Ethical Hacking Lecture 3: Target Scanning
37 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is a threat in the context of security?

  • A security vulnerability that has not yet been exploited.
  • A set of security controls that are designed to mitigate vulnerabilities.
  • An action or event that could cause harm to a system or asset. (correct)
  • A group of individuals who are actively trying to exploit vulnerabilities.

    • What is the purpose of running your own scans to identify what is visible on your network?

  • To identify all of the devices that are connected to your network.
  • To test the performance of your network infrastructure.
  • To discover potential vulnerabilities that could be exploited by attackers. (correct)
  • To assess the effectiveness of your firewall.

    • What is the purpose of network segmentation?

  • To reduce the risk of data breaches. (correct)
  • To increase the capacity of the network.
  • To improve network performance.
  • To make it easier to manage network devices.

    • Which of the following is NOT a method mentioned in the text for preventing information gathering by attackers?

    <p>Implementing multi-factor authentication. (B)</p> Signup and view all the answers

    What is the main goal of responsible disclosure?

    <p>To promote transparency and accountability in security. (C)</p> Signup and view all the answers

    Which of the following is NOT a step listed in the Penetration Testing Framework?

    <p>Social Engineering. (A)</p> Signup and view all the answers

    When is a threat considered practical?

    <p>When it has been successfully exploited in a real-world attack. (D)</p> Signup and view all the answers

    Which of the following is an example of a security measure against active information gathering?

    <p>Network segmentation. (A)</p> Signup and view all the answers

    Which of the following is NOT a valid example of passive information gathering?

    <p>Using a vulnerability scanner to identify open ports on a target's network (C)</p> Signup and view all the answers

    Which countermeasure is specifically designed to protect against the use of the Wayback Machine?

    <p>Reviewing public sources of information (B)</p> Signup and view all the answers

    What is the purpose of 'banner grabbing' in the context of active information gathering?

    <p>To extract information about services running on a target host (B)</p> Signup and view all the answers

    Which of the following is NOT considered a point of entry for an attacker or pentester?

    <p>Operating system configurations (B)</p> Signup and view all the answers

    Which of the following tools can be used for port scanning?

    <p>All of the above (D)</p> Signup and view all the answers

    What is the difference between a TCP port scan and a UDP port scan?

    <p>TCP scans send SYN packets, while UDP scans send UDP packets (D)</p> Signup and view all the answers

    Which of the following is a common misconception about passive information gathering?

    <p>It is always easy to detect (D)</p> Signup and view all the answers

    Which of the following is NOT a type of scan commonly performed by security professionals?

    <p>Network mapping scan (C)</p> Signup and view all the answers

    Which of the following is NOT a typical piece of information obtained from a service banner?

    <p>User Account Information (B)</p> Signup and view all the answers

    What makes banner grabbing a valuable technique for security professionals?

    <p>It can help detect outdated software versions. (A)</p> Signup and view all the answers

    Which tool is commonly used for banner grabbing due to its flexibility and wide range of networking capabilities?

    <p>Netcat (B)</p> Signup and view all the answers

    What is the primary method used for banner grabbing?

    <p>Establishing a TCP connection and reading the response. (A)</p> Signup and view all the answers

    Which of these protocols can be used for Banner Grabbing?

    <p>All of the above (D)</p> Signup and view all the answers

    What is the core concept behind the notion of threats?

    <p>The potential for something to cause harm, even if there's no intentional actor involved. (A)</p> Signup and view all the answers

    Which of the following is NOT a defining characteristic of threats as discussed in the provided content?

    <p>They are always tangible entities that can be easily identified. (D)</p> Signup and view all the answers

    What is a key difference between a threat and a vulnerability?

    <p>Threats represent the potential for harm, while vulnerabilities are the weaknesses that allow that harm. (C)</p> Signup and view all the answers

    According to the provided content, what is the significance of threat modeling in security?

    <p>It helps identify and prioritize threats for the purpose of developing effective security measures. (A)</p> Signup and view all the answers

    What is the primary function of the MS SDL Threat Modeling Tool?

    <p>To identify and analyze potential threats within a software development lifecycle. (A)</p> Signup and view all the answers

    What is a potential challenge when using MS SDL Threat Modeling?

    <p>Interpretations of potential threats by different security professionals may vary. (D)</p> Signup and view all the answers

    What does OSINT stand for?

    <p>Open Source Intelligence (B)</p> Signup and view all the answers

    What is the primary purpose of banner grabbing?

    <p>To gather basic information about a target system. (B)</p> Signup and view all the answers

    What is the primary goal of intelligence gathering during a penetration test?

    <p>To gain as much information about the target as possible, which can be used in later phases of the penetration test. (C)</p> Signup and view all the answers

    Which of the following is NOT a feature of active information gathering?

    <p>It relies solely on publicly available information. (A)</p> Signup and view all the answers

    What is a key advantage of passive information gathering?

    <p>It allows for gathering information without being detected by the target. (D)</p> Signup and view all the answers

    What type of OSINT activity could potentially be considered semi-passive?

    <p>Querying publicly available DNS records for the target domain. (A)</p> Signup and view all the answers

    Which information gathering technique is considered part of active information gathering?

    <p>Performing a port scan to identify open services on the target server. (B)</p> Signup and view all the answers

    A penetration tester is trying to gather information about a target organization. Which approach would likely NOT be considered active information gathering?

    <p>Analyzing publicly available data on the target organization's website. (A)</p> Signup and view all the answers

    How can active information gathering aid in identifying vulnerabilities in a target system?

    <p>By providing insights into the target's attack surface and potential attack vectors. (C)</p> Signup and view all the answers

    Why is it generally recommended to perform information gathering before vulnerability analysis during a penetration test?

    <p>To understand the target's attack surface and prioritize the most relevant vulnerabilities for analysis. (A)</p> Signup and view all the answers

    Flashcards

    Active Information Gathering

    Collecting information directly from a target to plan attacks.

    Passive Information Gathering

    Collecting information without alerting the target, often using archived data.

    Semi-Passive Information Gathering

    Gathering data that simulates normal internet behavior without raising suspicion.

    OSINT

    Open Source Intelligence; information gathered from publicly available sources.

    Signup and view all the flashcards

    Penetration Testing Framework

    Structured process for testing security through multiple phases.

    Signup and view all the flashcards

    Information Gathering Phase

    Initial stage of penetration testing where data on the target is collected.

    Signup and view all the flashcards

    Threat Modelling

    Identifying potential threats and vulnerabilities in a system.

    Signup and view all the flashcards

    Vulnerability Analysis

    Assessment of a system to find weaknesses that can be exploited.

    Signup and view all the flashcards

    Banner Grabbing

    A method to obtain information from a service's response, revealing its identity and version.

    Signup and view all the flashcards

    Service Identification

    Determining the type of service running based on the banner information.

    Signup and view all the flashcards

    Telnet

    A tool used to connect to a port to read the returned banner.

    Signup and view all the flashcards

    Netcat (nc)

    Versatile tool for reading banners and performing other networking tasks.

    Signup and view all the flashcards

    Nmap

    Network scanning tool that includes scripts specifically for banner grabbing.

    Signup and view all the flashcards

    Network Segregation

    Dividing a network into segments to enhance security and reduce scanning ease.

    Signup and view all the flashcards

    Responsible Disclosure

    A method of reporting security vulnerabilities to allow vendors to fix issues before public disclosure.

    Signup and view all the flashcards

    Firewall

    A security system that controls incoming and outgoing network traffic based on predetermined security rules.

    Signup and view all the flashcards

    Log Analysis

    The examination of logs to identify abnormal behaviors and security incidents.

    Signup and view all the flashcards

    Banners Removal

    The practice of eliminating information displayed by services to prevent information leakage about a system.

    Signup and view all the flashcards

    Threat Definition

    A potential cause of an unwanted incident that may harm a system or asset.

    Signup and view all the flashcards

    Countermeasures

    Actions taken to mitigate the risks of information gathering.

    Signup and view all the flashcards

    WHOIS Database

    A database that stores registered users or assignees of a domain name.

    Signup and view all the flashcards

    Target Scanning

    The process of discovering hosts, ports, and services on a network.

    Signup and view all the flashcards

    Operating System Discovery

    The process of determining the OS running on a networked device.

    Signup and view all the flashcards

    Threat

    An entity that wants to do harm to you or something you care about.

    Signup and view all the flashcards

    Vulnerability

    A weakness that can be exploited to cause harm.

    Signup and view all the flashcards

    Asset

    Something valuable that needs protection from threats.

    Signup and view all the flashcards

    Security Problem Components

    Includes threats, vulnerabilities, and assets.

    Signup and view all the flashcards

    MS SDL Threat Modelling Tool

    A tool by Microsoft to help manage and mitigate threats.

    Signup and view all the flashcards

    Interpretation Challenges

    Different engineers may interpret threat models in various ways.

    Signup and view all the flashcards

    OSINT Types

    Open-source intelligence methods for gathering information.

    Signup and view all the flashcards

    Study Notes

    Ethical Hacking and Penetration Testing - Lecture 3

    • Lecture focuses on Target Scanning (active information gathering) and Threat Modeling
    • The lecture outlines a penetration testing framework including pre-engagement interactions, information gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
    • OSINT types are categorized into passive, semi-passive, and active information gathering.
    • Passive information gathering is generally useful when targeting activity needs to be undetected
    • This involves collecting archived information from third-party sources.
    • Semi-passive involves gathering data that appears like normal internet behavior.
    • This does not include port scanning or crawler techniques
    • The goal is to collect metadata to avoid attracting attention during the reconnaissance activities
    • Active information gathering is performed to identify the infrastructure
    • This includes actively searching for open services, unpublished directories, files, and servers.
    • Target scanning includes host discovery, port scanning, and operating system discovery.
    • Scanners like Nmap, Netcat and Superscan are discussed
    • Banner grabbing is a technique used to gather information about a computer system by connecting to a service and reading the banner returned.
    • Information gathered via banners provide details on services, software version, and operating systems.
    • Tools like Telnet and Netcat support banner grabbing
    • Countermeasures against active information gathering include network topology design for difficulty in scanning, disabling unnecessary services, using firewalls, and implementing network intrusion detection systems to reduce exposure.
    • Countermeasures against passive information gathering include reviewing public information sources prior to publication, employing anonymous identities, considering private domain registration, checking files/pages for metadata and be aware of archives like WayBack Machine
    • The framework for penetration testing includes pre-engagement interactions, initial assessment, threat modeling, vulnerability analysis, Exploitation and post exploitation, and reporting.
    • Threat modeling assesses threats to assets, and approaches include attacker-centric (understanding attack methods), software-centric (assessing softwar vulnerabilities), and asset-centric (examining the value of each asset).
    • Microsoft SDL is a threat modeling technique used by developers to enhance security design.
    • Steps include system description, creation of checklists, impact assessment and countermeasure planning
    • Tools such as the MS SDL threat modelling tool are available to support the process
    • The concept of responsible disclosure is presented along with the potential rewards for vulnerability discoveries

    Lab Activities

    • Students are required to complete Week 3 lab activities on active information gathering using Nmap for target scanning.
    • The lab will utilize both Kali Linux and Metasploitable virtual machines.
    • The MySay module survey is to be completed.
    • Review the coursework specification document and clarify any related questions.

    Reading List

    • Recommended resources for further research.

    Next Week

    • A preview of the topics to be covered in the following week, namely Vulnerability Assessment and coursework review.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Ethical Hacking and Penetration Testing Lecture 3 PDF

    Description

    This lecture delves into target scanning and threat modeling as part of ethical hacking and penetration testing. Key topics include the penetration testing framework, types of OSINT, and different methods of information gathering—passive, semi-passive, and active. Understand how to conduct effective reconnaissance while minimizing exposure.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser