Resources: what is exploit-db.com?

A

A complete collection of public exploits and vulnerable software kept in a fully searchable database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Exploit Resources: what is packetstormsecurity.com?

A

Contains news articles, advisories, whitepapers, tools, and exploits that can be reviewed and used in penetration tests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Exploit Resources: what is Exploit Chaining?

A

▪ Combines multiple exploits to form a larger attack
▪ Chained exploits can be run simultaneously or sequentially

Ex1: Piggybacking => lock picking => Rogue WAP
Ex2: SQL injection => Privilege Escalation => Keylogging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ARP Poisoning: what is Address Resolution Protocol (ARP)?

A

Address Resolution Protocol (ARP) is a protocol that connects an ever-changing Internet Protocol (IP) address to a fixed physical machine address, also known as a media access control (MAC) address, in a local-area network (LAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ARP Poisoning: what is ARP Spoofing?

A

▪ Sending falsified ARP messages over a local area network to get the ARP caches to dynamically update with new information
▪ ARP spoofing attack can be used as a precursor to other attacks
▪ Anytime a frame claims to have a new IP address for a given MAC address, the routing switch will update its ARP cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ARP Poisoning: how to prevent from this attack?

A

Prevent ARP poisoning by setting up good VLAN segmentation and DHCP snooping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ARP Poisoning: how do you perform this attack? Provide the tool names and the commands that you will run:

A

1/ Identify the MAC address and IP address using Wireshark or Nmap:
nmap -PR -sn <target></target>

2/ Use a spoofing tool such as Arpspoof or Metasploit:
o arpspoof -i eth0 -t <IP>
o msfconsole
o use axiliary/spoof/arp/arp_poisoning</IP>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

DNS Cache Poisoning: what is Domain Name System (DNS) used for?

A

Converts domain names to IP addresses every time a user clicks on a link or enters a domain name into their browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DNS Cache Poisoning: what is DNS Cache Poisoning?

A

Attempts to change the IP address of a domain name stored in the DNS cache of a given DNS server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DNS Cache Poisoning: how do you perform the attack? Provide the command you use and explain the command

A

1/ Checks if a server uses recursion: nmap -sU -p 53 –script=dns-recursion <IP>
● -sU = UDP scans, DNS, SNMP, and DHCP are three of the most common UDP service
● -p 53 = port 53 for DNS</IP>

2/ Conducts a dynamic DNS update without authentication: nmap -sU -p 53 –script=dns-update –script-args=dns-update.hostname=<domain>,dns-update.ip=<IP> <target></target></IP></domain>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DNS Cache Poisoning: how to prevent from this attack (2)?

A

▪ Use DNSSEC: Uses digital signatures based on public-key cryptography to ensure DNS data is digitally signed by the owner. The zone owner and the resolvers need to configure their DNS servers to support DNSSEC
▪ Ensure servers have the latest security patches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

DNS Cache Poisoning: what is DNS Zone Transfer?

A

A method of replicating DNS database entries across a set of DNS servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

DNS Cache Poisoning: what is DNS Harvesting?

A

A form of Open-Source Intelligence used to gather information about a domain name and its associated resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

LLMNR/NBT-NS Poisoning: what is Link-Local Multicast Name Resolution (LLMNR)?

A

Based on the DNS packet formatting and allows both IPv4 and IPv6 hosts to perform name resolution on the host if they are on the same local link for Windows systems.
Instead of LLMNR, Linux systems rely on ZeroConf using the SystemD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

LLMNR/NBT-NS Poisoning: what is NetBIOS Name Service (NBNS or NBT-NS)?

A

▪ Part of the NetBIOS-over-TCP protocol suite that is used as a type of name resolution inside the internal network to translate internal names to IP addresses
▪ NBT-NS uses the host name of a system for its resolution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

LLMNR/NBT-NS Poisoning: what is the default protocol Windows will be use?

A

By default, Windows machines will first attempt to use LLMNR and then attempt to use NBT-NS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

LLMNR/NBT-NS Poisoning: what is the Responder?

A

A command-line tool in Kali Linux that is used to poison NetBIOS, LLMNR, and mDNS name resolution requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

LLMNR/NBT-NS Poisoning: how does the attack is perform (in terms of process)?

A

1/ LLMNR broadcast looking for \FileServer
2/ Responder: Right over here at 192.168.1.5 (Attacker’s IP)
3/ Connection attempt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

MAC Spoofing: what is spoofing?

A

A category of network attacks that occurs when an attacker masquerades as another person by falsifying their identity

23
Q

MAC Spoofing: what is a Media Access Control (MAC) Address?

A

▪ A means for identifying a device physically and allowing it to operate on a logical topology
▪ Layer 2 devices use MAC addresses to associate which device is connected to which physical port

24
Q

MAC Spoofing: what is MAC Filtering?

A

Any PC whose MAC address is on a whitelist is allowed access to the network ports, while those on blacklists are denied access or blocked. This entire process is called MAC filtering.

25
Q

MAC Spoofing: how to overcome the problem of being blacklisted ? Explain the commands (2)

A

▪ sudo ifconfig en0 ether <MAC>
▪ macchanger -m <MAC> <interface></interface></MAC></MAC>

26
Q

VLAN Hopping: what is a VLAN and how is it related to VLAN hopping?

A

▪ Used to partition any broadcast domain and isolate it from the rest of the network at the data link layer or layer 2 of the OSI model
▪ Once you gain access to a workstation located in one VLAN, you must break out of that VLAN to gain access to other sensitive areas of the network

27
Q

VLAN Hopping: what is VLAN Hopping?

A

A technique exploiting a misconfiguration to direct traffic to a different VLAN without proper authorization

28
Q

VLAN Hopping: what attack you can use to perform a VLAN Hopping (3)?

A

o Double Tagging
o Switch Spoofing
o MAC Table Overflow Attack

29
Q

VLAN Hopping: what is Double Tagging?

A

▪ Attacker tries to reach a different VLAN using the vulnerabilities in the trunk port (= specific port on a switch configured to transmit data traffic for multiple VLANs) configuration

30
Q

VLAN Hopping: how to do a Double Tagging?

A

Double tagging is used as part of a blind attack (= One where commands are sent to the victim, but the attacker doesn’t get to see any of the responses) or as part of a DoS or stress testing attack

31
Q

VLAN Hopping: how to prevent from Double Tagging (2)?

A

● Change default configuration of native VLAN
● Never add user devices into the native VLAN

32
Q

VLAN Hopping: what is Switch Spoofing?

A

Attacker attempts to conduct a Dynamic Trunking Protocol (DTP) negotiation

33
Q

VLAN Hopping: how to prevent from Switch Spoofing?

A

Always configure switch ports to have dynamic switch port modes disabled by default

34
Q

VLAN Hopping: what is MAC Table Overflow Attack?

A

Overloaded CAM tables result to switches “failing open” and beginning to act like a hub:
● Switch (Selectively transmits frames)
● Hub (Repeats every frame it receives)

35
Q

NAC Bypass: what is Network Access Control (NAC)?

A

A technology that is used to keep unauthorized users or devices from accessing a private network

36
Q

NAC Bypass: list and explain the different type of NAC solutions (3)?

A

▪ Persistent: A piece of software installed on a device requesting access to the network
▪ Non-persistent: Requires the users to connect to the network and log in to a web-based captive portal to download an agent that scans their devices for compliance
▪ Agentless NAC/Volatile Agent: Installs the scanning engine on the domain controller instead of the endpoint device

37
Q

NAC Bypass: how to bypass the NAC?

A

▪ Exploit an authorized host
▪ Make device look like something else: Most networks segment out VoIP devices and printers into their own separate VLANs

38
Q

On-Path Attack: what is it?

A

Occurs when an attacker puts themself between the victim and the intended destination

39
Q

On-Path Attack: what attacks can you perform to do a on-path attack (4)?

A

● ARP poisoning
● DNS poisoning
● Introducing a rogue WAP
● Introducing a rogue hub/switch

40
Q

On-Path Attack: what is a Replay attack?

A

Occurs when valid data is captured by the attacker and is then repeated immediately, or delayed, and then repeated

41
Q

On-Path Attack: what is a Relay attack?

A

Occurs when the attacker inserts themselves in between the two hosts

42
Q

On-Path Attack: if encryption is enforced on hosts, what can you do in that case and explain each of the attacks (2)?

A

o SSL Stripping: Occurs when an attacker tricks the encryption application into presenting the user with an HTTP connection instead of an HTTPS connection
o Downgrade Attack: Occurs when an attacker attempts to have a client or server abandon a higher security mode in favor of a lower security mode

43
Q

Password Attacks: what is a hash?

A

Hash digest is the result of a one-way hashing algorithm that protects the passwords stored in the database

44
Q

Password Attacks: what is a Password Cracker and provide tools that do that (2)?

A

Used to attempt to break a user’s password by using either a dictionary attack or by using brute force techniques
● John the Ripper
● Cain and Abel

45
Q

Password Attacks: list the password attack:

A

o Dictionary Attack
o Brute Force Attack
o Rainbow Table
o Password Spraying
o Credential Stuffing

46
Q

Password Attacks: what is a Dictionary Attack?

A

Uses a list of common passwords, words, and phrases to attempt to guess the password

47
Q

Password Attacks: what is a Brute Force Attack?

A

Attempts to break a password by guessing every single possible combination of numbers, letters, and special characters

48
Q

Password Attacks: what is a Rainbow Table?

A

A precomputed hash value table that contains known passwords used for offline password cracking

49
Q

Password Attacks: what is a Password Spraying?

A

Uses a dictionary of common passwords on multiple accounts to bypass authentication mechanisms

50
Q

Password Attacks: what is Credential Stuffing?

A

Tests stolen user account names and passwords against multiple websites

51
Q

Password Attacks: how to prevent from Credential Stuffing?

A

● Do not reuse any passwords across different websites
● Utilize two-factor authentication

52
Q

Password Attacks: how to prevent password attack (4)?

A

▪ Strong password security policies
▪ Complex passwords
▪ Password change at least every 60 days
▪ Failed login attempt lockouts or delays

53
Q

Pass the Hash:

A

Pentest+ (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions