Cram Flashcards
What standard was developed by business professionals as a best practice guide/methodology for conducting penetration testing?
Penetration Testing Execution Standard (PTES)
What organization aimed at increasing awareness and provides a framework for testing during each phase of the software development process?
Open Web Application Security Project (OWASP)
What guide provides different steps for the testing process and outlines the importance of assessing the entire organization, including the people, processes, and technology, during a penetration test?
OWASP Testing Guide (OTG)
What manuel was developed by the Institute for Security and Open Methodologies (ISECOM) and outlines every area of an organization that needs testing and how to conduct the relevant tests?
The Open Source Security Testing Methodology Manual (OSSTMM)
What framework is considered a open-source resource available to cybersecurity professionals and comprised of documents that relate to penetration testing, such as guidelines on business continuity and disaster recovery along with legal and regulatory compliance?
The Information Systems Security Assessment Framework (ISSAF)
What framework provides tools and techniques displayed as columns in a matrix that describe different tasks conducted by an attacker or penetration tester during an engagement?
The “MITRE ATT&CK” (Adversarial Tactics, Techniques & Common Knowledge) framework
What contract agreement is reached between two or more parties where each party agrees to most terms that will govern all other future transactions and agreements?
Master Services Agreement (MSA)
What agreement covers conditions such as: Payment terms, Product warranties, Intellectual property ownership, Dispute resolution, Allocation of risk, and Indemnification, corporate social responsibility, business ethics, network facility access?
Master Services Agreement (MSA)
What formal document, employed in the field of project management and provisional found in the MSA, explains the problem to be solved, work activities, project deliverables, and timeline for work completion?
Statement of Work (SOW)
What document addresses - Purpose, Scope of work, Location of work, Period of performance, Deliverables schedule, Applicable industry standards, Acceptance criteria, Special requirements, Payment schedule?
Statement of Work (SOW)
What document puts into writing guidelines and constrains regarding the execution of a pentest (what is and is not authorized)?
Rules of Engagement (RoE)
What document elaborates on these subjects: scope, location, applicable industry standards, and timelines?
Rules of Engagement (RoE)
What does a XML injection do?
Manipulate or compromise the logic of an XML application or service. The injection of unintended XML content and/or structures into an XML message can alter an application’s intended logic. XML Injection can cause the insertion of malicious content into resulting messages/documents.
What is the difference between Password spraying & Credential stuffing?
Credential stuffing is the automated injection of breached username/password pairs VS. Password spraying refers to the attack method that takes many usernames and loops them with a single password or multiple iterations using many different passwords.
What attack uses specially crafted URL that includes attack code that will cause information that users enter into their web browser to be sent to the attacker?
Cross-Site Scripting (XSS)
