CH-6 Techniques Used by Hackers

Question 1

Forms of Cell phone attacks?

Answer 1

■Blue Snarfing: access of information from a Bluetooth device

■Blue Jacking: Uses another Bluetooth device to send unsolicited messages to the target

■Blue Bugging: Similar to Blue Snarfing, Blue Bugging accesses and uses all phone features

■Pod Slurping: Using a device such as an iPod to access private data on a computer the iPod is plugged into

Question 2

How does CrossSite Scripting (website link w/t script) work?

Answer 2

1. email w/t script link
2. user clicks link, that loads legit website and executes script
3. script sends private data to attacker

Question 3

How does the Download Substitution work?

Answer 3

■ Attacker creates a page with seemingly innocuous and desirable programs for download

■Instead of, or in addition to, the intended functionality, the user installs malware

■This is a very common technique for spyware

■Free Video editor Resist the temptation!

Question 4

How does the OphCrack Password Cracking Tool work?

Answer 4

1. Download OphCrack , then load it on a USB stick or burn it to CD
2. Insert into a Windows computer and boot to OphCrack rather than the computer’s OS
3. It boots as Linux, grabs the Windows password file, and then uses cracking tools to extract passwords
4. Usernames and passwords are exported to a text file

Question 5

Scan Type Syn and Fin. Describe them.

Answer 5

■Syn
–Sends syn (synchronize) requests to the target
–Does not complete the TCP handshake process
–When an open port identified, TCP handshake is reset
–Now recognized by IDSs due to Syn requests being common for DoS attacks

■Fin
–Sends a FIN (or finish) packet to target
–If that port is not listening, no response
–If it is listening an error response is received

Question 6

Scan Type: Ping and Connect. Describe it.

Answer 6

■Ping
–Sends a single ICMP echo request to a target
–Target responds with an ICMP echo reply
–No response if IP address unused or if ICMP is filtered

■Connect
–Fully connect to the target IP address and port
–Does a complete TCP handshake
–Can be performed using Nmap

Question 7

What are some Passive Scanning Resources?

Answer 7

■Google
■LinkedIn
■Job listings
■Netcraft.com
■Archive.org

Question 8

What is a Penetration Test?

Answer 8

A simulated cyberattack on a computer system to evaluate its security.

Question 9

What is Active Scanning?

Answer 9

Sends traffic into the network to query systems and services

Checks running services for known vulnerabilities

Can be detected by security systems or from disrupting services

Question 10

What is Blue Team?

Answer 10

The defenders during a penetration.

Question 11

What is Clickjacking?

Answer 11

Manipulating a website user’s activity by concealing hyperlinks beneath legitimate clickable content, thereby causing the user to perform actions of which they are unaware.

Question 12

What is Enumeration?

Answer 12

■“Enumeration” is the act of making a list of things, one after another

■Powerful system and network scanning tools

■Uses active scanning to get as much information as possible

■Identify systems on a network

■Identifies services available on a host, including file shares, etc.

Examples include:
–Cain and Abel
–Sid2User
–Cheops (Linux only)
–UserInfo
–UserDump
–DumpSec
–Netcat
–NBTDump

Question 13

What is Nmap?

Answer 13

■CLI (Command-line Interface) tool that scans a private network and identifies all IP addresses that are in use

■Scans specific IP addresses to analyze connected devices

■Provides information about device operating systems and open ports

Question 14

What is OpenVAS?

Answer 14

OpenVAS is the scanner component of Greenbone Vulnerability Manager, a software framework of several services and tools offering vulnerability scanning and vulnerability management.

All Greenbone Vulnerability Manager products are free software, and most components are licensed under the GNU General Public License.

Question 15

What is Passive Scanning?

Answer 15

Manual research conducted about an organization and its systems.

Can include silent analyses of network traffic to identify systems and patterns.

Does not interact or interfere with systems so it generally cannot be detected

Question 16

What is Phishing?

Answer 16

A message that tries to trick a victim into providing private information or taking some other unsafe action

Question 17

What is Reconnaissance?

Answer 17

Preliminary survey or research.

Question 18

What is SQL Injection?

Answer 18

■ One of the most common attacks

■Requires some knowledge of SQL

■Attacker enters SQL commands insteadof innocuous data into an application

■If the application was not well designed, it could execute the command

Question 19

What Is SQL?

Answer 19

■SQL stands for Structured Query Language and is used by Relational Database Management Systems

■Relational databases tables identified each by a name

■You can think of SQL tables as Excel spreadsheets where columns are data types and rows are data/records

■SQL uses commands such as SELECT, UPDATE, DELETE, INSERT.

■Example: SELECT * FROM tblUsers WHERE USERNAME = ‘admin’

Question 20

What is the Red Team?

Answer 20

The attackers during a penetration

Question 21

What is Vulnerability Assessment?

Answer 21

Identifying, quantifying, and prioritizing the vulnerabilities (weaknesses) in a system.

Question 22

What is Vulnerability Scan?

Answer 22

Automated tool used for assessing computers, networks or applications for known weaknesses

Question 23

Windows Attacks. Describe.

Answer 23

■Pass the Hash
–Hacker first obtains encrypted username and password hash
–Sends the hash to the login system; no need to decrypt

■Net User Script
–Logs in to system using Guest account
–Creates script in All Users startup to create new admin account
–Next time an admin logs on, the script will execute

■Login as System
–Boot the target system to a USB or DVD based operating system
–Edit boot partition’s magnifier utility with command prompt app