Cyber Security and Kill Chain Overview
45 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Phishing emails and text messages never claim there's a problem with your account or payment information.

False (B)

Which of these is NOT a method used when scanning a network?

  • Password cracking (correct)
  • Checking for listening ports
  • Checking for live systems
  • Grab banners

    • A TCP connect scan attempts to complete a ______ with the target.

    three-way handshake

    What does the acronym NMAP stand for?

    <p>Network Mapper</p> Signup and view all the answers

    Match the network scanning techniques with their respective descriptions:

    <p>TCP Connect Scan = Attempts to complete a three-way handshake with the target. XMAS Scan = Uses a packet with FIN, PSH, and URG flags set to 1. FIN Scan = Sends a TCP segment with the FIN flag set.</p> Signup and view all the answers

    Which tool is a commercial vulnerability scanner?

    <p>Tenable Nessus (B)</p> Signup and view all the answers

    What does HPing do?

    <p>It extends ping to support TCP, UDP, ICMP, and Raw IP, enabling advanced network testing and diagnostics.</p> Signup and view all the answers

    Scanning network is the use of a computer system to systematically probe a target network to gather information about systems.

    <p>True (A)</p> Signup and view all the answers

    Which of these protocols are known to transmit usernames and passwords in plain text?

    <p>Telnet, POP, IMAP, SMTP, NNTP, FTP, HTTP (D)</p> Signup and view all the answers

    LDAP enumeration involves identifying and exploiting vulnerabilities in Lightweight Directory Access Protocol.

    <p>True (A)</p> Signup and view all the answers

    What is the primary purpose of the SNMP protocol?

    <p>SNMP (Simple Network Management Protocol) is used for monitoring and managing network devices. It allows administrators to collect data about network devices and their performance, configure settings, and troubleshoot issues.</p> Signup and view all the answers

    The process of capturing and analyzing network traffic is called ______.

    <p>sniffing</p> Signup and view all the answers

    Match the enumeration countermeasures with their corresponding protocol:

    <p>Silently ignore unknown recipients = Email Disable Zone Transfer = DNS Use SNMPv3 with authentication = SNMP Authenticate queries to only domain users = LDAP</p> Signup and view all the answers

    DHCP starvation attacks involve flooding the network with DHCP requests, preventing legitimate devices from obtaining IP addresses.

    <p>True (A)</p> Signup and view all the answers

    Which of the following tools is typically used for managing Active Directory domains?

    <p>AD Domain Services mgmt pack (A)</p> Signup and view all the answers

    What are two security measures that can be implemented to mitigate the risk of SNMP vulnerabilities?

    <p>Two security measures include using SNMPv3 with authentication and changing the default community name. SNMPv3 provides strong authentication and encryption, while using a unique community name prevents unauthorized access.</p> Signup and view all the answers

    To scan for hosts in the network using Ettercap, you should go to Host >> ______.

    <p>scan for Host</p> Signup and view all the answers

    When installing Ettercap, it's recommended to select all available plugins for optimal functionality.

    <p>True (A)</p> Signup and view all the answers

    Which of the following tools can be used for ARP poisoning attacks?

    <p>Ettercap (B)</p> Signup and view all the answers

    Which of the following steps is NOT required to perform ARP poisoning in Ettercap?

    <p>Click &quot;Log all packets and infos&quot; under &quot;Logging&quot;. (E)</p> Signup and view all the answers

    ARP poisoning attacks only affect the victim's device and not the network.

    <p>False (B)</p> Signup and view all the answers

    What is the purpose of using the "Host >> save to file" option in Ettercap?

    <p>To save the list of scanned hosts to a file for later use.</p> Signup and view all the answers

    Match the following Ettercap menu options with their corresponding functions:

    <p>Sniff &gt;&gt; Unified Sniffing = Captures all network traffic on the selected interface. Host &gt;&gt; Host List = Displays a list of scanned hosts on the network. MitM &gt;&gt; ARP Poisoning = Performs ARP poisoning on selected targets. Logging &gt;&gt; Log all packets and infos = Enables detailed logging of all network traffic and information.</p> Signup and view all the answers

    What is the primary function of ARP?

    <p>Address Resolution Protocol (ARP) maps Layer 2 MAC addresses to Layer 3 IP addresses.</p> Signup and view all the answers

    To start capturing network traffic between two machines, which of the following steps should be performed in Ettercap?

    <p>Click &quot;Target&quot; &gt;&gt; &quot;Current target&quot;. (A), Click &quot;Start&quot; &gt;&gt; &quot;Start sniffing&quot;. (E), Click &quot;MitM&quot; &gt;&gt; &quot;ARP Poisoning&quot;. (F)</p> Signup and view all the answers

    A poisoned ARP cache can lead to _______ of data.

    <p>sniffing</p> Signup and view all the answers

    Match the following countermeasures with the corresponding security attack:

    <p>Subnet based monitoring of MAC address changes = ARP poisoning Dynamic ARP inspection = Spoofing DHCP snooping = DNS poisoning IP source guard = ARP poisoning</p> Signup and view all the answers

    Performing ARP poisoning allows you to intercept network traffic between two machines, including potentially sensitive information.

    <p>True (A)</p> Signup and view all the answers

    Why is it important to add two IP addresses to Target 1 and Target 2 when attempting to capture username and password information?

    <p>To perform a Man-in-the-Middle attack, intercepting communication between two specific targets.</p> Signup and view all the answers

    Which of the following is NOT a recommended security measure for a wireless network?

    <p>Use WEP encryption (A)</p> Signup and view all the answers

    To change the default username and password for a router or access point, you should access the router's ______ interface.

    <p>administration</p> Signup and view all the answers

    Disabling SSID broadcasts will make your wireless network completely invisible to other devices.

    <p>False (B)</p> Signup and view all the answers

    What is the purpose of a firewall and an intrusion detection system (IDS) on a network?

    <p>A firewall acts as a barrier to block unauthorized access to your network, while an IDS detects malicious activity and alerts you to potential security threats.</p> Signup and view all the answers

    Match the following tools with their primary functions:

    <p>Httrack = Cloning websites Havij = Automatic SQL injection tool Acunetix = Web vulnerability scanner</p> Signup and view all the answers

    Which of the following steps is NOT involved in using Havij to access a database?

    <p>Check the desired table and click 'Get DBs' (B)</p> Signup and view all the answers

    When using Httrack to clone a website, you can save the cloned website to a local folder on your computer, typically in a directory called ______.

    <p>My Web Sites</p> Signup and view all the answers

    It is recommended to use identifying information like your name or address in your wireless network SSID.

    <p>False (B)</p> Signup and view all the answers

    Which of the following tools can be used to capture and analyze network traffic for security purposes?

    <p>All of the above (D)</p> Signup and view all the answers

    A malicious browser extension can potentially capture data from form fields, inject Javascript, exfiltrate data, and hijack authenticated sessions.

    <p>True (A)</p> Signup and view all the answers

    The MITRE ATT&CK framework helps security professionals understand and analyze the phases of an attack, which includes: Reconnaissance, [BLANK], Lateral Movement, C2 and Exfiltration.

    <p>Initial Access</p> Signup and view all the answers

    What is the primary function of Wireshark in cybersecurity?

    <p>Network analysis and troubleshooting</p> Signup and view all the answers

    Match the following security countermeasures with their corresponding categories:

    <p>Think before you click = Session Hijacking Counter Measures Disable insecure HTTP = Web Server Security Patch webservers for vulnerabilities = Web Server Security Use logout functions = Session Hijacking Counter Measures Probe systems, pen testing = Web Server Security Clear browser history, cache and cookies = Session Hijacking Counter Measures</p> Signup and view all the answers

    Which of the following are indicators of compromise (IoCs) that can be observed in network traffic?

    <p>All of the above (E)</p> Signup and view all the answers

    Session IDs, if not using TLS, are always encrypted and secure.

    <p>False (B)</p> Signup and view all the answers

    What is the primary purpose of using TLS (Transport Layer Security) in web server security?

    <p>To encrypt communication between client and server</p> Signup and view all the answers

    Flashcards

    Installing Ettercap

    Choose all plugins during installation and proceed with directory selection.

    Unified Sniffing

    A method in Ettercap to capture network traffic on a selected interface.

    Host List

    A feature in Ettercap to view hosts discovered on the network.

    Scanning for Hosts

    The process of searching for devices on the network in Ettercap.

    Signup and view all the flashcards

    Saving Host List

    The action of storing discovered hosts into a file for later reference.

    Signup and view all the flashcards

    ARP Poisoning

    A technique used to intercept network traffic between devices by manipulating ARP cache.

    Signup and view all the flashcards

    Logging Packets

    The practice of recording traffic data during sniffing sessions in Ettercap.

    Signup and view all the flashcards

    Man-in-the-Middle (MitM) Attack

    An interception strategy where an attacker can monitor or alter communication between two parties.

    Signup and view all the flashcards

    Machine in the Middle Attack

    An attack where the intruder intercepts communication between two parties.

    Signup and view all the flashcards

    Port-Security

    A Cisco feature that limits the number of MAC addresses on a port.

    Signup and view all the flashcards

    DNS Poisoning

    An attack that corrupts DNS cache, redirecting traffic to malicious sites.

    Signup and view all the flashcards

    Dynamic ARP Inspection (DAI)

    A Cisco feature that validates ARP packets to prevent spoofing.

    Signup and view all the flashcards

    DHCP Snooping

    A security feature that protects against rogue DHCP servers.

    Signup and view all the flashcards

    Sniffing Tools

    Software used to capture and analyze network traffic.

    Signup and view all the flashcards

    ARP Cache

    A table that maps IP addresses to MAC addresses within a network.

    Signup and view all the flashcards

    SNMP Scanner

    A tool used to discover and monitor devices on a network via SNMP.

    Signup and view all the flashcards

    LDAP

    Lightweight Access Protocol for directory services, operates over TCP/IP.

    Signup and view all the flashcards

    LDAPs

    Secure version of LDAP that uses encryption over TCP/638.

    Signup and view all the flashcards

    Sniffing

    The process of capturing and analyzing network traffic.

    Signup and view all the flashcards

    DHCP

    Dynamic Host Configuration Protocol that assigns IP addresses to devices.

    Signup and view all the flashcards

    DHCP Starvation

    An attack that exhausts available IP addresses by spoofing requests.

    Signup and view all the flashcards

    Plain Text Protocols

    Protocols where usernames and passwords are transmitted unencrypted.

    Signup and view all the flashcards

    Encryption

    The process of converting information into a secure format to prevent unauthorized access.

    Signup and view all the flashcards

    SSID Change

    Change the default SSID for your router or access point.

    Signup and view all the flashcards

    Router Security

    Change the default username and password for your router/AP.

    Signup and view all the flashcards

    SSID Broadcasts

    Disabling SSID broadcasts hides your network from casual observers.

    Signup and view all the flashcards

    MAC Address Filtering

    Allows only specified devices to connect to your network.

    Signup and view all the flashcards

    WPA3/WPA2 Security

    Use WPA3 or WPA2 for secure Wi-Fi; avoid WEP due to poor security.

    Signup and view all the flashcards

    Havij Tool

    An automatic SQL injection tool for retrieving data from databases.

    Signup and view all the flashcards

    HTTrack

    A tool to clone websites for offline browsing.

    Signup and view all the flashcards

    Firewall and IDS

    Use firewalls and Intrusion Detection Systems to protect your network.

    Signup and view all the flashcards

    Malicious Javascript

    JavaScript that has harmful effects on users or systems.

    Signup and view all the flashcards

    Session Hijacking

    Unauthorized access or control over a user's session.

    Signup and view all the flashcards

    Machine in the Middle (MitM)

    An attack where an attacker intercepts communications between two parties.

    Signup and view all the flashcards

    Countermeasures for Session Hijacking

    Strategies to prevent unauthorized access to a session.

    Signup and view all the flashcards

    Wireshark

    A tool used for monitoring and analyzing network traffic.

    Signup and view all the flashcards

    Indicators of Compromise (IoCs)

    Piece of evidence that suggests a breach or network compromise.

    Signup and view all the flashcards

    TLS (Transport Layer Security)

    A protocol that ensures privacy and data integrity between applications.

    Signup and view all the flashcards

    Attack Patterns

    Commonly observed actions taken by attackers during a cyber incident.

    Signup and view all the flashcards

    Phishing

    Fraudulent attempts to obtain sensitive information via fake messages.

    Signup and view all the flashcards

    Scanning Network

    Systematic probing of a target network to gather information about systems.

    Signup and view all the flashcards

    Vulnerability Scanning

    Process of identifying weaknesses in a system through tools.

    Signup and view all the flashcards

    Metasploit

    A framework used for penetration testing and vulnerability assessment.

    Signup and view all the flashcards

    TCP Connect Scan

    A scan that tries to complete a TCP handshake to identify open ports.

    Signup and view all the flashcards

    Xmas Scan

    A scan using TCP flags that can identify open ports based on responses.

    Signup and view all the flashcards

    FIN Scan

    A scan sending TCP packets with FIN flags to identify listening services.

    Signup and view all the flashcards

    Study Notes

    Cyber Security

    • Cyber security is the application of technologies, processes, and controls to protect systems, networks, programs, devices, and data from cyber attacks. Its goal is to reduce unauthorized exploitation.
    • Cyber security practices defend computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. Key aspects include confidentiality, integrity, and availability (CIA). A common attack is denial-of-service (DoS).
    • Data Forensics Incidence Response (DFIR) is vital in cyber security. This involves a Security Operations Center (SOC) where analysts monitor various systems for incidents.

    Cyber Kill Chain

    • Understanding the cyber kill chain is crucial, developed by Lockheed Martin.
    • Attack.mitre.org provides a framework, helping understand Tactics, Techniques, and Procedures (TTPs) used in attacks.
    • Discovery and account discovery are sub-techniques often used by attackers.
    • Helpful for understanding attack patterns.

    Helpful Websites

    • pentest-standard.org
    • owasp.org/index.php/OWASP_Testing_project
    • nvlpubs.nist.gov/nistpubs/legacy/SP/nistspecialpublicationsw-115.pdf
    • isecom.org/research

    Intelligence Gathering

    • Reconnaissance utilizes passive/active methods and public, available data.
    • Create attack maps possibly from a network diagram based on gathered info.
    • Vulnerability analysis uses tools and methods, to find vulnerabilities.

    Footprinting

    • The initial step in tracking, known as reconnaissance.
    • Attack.mitre.org is a useful resource for techniques.
    • Active/passive reconnaissance techniques are described.

    Email Footprinting

    • Tools and techniques for email analysis in penetration testing and intelligence gathering.
    • Email addresses are identified based on a domain.

    Whois and DNS Footprinting

    • Used to gather information about an organization.
    • Techniques for using Linux terminal tools like whois and nslookup.

    Network Footprinting

    • Finding information about networks using tools like host and nmap.

    Network Scanning Methodologies

    • Explores different network scanning methods, like TCP SYN scans, UDP scans, aggressive scans, and OS detection.

    Scanning Tools

    • Metasploit, Nmap, PRTG Network Monitor, Softperfect Network Scanner are mentioned as examples for network scanning, vulnerability scanning.

    Vulnerability Scanning Tools

    • Metasploit, Tenable Nessus (commercial), QualysGuard (commercial) are examples for scanning for vulnerabilities,

    Phishing

    • Internet fraudsters attempt to steal personal or financial information by sending deceptive messages.

    Steganography

    • Steganography is the practice of hiding secret data within ordinary files (e.g., images).
    • It is used to conceal messages, often in an attempt to avoid detection.

    Denial of Service (DoS) Attacks

    • Purposeful attacks on a network or resources to prevent authorized access.
    • Techniques include volumetric attacks (flooding with requests), protocol attacks (like SYN floods), and application attacks (overloading application with requests).

    Botnets

    • A network of compromised hosts running automated tasks through remote commands and controls.

    Session Hijacking

    • Stealing or predicting a valid session token to gain unauthorized access to a web server.

    Identity Theft

    • Stealing personal information to commit fraud.
    • Using stolen information for various fraudulent activities.

    Social Engineering

    • Manipulation techniques exploiting human error to gain access or other desired outcomes.
    • Includes scams based on social interactions, manipulation, and exploiting user behavior.

    SQL Injection

    • Malicious SQL statements inserted into an entry field for execution.
    • Exploiting vulnerabilities in database-driven applications.
    • A code injection technique aimed at database applications.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Cyber Security Note PDF

    Description

    This quiz covers essential aspects of cyber security, including its definition, objectives, and the vital role of Data Forensics Incidence Response (DFIR). Additionally, it explores the Cyber Kill Chain framework and Tactics, Techniques, and Procedures (TTPs) used in cyber attacks. Test your knowledge on these critical concepts in protecting against cyber threats.

    More Like This

    Advanced Persistent Threat (APT) and Cyber Kill Chain Quiz
    10 questions

    Advanced Persistent Threat (APT) and Cyber Kill Chain Quiz

    AudibleDesert3965 avatar
    AudibleDesert3965
    MITRE ATT&CK Framework Overview
    19 questions

    MITRE ATT&CK Framework Overview

    BrainyRo avatar
    BrainyRo
    Cyber Kill Chain Stages
    5 questions

    Cyber Kill Chain Stages

    OticMagnolia avatar
    OticMagnolia
    Cyber Kill Chain Model Order
    28 questions

    Cyber Kill Chain Model Order

    ConvenientInequality avatar
    ConvenientInequality
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser