Chapter 7: Remote Targeting II
120 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What types of networks should be reviewed for useful information during remote targeting?

  • VPN, SSL, WPA-Enterprise
  • WEP, WPA-PSK, WPA-Enterprise (correct)
  • WPA-PSK, WPA3, Open networks
  • WEP, WPA2, VPN

    • What file type is NOT typically logged by Kismet and airodump for further review?

  • PCAP
  • Log files
  • CSV (correct)
  • XML

    • What indicates a strong potential ownership of a client device during a probe?

  • The device last seen within the last hour
  • BSSID of the device's network
  • Total number of packets seen from the device
  • Probing for an SSID matching part of the user's name (correct)

    • What information is contained in the PCAP files other than basic details?

    <p>Times clients were first and last seen</p> Signup and view all the answers

    When identifying a target network, what should be looked up for the BSSID?

    <p>The MAC address vendor</p> Signup and view all the answers

    What is an ideal location for initiating stealth physical recon operations?

    <p>A public library</p> Signup and view all the answers

    Which method is NOT mentioned as a means of conducting stealth recon?

    <p>Physical break-in</p> Signup and view all the answers

    What should you do first before changing the MAC address in a Linux terminal?

    <p>Bring your interface down</p> Signup and view all the answers

    Which of the following is NOT a major vulnerability to be exploited in active wireless attacks?

    <p>Cracking WPA2</p> Signup and view all the answers

    When wardriving, what is essential to maintain during operations?

    <p>Anonymity and stealth</p> Signup and view all the answers

    What is a possible consequence of changing the last digit of your MAC address to avoid detection?

    <p>It may frustrate forensic investigations.</p> Signup and view all the answers

    Which device is NOT mentioned as suitable for mailing to conduct recon?

    <p>A standard telephone</p> Signup and view all the answers

    What command is used for spoofing a disassociation message in a wireless network?

    <p>aireplay-ng –deauth=5 –a -c mon0</p> Signup and view all the answers

    Which protocol can include the device hostname in its request?

    <p>DHCP</p> Signup and view all the answers

    What is a primary reason for enumerating wireless client information?

    <p>To identify networks without known associations</p> Signup and view all the answers

    What does stealth physical recon emphasize during a wireless reconnaissance?

    <p>Maintain a low profile and avoid detection</p> Signup and view all the answers

    What might indicate the organization responsible for a client device?

    <p>Captured packets during recon</p> Signup and view all the answers

    Which type of data can DNS automatically query for?

    <p>Client information</p> Signup and view all the answers

    What concept is beneficial when conducting stealth physical recon?

    <p>KISS strategy</p> Signup and view all the answers

    What information can be revealed by the NetBIOS broadcast?

    <p>Domain name and hostname of the client</p> Signup and view all the answers

    WEP networks are used for Wired Equivalent Privacy.

    <p>True</p> Signup and view all the answers

    Kismet and airodump can only log to PCAP files.

    <p>False</p> Signup and view all the answers

    The OUI of a MAC address consists of the last six hexadecimal digits.

    <p>False</p> Signup and view all the answers

    Captured packets can provide helpful information about observed packets.

    <p>True</p> Signup and view all the answers

    The aireplay-ng command is used for logging packet information.

    <p>False</p> Signup and view all the answers

    Public areas like coffee shops are suitable locations for stealth recon operations.

    <p>True</p> Signup and view all the answers

    Wardriving can only be performed using a car.

    <p>False</p> Signup and view all the answers

    Cracking WEP is one of the identified major vulnerabilities for compromising a target network.

    <p>True</p> Signup and view all the answers

    Changing the MAC address during active recon can hinder forensic investigations.

    <p>True</p> Signup and view all the answers

    An extra battery is not a recommended component to include in a mailed device for recon.

    <p>False</p> Signup and view all the answers

    It is unnecessary to change your MAC address when conducting reconnaissance.

    <p>False</p> Signup and view all the answers

    Active brute-forcing is a technique used to exploit wireless network vulnerabilities.

    <p>True</p> Signup and view all the answers

    The command used to spoof a disassociation message includes the parameter –deauth=5.

    <p>True</p> Signup and view all the answers

    Client device information can only be enumerated when the wireless network is positively identified as belonging to a target organization.

    <p>False</p> Signup and view all the answers

    During wireless recon, it's possible to capture packets that help to indicate ownership of a client device.

    <p>True</p> Signup and view all the answers

    The DHCP protocol is unlikely to include any device hostname information.

    <p>False</p> Signup and view all the answers

    Stealth physical recon emphasizes maintaining a low profile during wireless reconnaissance operations.

    <p>True</p> Signup and view all the answers

    The concept of KISS in stealth physical recon stands for 'Keep It Simple and Secure.'

    <p>False</p> Signup and view all the answers

    NetBIOS broadcasts can reveal the domain name of a client device.

    <p>True</p> Signup and view all the answers

    Social engineering concepts are not applicable during stealth physical reconnaissance.

    <p>False</p> Signup and view all the answers

    What basic information is contained in the PCAP files logged by Kismet and airodump?

    <p>BSSID and associated clients</p> Signup and view all the answers

    Which of the following is indicated by the presence of a network probe for YURICH_HOME in relation to employee Tom Yurich?

    <p>Tom Yurich owns a device that connects to YURICH_HOME</p> Signup and view all the answers

    What does the OUI of a MAC address signify?

    <p>Organizationally Unique Identifier assigned to manufacturers</p> Signup and view all the answers

    What additional activity might be necessary when identifying cloaked networks?

    <p>Forcing the association process through spoofing</p> Signup and view all the answers

    Which types of data can both Kismet and airodump log apart from PCAP files?

    <p>XML files by default</p> Signup and view all the answers

    What is a key consideration when conducting stealth recon in public areas?

    <p>Remaining stationary for long periods</p> Signup and view all the answers

    Which method can be used to ensure anonymity during a wireless attack?

    <p>Changing the MAC address of devices</p> Signup and view all the answers

    What is a common vulnerability found in wireless networks that can be exploited?

    <p>Weak WPA preshared keys</p> Signup and view all the answers

    What device might be mailed to a target organization to aid in remote reconnaissance?

    <p>A smartphone or tablet</p> Signup and view all the answers

    What is a potential consequence of changing your MAC address to a digit different from the target MAC address?

    <p>Hinders forensic investigations</p> Signup and view all the answers

    In preparing for an active wireless attack, what is essential before changing the MAC address?

    <p>Bringing the network interface down</p> Signup and view all the answers

    What is an appropriate strategy for conducting wardriving effectively?

    <p>Using any mode of transportation</p> Signup and view all the answers

    What effect does spoofing a disassociation message have on the client device?

    <p>The client device experiences a temporary loss of connection.</p> Signup and view all the answers

    Which of the following statements about client device enumeration is true?

    <p>Enumerating clients can help identify vulnerable networks.</p> Signup and view all the answers

    Which protocol can potentially reveal the hostname of a device during enumeration?

    <p>DHCP</p> Signup and view all the answers

    What is a key consideration to maintain during stealth physical recon?

    <p>Blending in and acting congruently with your story.</p> Signup and view all the answers

    Which of the following is a correct statement regarding the use of NetBIOS broadcasts?

    <p>NetBIOS broadcasts can provide the domain name and hostname of a client.</p> Signup and view all the answers

    What aspect of the KISS strategy is critical for stealth physical recon?

    <p>Minimize actions to avoid drawing attention.</p> Signup and view all the answers

    Why is it beneficial to capture packets during wireless network recon?

    <p>It can indicate device ownership and type.</p> Signup and view all the answers

    What is a potential outcome of incorrectly executing a command to spoof a disassociation message?

    <p>Loss of visibility to the wireless network.</p> Signup and view all the answers

    Both Kismet and airodump can log data in XML format by default.

    <p>True</p> Signup and view all the answers

    The OUI of a MAC address consists of the last six hexadecimal digits uniquely assigned to every manufacturer.

    <p>False</p> Signup and view all the answers

    Captured packets can only reveal basic information about a wireless network.

    <p>False</p> Signup and view all the answers

    Probing clients can indicate which clients might belong to the target organization.

    <p>True</p> Signup and view all the answers

    It is beneficial to perform a detailed analysis of client devices in addition to reviewing PCAP files.

    <p>True</p> Signup and view all the answers

    The aireplay-ng command can be used to mimic a legitimate disassociation message.

    <p>True</p> Signup and view all the answers

    When enumerating wireless client information, protocols like DNS and HTTP can provide identity details.

    <p>True</p> Signup and view all the answers

    Stealth physical recon requires the operator to maintain a high presence in the environment.

    <p>False</p> Signup and view all the answers

    The DHCP protocol is known to commonly include device hostname information in its requests.

    <p>True</p> Signup and view all the answers

    Social engineering concepts are irrelevant to the practice of stealth physical recon.

    <p>False</p> Signup and view all the answers

    The NetBIOS protocol can reveal the hostname of a client device via broadcast.

    <p>True</p> Signup and view all the answers

    Captured packets during wireless recon are only useful after identifying the target organization.

    <p>False</p> Signup and view all the answers

    The practice of KISS in stealth recon focuses on keeping operations straightforward and undetectable.

    <p>True</p> Signup and view all the answers

    Aerial drones are commonly used by government agencies for surveillance.

    <p>True</p> Signup and view all the answers

    Changing the MAC address of a device is unnecessary when conducting wireless reconnaissance.

    <p>False</p> Signup and view all the answers

    Wardriving can be performed using any type of transportation.

    <p>True</p> Signup and view all the answers

    Cracking WEP is one of the vulnerabilities that can be exploited in an active wireless attack.

    <p>True</p> Signup and view all the answers

    Mailing a device to a target organization is not a recommended method for reconnaissance.

    <p>False</p> Signup and view all the answers

    The command 'ifconfig wlan0 down hw either 22;44:66:11:22:23' is used to change the MAC address in Linux.

    <p>False</p> Signup and view all the answers

    Maintaining anonymity and stealth is essential during stealth recon operations.

    <p>True</p> Signup and view all the answers

    The aireplay-ng command is utilized to force the association process by spoofing a disassociation message.

    <p>True</p> Signup and view all the answers

    Kismet and airodump are capable of logging only to binary file formats.

    <p>False</p> Signup and view all the answers

    The first six hexadecimal digits of a MAC address represent the OUI assigned to the device manufacturer.

    <p>True</p> Signup and view all the answers

    Probed networks do not provide any useful information about the owners of client devices.

    <p>False</p> Signup and view all the answers

    Captured packets include timestamps related to specific clients or networks being observed.

    <p>True</p> Signup and view all the answers

    Using an aerial drone for surveillance is commonly adopted by various government agencies.

    <p>True</p> Signup and view all the answers

    Wardriving is exclusively performed while using a car.

    <p>False</p> Signup and view all the answers

    MAC address spoofing can confuse forensic investigations into wireless activities.

    <p>True</p> Signup and view all the answers

    Active brute-forcing targets the encryption method used in Wi-Fi Protected Setup.

    <p>True</p> Signup and view all the answers

    The only method to maintain anonymity while attacking a wireless network is by changing the MAC address.

    <p>False</p> Signup and view all the answers

    Cracking WEP is mentioned as one of the significant vulnerabilities in wireless networks.

    <p>True</p> Signup and view all the answers

    Public and common areas are ideal locations for setting up stealth recon operations because of the high traffic and anonymity they provide.

    <p>True</p> Signup and view all the answers

    The aireplay-ng command used for spoofing disassociation messages uses the parameter –deauth=10.

    <p>False</p> Signup and view all the answers

    Captured packets during wireless recon can sometimes reveal the device operating system type.

    <p>True</p> Signup and view all the answers

    Stealth physical recon requires strict adherence to a complex set of strategies.

    <p>False</p> Signup and view all the answers

    NetBIOS broadcasts are unlikely to provide useful information about a client device's hostname.

    <p>False</p> Signup and view all the answers

    Utilizing DHCP requests can help identify the hardware manufacturer of a client device.

    <p>True</p> Signup and view all the answers

    All wireless networks positively identified as belonging to a target organization are guaranteed to be vulnerable.

    <p>False</p> Signup and view all the answers

    Acting congruently with your story is not relevant in social engineering for stealth recon.

    <p>False</p> Signup and view all the answers

    Kismet and airodump are capable of logging multiple types of information beyond just packet data.

    <p>True</p> Signup and view all the answers

    What specific information about clients can be inferred from probe requests during remote targeting?

    <p>Potential ownership of client devices based on specific probing patterns</p> Signup and view all the answers

    In the context of wireless reconnaissance, what does the term OUI refer to?

    <p>Organizationally Unique Identifier, the first six digits of a MAC address</p> Signup and view all the answers

    What is an important purpose of logging to XML files via Kismet and airodump?

    <p>To retain a detailed history of network monitoring for later audits</p> Signup and view all the answers

    Why might some client devices not probe for other networks while connected?

    <p>They have been programmed to maintain secure connections on their current network only</p> Signup and view all the answers

    What can the aireplay-ng command specifically achieve in wireless reconnaissance?

    <p>Spoof disassociation messages to force clients to reconnect</p> Signup and view all the answers

    What is a primary component of maintaining anonymity while performing active wireless reconnaissance?

    <p>Changing the MAC address of your devices</p> Signup and view all the answers

    Which of the following is a method for performing reconnaissance without physically being present?

    <p>Mailing a modified device to the target</p> Signup and view all the answers

    What should be considered when selecting a public location for stealth recon operations?

    <p>Low foot traffic and visibility to others</p> Signup and view all the answers

    Which technique is specifically designed for conducting attacks on wireless networks?

    <p>Using a deauthentication attack</p> Signup and view all the answers

    What is the consequence of leaving your laptop running in a secluded location during recon?

    <p>Risk of being observed by passersby</p> Signup and view all the answers

    In the context of wireless attacks, what does changing the last digit of a MAC address accomplish?

    <p>Confuses forensic investigations</p> Signup and view all the answers

    Which of these vulnerabilities is notably targeted during wireless network attacks?

    <p>Exploiting weak encryption protocols</p> Signup and view all the answers

    What are the potential implications of spoofing a disassociation message from a client's perspective?

    <p>The connection will appear to drop and return without any user notice.</p> Signup and view all the answers

    Why is it vital to enumerate wireless client information before proceeding with an attack?

    <p>To verify the availability of attack vectors on identified networks.</p> Signup and view all the answers

    Which protocol can provide crucial information about the domain name of a client device being probed?

    <p>NetBIOS</p> Signup and view all the answers

    What is a core strategy emphasized in stealth physical recon operations?

    <p>Acting congruently with your cover story.</p> Signup and view all the answers

    Which of the following statements regarding DHCP packets is true during wireless reconnaissance?

    <p>They could include the device hostname in the request.</p> Signup and view all the answers

    What is one reason to capture packets during wireless network reconnaissance?

    <p>To establish the type and ownership of client devices.</p> Signup and view all the answers

    What principle does the APT strategy 'KISS' stand for during stealth physical reconnaissance?

    <p>Keep It Simple and Secure.</p> Signup and view all the answers

    In the context of wireless client attacks, what does enumerating client information primarily assist with?

    <p>Identifying vulnerabilities in a target organization.</p> Signup and view all the answers

    Study Notes

    Chapter 7: Phase III: Remote Targeting, Part Two

    • This chapter details remote targeting in Phase III.
    • Active Wireless Recon II involves reviewing data for useful information after initial setup.

    Active wireless Recon II

    • Review collected data for interesting and useful information.
    • Focus on:
      • WEP (Wired Equivalent Privacy) networks
      • WPA-PSK (WPA Pre-Shared Key Mode) networks
      • WPA-Enterprise (WPA Enterprise Mode) networks
      • Captured packets
      • Associated clients

    Active Wireless Recon II (cont.)

    • Kismet and airodump can log PCAP files for analysis using Wireshark.
    • Review client device information beyond PCAP files.
    • Basic information from PCAP files includes:
      • BSSID (Basic Service Set Identifier)
      • Client devices
      • Associated clients
      • Probing clients
      • Channels

    Active Wireless Recon II (cont.)

    • Other collected data includes:
      • Times specific clients or networks were first and last seen
      • Total number of packets from each device
      • Information about observed packets
      • Wireless networks probed by client devices

    Active Wireless Recon II (cont.)

    • Probed networks may indicate client device ownership.
    • Examples include:
      • Identifying an employee to correlate a probe for a known network.
      • Discovering networks with SSID related to the target organization.
      • Identifying networks with recognizable patterns.

    Active Wireless Recon II (cont.)

    • Organization Unique Identifier (OUI) of a MAC address is the first six hexadecimal digits.

    • OUIs are assigned to network equipment manufacturers.

    • Identify cloaked networks to enumerate SSIDs.

    • Force association by spoofing a disassociation message using the aireplay-ng command.

    Enumerate Client Info

    • After initial wireless reconnaissance, shift focus to enumerating wireless client information, assessing vulnerabilities.
    • Determine networks not positively associated with any particular company.
    • Confirm if all identified networks belong to the target organization and are not vulnerable to direct exploitation.

    Enumerate Client Info (cont.)

    • Key protocols:
      • DHCP (Dynamic Host Configuration Protocol).
      • NetBIOS.
      • HTTP (Hypertext Transfer Protocol).
      • DNS (Domain Name System).

    Stealth Physical Recon

    • This phase shifts reconnaissance to physical locations.

    • Maintaining stealth and anonymity is paramount.

    • Good locations include:

      • Public areas like coffee shops, libraries, or hotels.
      • Buildings with areas for laptops.

    • Avoid obvious tactics for physical infiltration.

    • Consider social engineering concepts and acting congruently with your story.

    • Utilizing tools like drones or sending devices to the target organization are also options.

    Active Wireless Attacks

    • Identify potential vulnerabilities in target networks for exploitation.
    • Examples include:
      • Cracking WEP
      • Off-line brute-forcing WPA preshared keys
      • Active brute-forcing of WiFi protected setup
      • Wireless vendor vulnerabilities

    Active Wireless Attacks (cont.)

    • Changing MAC addresses from Linux terminal is needed for active attacks.
    • Commands to accomplish this include:
      • ifconfig wlan0 down
      • ifconfig wlan0 down hw either 22;44:66:11:22:23
      • ifconfig wlan0 up

    Active Wireless Attacks (cont.)

    • Do not use the same card for active recon or attack if it uniquely belongs to the network.

    Web Cracking

    • WEP cracking relies on collecting a certain amount of packets (2,000-200,000) to deduce the key.

    • Fastest cracking using an active method takes about 15 minutes using ~20,000 packets.

    • Use airodump for packet capture.

    • Use aireplay-ng command for faster capture.

    Web Cracking (cont.)

    • Put interface into monitor mode using airmon-ng command.

    • Use airodump-ng to configure and specify desired parameters

    • Use airodump-ng to capture packets for target network.

    • Capture and analyze packet data using airodump-ng.

    • Use airock-ng to crack the WEP key.

    WPA Preshared Key Cracking

    • Offline brute-force is the only effective method for WPA-PSK (Wired Equivalent Privacy).
    • Capturing the four-way authentication handshake is necessary.
    • Many modern devices use strong, randomly generated WPA preshared keys.
    • Using airmon-ng and aircrack-ng in a similar way to WEP cracking.
    • Capture the necessary data and then use aircrack-ng with wordlist.
    • Disconnecting a client for analysis of spoofed disassociation messages

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Chapter 7 Part 2: Active Wireless Recon

    Description

    Explore the intricacies of remote targeting in Phase III as discussed in Chapter 7. This chapter emphasizes the analysis of collected data from various network types including WEP and WPA, and highlights tools like Kismet and Wireshark for data review. Understand the significance of client information and logging for effective wireless reconnaissance.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser