Chapter 7: Remote Targeting II

What types of networks should be reviewed for useful information during remote targeting?

What file type is NOT typically logged by Kismet and airodump for further review?

What indicates a strong potential ownership of a client device during a probe?

What information is contained in the PCAP files other than basic details?

When identifying a target network, what should be looked up for the BSSID?

What is an ideal location for initiating stealth physical recon operations?

Which method is NOT mentioned as a means of conducting stealth recon?

What should you do first before changing the MAC address in a Linux terminal?

Which of the following is NOT a major vulnerability to be exploited in active wireless attacks?

When wardriving, what is essential to maintain during operations?

What is a possible consequence of changing the last digit of your MAC address to avoid detection?

Which device is NOT mentioned as suitable for mailing to conduct recon?

What command is used for spoofing a disassociation message in a wireless network?

Which protocol can include the device hostname in its request?

What is a primary reason for enumerating wireless client information?

What does stealth physical recon emphasize during a wireless reconnaissance?

What might indicate the organization responsible for a client device?

Which type of data can DNS automatically query for?

What concept is beneficial when conducting stealth physical recon?

What information can be revealed by the NetBIOS broadcast?

WEP networks are used for Wired Equivalent Privacy.

Kismet and airodump can only log to PCAP files.

The OUI of a MAC address consists of the last six hexadecimal digits.

Captured packets can provide helpful information about observed packets.

The aireplay-ng command is used for logging packet information.

Public areas like coffee shops are suitable locations for stealth recon operations.

Wardriving can only be performed using a car.

Cracking WEP is one of the identified major vulnerabilities for compromising a target network.

Changing the MAC address during active recon can hinder forensic investigations.

An extra battery is not a recommended component to include in a mailed device for recon.

It is unnecessary to change your MAC address when conducting reconnaissance.

Active brute-forcing is a technique used to exploit wireless network vulnerabilities.

The command used to spoof a disassociation message includes the parameter –deauth=5.

Client device information can only be enumerated when the wireless network is positively identified as belonging to a target organization.

During wireless recon, it's possible to capture packets that help to indicate ownership of a client device.

The DHCP protocol is unlikely to include any device hostname information.

Stealth physical recon emphasizes maintaining a low profile during wireless reconnaissance operations.

The concept of KISS in stealth physical recon stands for 'Keep It Simple and Secure.'

NetBIOS broadcasts can reveal the domain name of a client device.

Social engineering concepts are not applicable during stealth physical reconnaissance.

What basic information is contained in the PCAP files logged by Kismet and airodump?

Which of the following is indicated by the presence of a network probe for YURICH_HOME in relation to employee Tom Yurich?

What does the OUI of a MAC address signify?

What additional activity might be necessary when identifying cloaked networks?

Which types of data can both Kismet and airodump log apart from PCAP files?

What is a key consideration when conducting stealth recon in public areas?

Which method can be used to ensure anonymity during a wireless attack?

What is a common vulnerability found in wireless networks that can be exploited?

What device might be mailed to a target organization to aid in remote reconnaissance?

What is a potential consequence of changing your MAC address to a digit different from the target MAC address?

In preparing for an active wireless attack, what is essential before changing the MAC address?

What is an appropriate strategy for conducting wardriving effectively?

What effect does spoofing a disassociation message have on the client device?

Which of the following statements about client device enumeration is true?

Which protocol can potentially reveal the hostname of a device during enumeration?

What is a key consideration to maintain during stealth physical recon?

Which of the following is a correct statement regarding the use of NetBIOS broadcasts?

What aspect of the KISS strategy is critical for stealth physical recon?

Why is it beneficial to capture packets during wireless network recon?

What is a potential outcome of incorrectly executing a command to spoof a disassociation message?

Both Kismet and airodump can log data in XML format by default.

The OUI of a MAC address consists of the last six hexadecimal digits uniquely assigned to every manufacturer.

Captured packets can only reveal basic information about a wireless network.

Probing clients can indicate which clients might belong to the target organization.

It is beneficial to perform a detailed analysis of client devices in addition to reviewing PCAP files.

The aireplay-ng command can be used to mimic a legitimate disassociation message.

When enumerating wireless client information, protocols like DNS and HTTP can provide identity details.

Stealth physical recon requires the operator to maintain a high presence in the environment.

The DHCP protocol is known to commonly include device hostname information in its requests.

Social engineering concepts are irrelevant to the practice of stealth physical recon.

The NetBIOS protocol can reveal the hostname of a client device via broadcast.

Captured packets during wireless recon are only useful after identifying the target organization.

The practice of KISS in stealth recon focuses on keeping operations straightforward and undetectable.

Aerial drones are commonly used by government agencies for surveillance.

Changing the MAC address of a device is unnecessary when conducting wireless reconnaissance.

Wardriving can be performed using any type of transportation.

Cracking WEP is one of the vulnerabilities that can be exploited in an active wireless attack.

Mailing a device to a target organization is not a recommended method for reconnaissance.

The command 'ifconfig wlan0 down hw either 22;44:66:11:22:23' is used to change the MAC address in Linux.

Maintaining anonymity and stealth is essential during stealth recon operations.

The aireplay-ng command is utilized to force the association process by spoofing a disassociation message.

Kismet and airodump are capable of logging only to binary file formats.

The first six hexadecimal digits of a MAC address represent the OUI assigned to the device manufacturer.

Probed networks do not provide any useful information about the owners of client devices.

Captured packets include timestamps related to specific clients or networks being observed.

Using an aerial drone for surveillance is commonly adopted by various government agencies.

Wardriving is exclusively performed while using a car.

MAC address spoofing can confuse forensic investigations into wireless activities.

Active brute-forcing targets the encryption method used in Wi-Fi Protected Setup.

The only method to maintain anonymity while attacking a wireless network is by changing the MAC address.

Cracking WEP is mentioned as one of the significant vulnerabilities in wireless networks.

Public and common areas are ideal locations for setting up stealth recon operations because of the high traffic and anonymity they provide.

The aireplay-ng command used for spoofing disassociation messages uses the parameter –deauth=10.

Captured packets during wireless recon can sometimes reveal the device operating system type.

Stealth physical recon requires strict adherence to a complex set of strategies.

NetBIOS broadcasts are unlikely to provide useful information about a client device's hostname.

Utilizing DHCP requests can help identify the hardware manufacturer of a client device.

All wireless networks positively identified as belonging to a target organization are guaranteed to be vulnerable.

Acting congruently with your story is not relevant in social engineering for stealth recon.

Kismet and airodump are capable of logging multiple types of information beyond just packet data.

What specific information about clients can be inferred from probe requests during remote targeting?

In the context of wireless reconnaissance, what does the term OUI refer to?

What is an important purpose of logging to XML files via Kismet and airodump?

Why might some client devices not probe for other networks while connected?

What can the aireplay-ng command specifically achieve in wireless reconnaissance?

What is a primary component of maintaining anonymity while performing active wireless reconnaissance?

Which of the following is a method for performing reconnaissance without physically being present?

What should be considered when selecting a public location for stealth recon operations?

Which technique is specifically designed for conducting attacks on wireless networks?

What is the consequence of leaving your laptop running in a secluded location during recon?

In the context of wireless attacks, what does changing the last digit of a MAC address accomplish?

Which of these vulnerabilities is notably targeted during wireless network attacks?

What are the potential implications of spoofing a disassociation message from a client's perspective?

Why is it vital to enumerate wireless client information before proceeding with an attack?

Which protocol can provide crucial information about the domain name of a client device being probed?

What is a core strategy emphasized in stealth physical recon operations?

Which of the following statements regarding DHCP packets is true during wireless reconnaissance?

What is one reason to capture packets during wireless network reconnaissance?

What principle does the APT strategy 'KISS' stand for during stealth physical reconnaissance?

In the context of wireless client attacks, what does enumerating client information primarily assist with?