Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CEH > Post Class Review > Flashcards

Post Class Review Flashcards

(218 cards)

Start Studying
1
Q

What are the countermeasures against MAC Flood and MAC Spoofing attacks?

A 
Port Security
Binding
IP Source Guard
DAI (Dynamic Arp Inspection)
ARP Watch
ARP Wall
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Describe DHCP Starvation attack

A

Exhausting the pool of IP addresses on a DHCP server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

DHCP Starvation attack countermeasure

A

Port Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Describe Rogue DHCP Attack

A

Unauthorized DHCP server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Rogue DHCP Attack countermeasure

A

DHCP snooping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How do you evade IDS Signature Detection

A 
Encryption
IP Fragmentation (IP Fragment Scanning)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How do you evade IDS Anomaly Detection?

A

Session splicing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Nmap setting for session splicing

A

Timing template / timing channel
T0-slowest
T5-fastest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Application proxies provide privacy (security through obscurity) and:

A

content filtering (data+commands)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How to defend against Spoofing, ARP poisoining?

A

ARPWALL
ARPWatch
Private VLANS
Using Static ARP entries for servers&routers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Full Open Scan

A

–>

–>

nmap -sT

TCP Connect scan completes the 3 way handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Half open scan

A

–>

nmap -sS

Stealth scan, syn scan

Scan spoof IP, bypass firewall rules (anti spoof)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

XMas scan

A

nmap -sX

FIN, URG, PSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Shared traits of XMAS, Null, FIN scans

A

No response = port open
RST = port closed
always RST = Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

nmap switch:

TCP Connect/Full Open Scan

A

nmap -sT

Completes 3 way handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

nmap switch:

Stealth Scan/Half Open Scan/Syn scan

A

nmap -sS

Can spoof IP, bypasses firewall rules (anti spoof)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

nmap switch:

XMas scan

A

nmap -sX

FIN, URG, PSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

nmap switch:

FIN scan

A

-sF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

nmap switch:

Null scan

A

no flags -sN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

nmap switch:

Idle scan

A

nmap -sI

You need a zombie to determine if port is open/closed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Idle scan

A

IPID + 2 = port open
IPID + 1 = port closed
zombie must be idle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Nmap switch:

OS

A

nmap -O

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Nmap switch:

output

A

nmap -o

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Nmap syntax:

Network scan of the entire subnet 192.168.10.0

A

nmap -sn 192.168.10.0/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Nmap syntax: | Network scan of all hosts from 192.168.10.200 to 192.168.10.250
nmap -sn 192.168.10.200-250
26
Nmap switch: | network scan
nmap -sn
27
ICMP Message Type | Request
8
28
ICMP Message Type | Response
0
29
ICMP Message Type | Unreachable
3
30
ICMP Message Type | TTP Expired
11
31
ICMP Message Type 3 Code 1
Host
32
ICMP Message Type 3 Code 0
Network
33
ICMP Message Type 3 Code 2
Protocol
34
ICMP Message Type 3 Code 3
Port
35
ICMP Message Type 3 Code 13
Admin Prohibited
36
MultiFactor Authentication | K- Know
Passwords, PINS
37
MultiFactor Authentication | A - Are
Biometric
38
MultiFactor Authentication | H - Have
Token, Card
39
A token is which combination of multi factors?
Know + Have
40
Best combination of multi factor authentication?
Know + Have + Are (Token + Biometric)
41
Polymorphic (XOR'd) Shellcode
Signature changes, XOR is encrypted
42
Metamorphic Virus
Both algorithm and signature changes
43
Describe Vulnerability scanning
Identify weaknesses
44
Limitations on vulnerability scanning
Can only discover known vulnerabilities
45
Auditing vs Vulnerability Scanning vs Pen Testing
Auditing- testing for compliance Vulnerability scanning- Passive Pen testing - active
46
SQL Injection: | '
' tests if database is susceptible to SQLi
47
SQL injection: | --
-- is end of line/single line commands
48
SQL Injection: | +, ||
+, || are concatenation operators
49
SQL Injection: | UNION
UNION joins multiple queries
50
SQL Injection: | UPDATE
Update table or database
51
SQL injection: | DROPTABLE
Deletes table
52
SQL injection: | Xp_cmdshell
Invokes command shell
53
SQL injection: | OPENROWSET
Makes an offline copy of the database contents
54
Typical SQL injection syntax
blah' or 1=1--
55
1=1 is what
tautology, an assertion of truth
56
Outcome of SQL injection in a login context
Logs in as first user in table
57
Outcome of SQL injection in a database search context
Dumps all records in a table
58
Spoofing vs Session Hijacking
Spoofing - all responses go to spoofed address | Hijacking - attacker takes over an active session
59
Steganography
Manipulating least significant bits within image files to hide information
60
Sparse infector virus
Time trigger activated virus (Friday 13th)
61
Stealth virus
Places itself between kernel & user programs to intercept system calls/IO operations
62
Macro virus
targets MSOffice applications
63
Trojans
Require a host file | Cannot self replicate or self propagate
64
Virus
Require a host file CAN self replicate CANNOT self propagate
65
Worm
NOT require a host file CAN self replicate CAN self propagate
66
Phishing
Sending to a broad audience
67
Spear phishing
targeting individuals
68
Whaling
targeting upper hierarchy/C-Levels
69
How does "tracert" work and what is its purpose
Uses ICMP & manipulates the TTL to discover hops
70
Describe Firewalking
Fingerprinting a firewall
71
Firewalking | Traceroute
Discover IPs of routers & firewalls
72
Firewalking | ACK scan
Determine if firewall is stateful or non-stateful No response -> Stateful RST -> not stateful
73
Firewalking | IKE scan
Determine if the firewall is using IPSEC
74
Firewalking Techniques
1. Traceroute 2. ACK scan 3. IKE scan 4. Scan vor vendor specific parts 5. Banner grabbing
75
Session Fixation attack
taking advantage of fixed session IDs (link in password reset email)
76
Ways to browse the internet anonymously
Proxy VPN Anonymizer HTTP tunneling
77
Switch sniffing techniques
1. SPAN port/ Port Spanning 2. MAC flood 3. ARP poisoning 4. DNS poisoning 5. Rogue DHCP server 6. Manipulating proxy server setting
78
What is the default RID for a Windows Administrator account
500
79
Bits for MD4
128
80
Bits for MD5
128
81
Bits for SHA-1
160
82
Bits for SHA2
256+
83
What is Syskey used for
Encrypt SAM file
84
Type of encryption used for Syskey
128 bit RC4 encryption
85
Port: | FTP
20,21
86
Port: | TFTP
69
87
Port: | Syslog
514
88
Port: | RDP
3389
89
Port: | LDAP
389
90
Port: | LDAPS
636
91
Port: | SSH
22
92
Port: | SSL
443
93
Port: | SMB over NetBIOS
139
94
Port: | SMB over TCP/IP
445
95
Port: | Kerberos
88
96
Port: | DNS Zone Transfer
TCP 53
97
Port: | DNS lookup
UDP 53
98
Port: | Network Printing
515, 631, 9100
99
Port: | SMTP
25
100
Port: | SNMP
161, 162
101
Port: | NTP
123
102
Port: | IKE
500
103
Port: | DHCP
67, 68
104
Port: | POP3
110
105
Port: | IMAP
143
106
What does the following command do: type trojan.exe > c:\windows\system32\ping.exe:trojan.exe
Places malicious file within the ADS/Alternate Data Stream of a good file NTFS data stream. Type and Copy are interchangeable
107
What does the following command do: copy trojan.exe > c:\windows\system32\ping.exe:trojan.exe
Places malicious file within the ADS/Alternate Data Stream of a good file NTFS data stream. Type and copy are interchangeable
108
Simple SQL Injection
attacker sees responses
109
Blind SQL injection
attacker does not see responses, uses YES or NO responses with WAITFORDELAY command
110
Attack that uses YES or NO responses with WAITFORDELAY command
Blind SQL injection
111
Difference between sniffing on a Hub network vs a Switch network
Hub - passive | Switch - active
112
What is the Snow tool
used for Whitespace Steganography
113
What type of encryption does Snow use
Ice
114
6 techniques of Anti-spoofing
1. Packets from outside have inside/private IP as source IP 2. Packets from inside have outside IP as source IP 3. Packets from a new network send test packets 4. TTL mismatch 5. IPID mismatch 6. Exceeding window size
115
Wireshark filter syntax: | ip.addr==10.10.1.1
All packets going to and from 10.10.1.1
116
Wireshark filter syntax: | ip.src==10.10.1.1
All packets coming from 10.10.1.1
117
Wireshark filter syntax: | ip.dest==10.10.1.1 && tcp.dstport=80
All packets going to 10.10.1.1 destination port 80 && = OR
118
Wireshark filter syntax: | tcp.flagsreset==1
All packets with a Reset flag set
119
Wireshark filter syntax: | tcp contains wireshark
Search http text "wireshark"
120
Substituting non-alphanumeric characters with alphanumeric to prevent XSS attack is called: _____ < < > &gt
HTML entities
121
Example of HTML entities
< < | > gt
122
How does IPS/IDS work?
IDS - passive IPS - active Uses signature & anomaly detection
123
Name of server used to provide Blackberry services
BES - Blackberry Enterprise Services
124
Two types of Input validation
Data boundary, length, size | Data type
125
Risk of data boundary input validation
Buffer overflow
126
Risk of data type input validation
Injection
127
What is Overwriting the EIP (Extended Instruction Pointer)?
Buffer overflow attack
128
Buffer overflow attack
- Overwriting the EIP/Extended Instruction Pointer | - Overwriting return pointer/ instruction pointer/ return address/ return register
129
What detects attempted buffer overflow attacks?
Canary word
130
What does robots.txt do?
Prevents Google, Yahoo, & Bing from accessing certain pages on the webserver
131
Uses for Cain & Abel
1. ARP Poisoning 2. Sniffing 3. Password cracking 4. WiFi encryption cracking (aircrack-ng, korecs algorith)
132
What tools use the korecs algorithm?
Cain & Abel | Aircrack-ng
133
Hybrid password attacks include
Brute force + dictionary
134
Key length of | Diffie Hellman
1536 bits
135
Key length of: | RSA
Variable, minimum 2048
136
Key length of: | DES
Total: 64 Actual: 56
137
Key length of: | 3DES
Actual: 168 Effective: 112
138
Key length of: | AES
Minimum- 128, 192, 256
139
AES encryption:
Protocop: CCMP Algorithm: Rijndael Minimum key length: 128, 192, 256
140
Tools that - Verify Integrity - of system and data files?
Tripwire | FCIV (microsoft tool)
141
Tools that - Verify Authenticity - of program files?
Sigverif (microsoft) | Bit9
142
Command switch: | Manipulates TTL Value
-i
143
Command switch: | Specifies # of ping packets in Windows
-n
144
Command switch: | Specifies # of ping packets in Linux
-c
145
Hardware disk encryption
TPM, HSM Full disk encryption MBR encrypted
146
Software disk encryption
MBR not encrypted Partial disk encryption EFS-microsoft
147
Attacker sends ping/icmp packets to a broadcast address with spoofed src IP as victim's IP
SMURF
148
Attack that's the same as a SMURF attack but uses UDP
Fraggle
149
Attack which takes advantage of TCP 3-way handshake, sends SYN packets to victim with the source & dest IPs pointing to the victim IP
Land attack
150
Attack which takes advantage of TCP 3-way handshake, attacker sends SYN packets to victim with src IP spoofed to be a nonexistent/random IP, results in a large number of half open connections.
SYN flood, half open scan
151
Windows 32, Linux 64 | Attacker sends oversized ping packetse to victim
P.O.D. Ping of death
152
Trinoo, TFN2k, LOIC, HOIC
DDoS tools
153
Embedding malicious scripts within webpages, emails, etc
XSS cross site scripting
154
Similar to XSS, however attacker targets an already authenticated/trusted session and forces the victim to do something they never intended to do
CSRF/XSRF cross site request forgery
155
If the second half of an LM hash contains a hash value of - AAD3B435B51404EE, it indicates that_______
The password length is less than 7 characters.
156
If the following value is on both sides of an LM hash: - AAD3B435B51404EE, ______
It means LM hash is not being stored
157
Factorization of 2 large prime numbers describes which agorithm?
RSA encryption
158
Symmetric encryption provides which of the following Cryptographic objectives: Confidentiality Integrity Authentication (HMAC) Non-Repudiation
Confidentiality Integrity Authentication (HMAC only)
159
Asymmetric encryption provides which of the following Cryptographic objectives: Confidentiality Integrity Authentication Non-Repudiation
All 4
160
Digital Signature provides which of the following Cryptographic objectives: Confidentiality Integrity Authentication Non-Repudiation
Integrity Authentication Non-repudiation
161
Integrity Authentication Non-repudiation
Digital Signature
162
Confidentiality Integrity Authentication Non-Repudiation
Asymmetric encryption
163
Confidentiality Integrity Authentication (HMAC only)
Symmetric encryption
164
With a digital signature, the hash is encrypted with ____
sender's private key
165
A digital signature hash being encrypted with a senders' private key results in ____
Authenticity
166
For Authentication, the hash/message is encrypted with _____
sender's private key
167
Symmetric encryption is most suited for ____ because of speed
Bulk data
168
Disadvantages of symmetric encryption?
1. No non-repudiation 2. Key management (not scalable) 3. Key distribution (relies on out of band OOB key distribution)
169
WIFI encryption: | 48 bit IV and 128 bit AES encryption
WPA2
170
WIFI encryption: | 48 bit IV and 128 bit TKIP-RC4 encryption
WPA
171
Why is WEP considered to be an inherently weak wi-fi encryption standard?
IV is too short (24 bits) | Lacks randomization resulting in frequency patterns
172
Hashing algorithm: | LMHash
DES
173
Hashing algorithm: | NTLMv1
MD4
174
Hashing algorithm: | NTLMv2
MD5
175
What happens to a switch when the CAM table is flooded?
It breaks down into a hub
176
What is the broadcast address for 180.160.172.0/22?
180.160.175.255
177
How do you secure SNMP
1. Use SNMP v3 | 2. Change default passwords/"community string"
178
2 Methods of banner grabbing using telnet?
1. GET /HTTP/1.0 | 2. HEAD /HTTP/1.0
179
Is it possible to block all reconnaissance traffic completely? (ping, tracert, DNS, etc)
No
180
``` 1+1 = 0 1+0 = 1 0+1 = 1 0+0 = 0 ```
Truth table for XOR
181
Computer security incident response team
CSIRT
182
Provides guidance & solutions on how to secure and test systems
OSSTMM
183
Provides information on common web application flaws and solutions, OWASP top 10, injection, webgoat
OWASP
184
SOX
Sarbanes Oxley - Regulation to enforce financial accountability
185
PCI-DSS
Standard to protect PII
186
Types of rootkits
1. Application 2. Hypervisor 3. Bootloader 4. DLL 5. Kernel 6. BIOS
187
Key escrow
private key is split into 2 or more parts and each part is given to different CA's for safekeeping
188
Recovery agent
designated account used to recover from lost or stolen keys (similar to a master key)
189
N-Tier architecture: | Infrastructure
The servers are logically grouped by function within individual VLAN segments
190
N-Tier architecture: | Application architecture
Applications are designed in a modular fashion where changes to one module does not impact other modules
191
What do these tools have in common? ``` Brutus John the Ripper Cain & Abel Kerbcrack Hydra ```
password crackers
192
Limiting the # of MACs on a switch port
Port security
193
Network access control, Network access protection
NAC/NAP Sets & enforces baselines/policies on devices connected to the network
194
NAC/NAP
Network access control/protection Sets & enforces baselines/policies on devices connected to the network
195
EAP/802.1x
``` RADIUS Kerberos Active directory PKI Secure token ```
196
How to disable LMHashes
1. Modify registry 2. Use GPOs 3. Make passwords greater than 14 characters with a minimum of 15 characters
197
Name trust models
Web of Trust Hierarchical Bridge
198
Trust models: | Web of trust
PGP, GPG
199
Trust models: | HIerarchical
PKI
200
Trust models: | Bridge
Trust between 2 different PKI hierarchies
201
Take advantage of the lack of input validation within cgi scripts to gain shell access
Shellshock
202
An openSSL vulnerability which gave attackers access to private keys in RAM
Heartbleed
203
2 different pieces of text produce the same hash value
Collision
204
Hashing algorithms are collision-resistant. True or false?
True
205
Risk management: SLE
Single loss expectancy Asset value x Exposure factor
206
Risk management: Risk
Threat x vulnerability x asset/impact
207
Risk management: ALE
Annual loss expectancy Asset value x exposure x annualized rate of occurrence (ARO)
208
Risk management: ARO
Annualized rate of occurrence
209
Google search: insite:www.cisco.com filetype.pdf
Locating .pdf files on www.cisco.com
210
HTTPMETHODS
Nmap script that tests which methods are allowed on an HTTP server: GET, PUT, POST, TRACE, etc...
211
Tool equivalent to Netcat that can be used to have an encrypted netcatlike session?
Cryptcat
212
Provides multilayer inspection, stateful inspection, maintains state table, enforces 3-way handshake
Stateful inspection firewall
213
Does deep packet inspection to prevent web application attacks
Web application firewall
214
Repository of revoked public keys
CRL, certificate revocation list
215
Online Certificate Status Protocol, used to check CRL in real time
OSCP
216
Linux tool used to change Windows passwords
CHNTPN
217
Used to gather metadata of public documents
Metagoofil
218
Radius 2.0, enhanced version of RADIUS, uses TCP for reliability & provides mobility options
DIAMETER

CEH (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions