Ethical Hacking and CVSS Principles

A system for measuring the severity of vulnerabilities, offering a standardized approach across industries, organizations, and governments. It provides consistent scoring based on factors like impact and exploitability.

A security attack where a fake Wi-Fi access point is created to mimic a legitimate network, often used to steal sensitive data.

A process of gaining access to a wireless network without proper authorization, often done by exploiting vulnerabilities in the network's security settings or by leveraging a lack of password protection.

The act of monitoring wireless network traffic with the intention of intercepting sensitive information, such as passwords and data.

The practice of driving around with a device that scans for Wi-Fi networks, often to identify vulnerable or unprotected networks.

A system to calculate the severity of vulnerabilities, combining factors like impact and exploitability to create objective scores.

CVSS scores are used to help prioritize vulnerability remediation efforts, focusing on the vulnerabilities posing the highest risk to systems.

The National Vulnerability Database (NVD) provides CVSS scores for known vulnerabilities, enabling organizations to assess risk and prioritize remediation actions efficiently.

A security vulnerability that allows attackers to exploit weaknesses in the WPA3 encryption protocol on Wi-Fi networks. This vulnerability could allow an attacker to gain access to the network and potentially steal sensitive information.

A type of attack where an attacker tricks a user into performing an unintended action, such as clicking a malicious link or providing sensitive information.

A technique used by ethical hackers to test the security of a system by attempting to break into it in a controlled way. This helps identify vulnerabilities before malicious actors can exploit them.

A type of denial-of-service attack that floods a network or server with traffic, making it unavailable to legitimate users. This can be used by ethical hackers to test the resilience of a network to traffic overload.

A technique used to analyze and understand the internal workings of software or hardware. Ethical hackers use this to find potential vulnerabilities that could be exploited.

A type of attack targeting wireless networks that uses vulnerabilities in the WPA2 encryption protocol. The attacker can exploit these vulnerabilities to gain unauthorized access to the network.

A set of tools and techniques used to identify and exploit vulnerabilities in software and systems. Ethical hackers use this to assess the security of a system and identify potential threats.

The ability of a system or protocol to resist attacks and maintain its integrity and availability even when facing malicious attempts to disrupt it.

The remaining risk after implementing security measures to mitigate vulnerabilities.

A type of attack where an intruder creates a fake Wi-Fi access point that mimics a legitimate one, tricking users into connecting and stealing their data.

An attack technique that divides data into small packets to bypass Intrusion Detection Systems (IDS).

A tool used to perform session splicing attacks, making it difficult for IDS to detect malicious activity.

The inherent risk associated with a system or process before any security measures are implemented.

A technique used to lure users into giving up their sensitive data by creating fake websites and emails.

A risk that is acknowledged but not addressed immediately.

Exploiting vulnerabilities in file system permissions to replace legitimate binaries with malicious ones, allowing attackers to execute code with elevated privileges.

A type of attack that tries every possible combination of characters to guess a password. This method is very time-consuming but can be effective against weak passwords.

An attack where an attacker exploits vulnerabilities in file system permissions to gain access to unauthorized files or directories.

A technique used to guess passwords by trying commonly used words and phrases from a list.

A method of password cracking that uses pre-computed tables of password hashes, allowing for faster password retrieval.

A technique that uses pre-calculated tables of password hashes and their corresponding plain text passwords. This is faster than brute force attack but requires pre-calculation of hashes and can be less effective against strong passwords.

An attack where an attacker gains unauthorized access to a system by exploiting vulnerabilities that allow the execution of code with elevated privileges.

An attack that occurs when an attacker observes someone entering their password or other sensitive information.

Combining symmetric and asymmetric cryptography in SSL/TLS allows devices with limited processing power, like mobile phones, to utilize symmetric encryption effectively, while still benefiting from the security of asymmetric cryptography for key negotiation.

The known plaintext attack exploits a weakness in the double encryption of DES, demonstrating that encrypting data with two separate DES keys is equivalent to using a single key, making the encryption less secure.

The Single Loss Expectancy (SLE) quantifies the potential financial loss from a single occurrence of a specific risk. It's calculated by multiplying the Asset Value (AV) by the Exposure Factor (EF).

The Annual Rate of Occurrence (ARO) represents the frequency of a specific risk event occurring within a year. It's expressed as a probability or a proportion.

The Annual Loss Expectancy (ALE) calculates the expected financial loss from a specific risk over a year. It's calculated by multiplying the Single Loss Expectancy (SLE) by the Annual Rate of Occurrence (ARO).

The Asset Value (AV) refers to the estimated monetary worth of an asset, representing its cost for replacement or recovery. It includes factors like the cost of hardware, software, and any associated restoration efforts.

The Exposure Factor (EF) expresses the percentage of an asset's value that would be lost due to a specific risk event. It quantifies the potential impact of the risk.

A hard drive failure is estimated to occur every three years. The cost to replace the drive is $300, and the restoration process takes 14 hours at a labor rate of $10 per hour. The annual loss expectancy (ALE) for this scenario is approximately $145.2.

Bug bounty programs encourage ethical hackers to find and report vulnerabilities in a company's systems which might be missed by internal security teams.

Bug bounty programs might not be suitable for companies that lack the capacity to quickly fix discovered vulnerabilities, resulting in a backlog of unaddressed issues.

A large influx of bug reports, including many that might not be valuable, can overwhelm a company's security team, making it difficult to prioritize and address the most critical issues.

If a bug bounty program doesn't attract enough skilled participants, it might not be effective in uncovering significant security flaws.

Most bug bounty participants focus on web application vulnerabilities, while fewer specialize in finding vulnerabilities in operating systems or network hardware that require specialized expertise.

Companies might see a better return on investment for bug bounties related to web applications, since fewer participants have the specialized skills needed to assess vulnerabilities in other areas.

Bug bounty programs lack guaranteed timelines for discovering issues, meaning a company might not receive reports within a specific timeframe, potentially hindering critical projects.

Allowing freelance researchers to potentially penetrate a company's network can pose security risks, requiring careful consideration and risk assessment.