Full Test Flashcards
(52 cards)
What does the sv mean in this. “nmap -sV 192.168.10.1 -p-“
Service Version of all open ports
Spear Phishing
Targeting a specific company
Pretexting
Fabricates a scenario or pretext to steal their victims’ personal information
Blackmail/ Intimidation
Utilising information/force to compel the victim
Baiting
Tricking or enticing the victim to reveal/do something
Tailgating/Piggybacking
Involves an unauthorized person following an authorized individual into a restricted area or system
Vishing
Using phone calls to scam the victim into divulging information
Smishing
Text messages to lure victims into clicking on a malicious link or providing personal information
Impersonation
Pretending to be a trusted contact or authority
Phases of social engineering
Investigation
Identifying the victim(s)
Gathering background information
Selecting attack method
Hook
Engaging the target
Spinning a story
Taking control of the interaction
Play
Expanding foothold
Executing the attack
Disrupting business or/and siphoning data
Exit
Removing all traces of malware
Covering tracks
Bringing the charade to a natural end
Information Gathering
Examples:
Date of birth, important dates, family date of births in 4/6 digit pin
Compiling a common wordlist from websites, social media
Using other active information gathering methods
Disadvantages of dictionary attacks
Uncertain
Detection /Blacklisting
Honeypot
Intelligent Guessing
Default passwords, etc
Deception Honey pots
Honeypots
- Honey Users
- Honey Tokens
- Honey Pots
- Honey Nets
Obfuscation
Switching port numbers, plugin names, directory names etc
Permission to Octal Conversion
Symbol | Binary | Octal |
| —— | —— | —– |
| --- | 000 | 0 |
| --x | 001 | 1 |
| -w- | 010 | 2 |
| -wx | 011 | 3 |
| r-- | 100 | 4 |
| r-x | 101 | 5 |
| rw- | 110 | 6 |
| rwx | 111 | 7 |
[File Type] [Owner] [Group] [Others]
- rwx r-x r–
———————————————————
The first character is the file type:
- = regular file
d = directory
l = symbolic link
The remaining 9 characters are permissions:
First 3 = Owner
Next 3 = Group
Last 3 = Others
r = read
w = write
x = execute
- = no permission
What is “salting” in password security?
Salting is the process of adding a random string (salt) to a password before hashing it, to make each hash unique — even if users have the same password.
This helps defend against rainbow table and precomputed hash attacks.
How do you identify a reverse shell connection using nc (Netcat)?
Look for these clues:
Listener side (-l -p) + -e /bin/bash or similar
→ This machine is hosting a shell to be accessed remotely.
Connecting side (nc [IP] [port])
→ This machine is connecting to the listener and will receive the shell.
If -e /bin/bash is used, the connecting machine gains interactive shell access to the listener.
💡 Rule of Thumb:
Machine with -e /bin/bash = loses control (victim)
Machine that connects = gains control (attacker)
Forward DNS lookup from a reverse DNS lookup?
Forward DNS Lookup:
🔎 Converts a domain name (e.g., example.com) → IP address (93.184.216.34)
✔️ Most common type of DNS query.
Reverse DNS Lookup:
🔁 Converts an IP address → domain name
🔍 Uses PTR (pointer) records in DNS.
🧠 Remember:
Forward = Name → IP
Reverse = IP → Name
Which tools can be used for offline cracking of password hashes?
🛠️ Common tools for offline hash cracking:
✅ John the Ripper – Fast and flexible password cracker.
✅ Hashcat – GPU-accelerated hash cracking tool.
✅ Hydra (for some offline modes) – Primarily online, but can be adapted.
✅ Cain & Abel (Windows-only, legacy tool)
📌 Offline cracking means:
You already have the password hashes (e.g., from /etc/shadow, SAM file).
You’re not interacting with a live login service.
Attacks like dictionary, brute force, or rule-based are used locally.
Common DNS Record Types
A = Address Record
AAAA = IPv6 Address Record
CNAME = Canonical Name Record
MX = Mail Exchange Record
PTR = Pointer Record
NS = Name Server Record
SOA = Start of Authority Record
TXT = Text Record
SRV = Service Record
SPF = Sender Policy Framework
CAA = Certification Authority Authorization
Record Type | Full Name | Purpose / Description |
What are valid defences to buffer overflow attacks?
Stack canaries (stack guards): Special values placed before the return address to detect corruption.
Address Space Layout Randomization (ASLR): Randomizes memory addresses to make exploitation harder.
Data Execution Prevention (DEP) / NX bit: Marks memory regions as non-executable to prevent code injection.
Bounds checking / Safe programming languages: Using languages or techniques that prevent buffer overflows.
Control Flow Integrity (CFI): Ensures program control flow follows valid paths only.
Network Scanning & Reconnaissance
Nmap – Network mapper, port scanner, OS fingerprinting
Masscan – Very fast port scanner
Netdiscover – Network address discovery
Angry IP Scanner – Simple network scanner
Packet Capture & Analysis tools
Wireshark – Network protocol analyzer (packet sniffer)
Tcpdump – Command-line packet analyzer
Exploitation Frameworks
Metasploit Framework – Exploit development and execution platform
BeEF – Browser Exploitation Framework
