Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CompTIA PenTest+ > 5.0 Tools > Flashcards

5.0 Tools Flashcards

(65 cards)

Start Studying
1
Q

FOCA

A

Fingerprinting Organizations with Collected Archives is a OSINT software that finds metadata and hidden information in documents from an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

theHarvester also dns

A

A OSINT is program for gathering subdomains, hosts, employee names, email addresses, PGP key entries, open ports, and service banners from servers * DNS recon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Shodan

A

Website search engine for devices that are considered part of the Internet of things

*Accessed through https://www.shodan.io OR CLI: ~ $shodan stats –facets port:100 country:US

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Maltego

A

A OSINT commercial software used to visually help connect relationships and automate the querying of data and compare it with other sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Recon-ng think cross platform/ framework

A

OSINT cross-platform web reconnaissance framework with a system of modules
*To run > # recon-ng

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Censys

A

A OSINT website search engine used for finding hosts and networks with data about their configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SET

A

Social Engineering Toolkit - collection of tools and scripts, to conduct social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

BeEF think posture

A

Browser Exploitation Framework - used to assess the security posture of a target environment using cross-site attack vectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Nikto

A

A web vulnerability scanner used to assess custom web applications 
*perl nikto.pl -h <IP></IP>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

OpenVAS 


A

An Open-Source Vulnerability Scanner - with the ability to assign a risk rating for targeted assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Nessus 


A

Used to conduct basic, advanced and compliance vulnerability scans (such as PCI DSS audit) to measure the effectiveness of the system’s security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SQLmap

A

open-source web application database scanner that searches for SQL injection vulnerabilities

*syntax # sqlmap -u “http://<ip>/cat.php?<pram></pram></ip>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Open SCAP

A

Security Content Automation Protocol - creates a predetermined security baseline (by NIST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Wapiti


A

A web application vulnerability scanner that searches for areas where it can inject data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

WPScan

A

WordPress site vulnerability scanner identifies plugins used by the website against a database of known vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Brakeman think rubies

A

Static code analysis security tool, used to identify vulnerabilities in applications written in Ruby on Rails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ScoutSuite think how ?

A

Used to audit instances and policies created on multi-cloud platforms by collecting data using API calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

OWASP ZAP

A

Zed Attack Proxy - free open-source application scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Tcpdump

A

CLI protocol analysis tool that conducts packet sniffing and decoding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Hping

A

Open-source packet crafting tool used to exploit vulnerable firewalls and IDS/IPS * TCP,UDP,ICMP,RAW-IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Aircrack-ng

A

Open-source wireless exploitation tool kit. Consist of:

*Airomon-NG (monitor wireless frequencies to identify access points and clients) *Airodump-NG - (capture network traffic and save it to a PCAP file) *Aireplay-NG (deauthentication attack by sending spoofed deauth requests to the access point) *Airocrack-NG (conduct protocol and password cracking of wireless encryption)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Kismet

A

An open-source tool that contains a wireless sniffer, a network detector, and IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Wifite 


A

Wireless auditing tool that conducts a site survey to locate rogue and hidden access points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

EAPHammer

A

A Python-based toolkit that can steal EAP authentication credentials used in a WPA2-Enterprise network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
mdk4
Wireless vulnerability exploitation toolkit that can conduct 10 different types of 802.11 exploitation techniques
26
Spooftooph 

Automates the spoofing or cloning of a Bluetooth device’s name, class, and address
27
Reaver
A tool that conducts a brute-force attack against Wi-Fi Protected Setup (WPS) PIN
28
WiGLE
Wireless Geographic Logging Engine - tool that maps and index known wireless AP (consists of a website and database)
29
Fern think recovery
Tests wireless networks by conducting password recovery (through brute force , dictionary attacks, as well as session hijacking, replay, and on-path attacks)
30
Hashcat

Modern password and hash cracking tool that supports parallel processing (GPU)
31
Medusa
A parallel brute-force tool. Used against network logins to attack services that support remote authentication
32
Hydra 

A parallel brute-force tool that attempts passwords from a dictionary that meets the minimum password requirements (supports pw-inspect module)
33
CeWL 

Automatically crawls a website to collect words and metadata to generate word lists
34
John the Ripper 

A password cracking tool that supports large sets of hashes and dictionary and brute-force attacks
35
Cain
Cain and Abel
, a legacy password cracking and hash dumping
36
Mimikatz 

A tool that gathers credentials by extracting key elements from the memory *use case: Pass-the-hash, Pass-the-ticket, Golden ticket
37
Patator

A multi-purpose brute-force tool (methods: ftp, ssh, smb, vnc, and zip password cracking)
38
DirBuster

A brute-force tool to identify unlisted directories and file names that may be accessed on a web application or server
39
W3af
Web Application Attack and Audit Framework - used to identify and exploit vulnerabilities
40
Burp Suite

Used for raw traffic interception and modification. Use case: automated testing, manual request modification, and passive web application analysis
41
Gobuster

Used to identify unlisted resources in a web application
42
CloudBrute
Used to find a target’s infrastructure, files, and apps across the top cloud service providers
43
Pacu 

Exploitation framework used to assess the security configuration of an AWS account
44
CloudCustodian 

Open-source cloud security, governance, and management tool to help admins create policies based on resource types
45
Snow
CLI steganography tool that conceals a payload within the whitespace of an ASCII formatted text file
46
Coagula 

An image synthesizer tool - used to create a sound file (.wav) from image
47
Sonic Visualiser

Open-source application for viewing and analyzing the contents of music audio files
48
TinEye

A website that can be used to conduct reverse image searches using image recognition
49
Metagoofil
Python-based tool that can search for metadata from public documents located on a target’s website
50
Online SSL Checkers

Web application used to test the validity, strength, and security of an SSL or TLS digital certificate
51
OllyDbg

Linux debugger used to analyze binary code found in 32-bit Windows applications
52
Immunity Debugger

Uses Python scripts and APIs to write exploits, analyze malware, and reverse engineer binary files (*Debugger built for penetration testers ).
53
GDB
GNU Debugger is a open-source, cross-platform debugger
54
WinDbg

Free debugging tool that is distributed by Microsoft for use in the Windows operating system
55
IDA
Interactive Disassembler is a commercial disassembler and cross-platform debugging tool (generates assembly language source code from machine-executable code)
56
Covenant

An open-source .NET framework focused on penetration testing that also has a development and debugging component
57
SearchSploit

A tool used to find exploits available in the Exploit-DB *install: https://www.exploit-db.com/searchsploit *CLI: # searchsploit such as # searchsploit vsftp
58
PowerSploit

A collection of PowerShell modules that create an exploitation framework
59
Responder

A Kali Linux CLI tool used to poison NetBIOS, LLMNR, and MDNS name resolution requests
60
Impacket Tools
An open-source collection of python classes for working with network protocols and the exploitation of Windows systems * Remote Execution, Kerberos, Windows Secrets, MiTM Attacks, WMI, SMB/MSRPC
61
Empire 

A C2 framework for common post-exploitation tasks can uses PowerShell or Python depending on the system * common use: lateral movement, escalate privileges, capture data, extract passwords, install persistent backdoors
62
Metasploit 

A multi-purpose (computer security /penetration testing) framework that uses modularized attacks to exploit systems
63
mitm6
An IPv6 DNS hijacking tool - sets the malicious actor as the DNS server by replying to DHCPv6 messages and redirecting the victim to another malicious host
64
CrackMapExec
A post-exploitation tool to identify vulnerabilities in Active Directory environments
65
TruffleHog
A Git search tool that crawls through a repository looking for accidental commits

CompTIA PenTest+ (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions