Podcast
Questions and Answers
A major difference between a hacker and an ethical hacker is the:
A major difference between a hacker and an ethical hacker is the:
Breaking the trust of the client has placed in the ethical hacker can lead to the:
Breaking the trust of the client has placed in the ethical hacker can lead to the:
During the planning phase of a penetration test, the aim should be to:
During the planning phase of a penetration test, the aim should be to:
Planning, discovery, attack, and reporting are considered:
Planning, discovery, attack, and reporting are considered:
Signup and view all the answers
What type of penetration testing is most often used when an organization wants to closely simulate how an attacker views a system?
What type of penetration testing is most often used when an organization wants to closely simulate how an attacker views a system?
Signup and view all the answers
Which of the following is NOT considered one of the three types of controls you can use in risk mitigation?
Which of the following is NOT considered one of the three types of controls you can use in risk mitigation?
Signup and view all the answers
Which of the following refers to a piece of software, a tool, or a technique that targets or takes advantage of a vulnerability?
Which of the following refers to a piece of software, a tool, or a technique that targets or takes advantage of a vulnerability?
Signup and view all the answers
Which of the following refers to the structured and methodical means of investigating, uncovering, attacking, and reporting on a target system's strengths and vulnerabilities?
Which of the following refers to the structured and methodical means of investigating, uncovering, attacking, and reporting on a target system's strengths and vulnerabilities?
Signup and view all the answers
Which of the following tests includes anything that targets equipment or facilities and can also include actions against people, such as social engineering-related threats?
Which of the following tests includes anything that targets equipment or facilities and can also include actions against people, such as social engineering-related threats?
Signup and view all the answers
Which of the following tests is designed to simulate an attack against technology from either the inside or the outside depending on the goals and intentions of the client?
Which of the following tests is designed to simulate an attack against technology from either the inside or the outside depending on the goals and intentions of the client?
Signup and view all the answers
A hierarchical system of servers and services specifically designed to translate IP addresses into domain names is called?
A hierarchical system of servers and services specifically designed to translate IP addresses into domain names is called?
Signup and view all the answers
Blocking everything and allowing only what is needed is known as:
Blocking everything and allowing only what is needed is known as:
Signup and view all the answers
Repeaters, hubs, bridges, and switches are part of:
Repeaters, hubs, bridges, and switches are part of:
Signup and view all the answers
The act of a third party covertly monitoring Internet and telephone conversations is called:
The act of a third party covertly monitoring Internet and telephone conversations is called:
Signup and view all the answers
Which of the following is a connection-less protocol that offers speed and low overhead as its primary advantage?
Which of the following is a connection-less protocol that offers speed and low overhead as its primary advantage?
Signup and view all the answers
Which of the following is a largely obsolete protocol that was originally designed for the use in connections established by modems?
Which of the following is a largely obsolete protocol that was originally designed for the use in connections established by modems?
Signup and view all the answers
Which of the following is a method of separating a network into segments for better management and performance?
Which of the following is a method of separating a network into segments for better management and performance?
Signup and view all the answers
Which of the following offers the greatest level of security for wireless networks?
Which of the following offers the greatest level of security for wireless networks?
Signup and view all the answers
Which of the following regulates the flow of traffic between different networks?
Which of the following regulates the flow of traffic between different networks?
Signup and view all the answers
Which routing protocol calculates the best path to a target network by one or more metrics such as delay, speed, or bandwidth?
Which routing protocol calculates the best path to a target network by one or more metrics such as delay, speed, or bandwidth?
Signup and view all the answers
A hash algorithm can be compromised with a collision, which occurs when two separate and different messages or inputs pass through the hashing process and generate:
A hash algorithm can be compromised with a collision, which occurs when two separate and different messages or inputs pass through the hashing process and generate:
Signup and view all the answers
A one-way hashing function is designed to be:
A one-way hashing function is designed to be:
Signup and view all the answers
Cryptography provides an invaluable service to security by providing all of the following except:
Cryptography provides an invaluable service to security by providing all of the following except:
Signup and view all the answers
Digital certificates:
Digital certificates:
Signup and view all the answers
In using symmetric encryption to encrypt a given piece of information, there are two different mechanisms an algorithm can use, either:
In using symmetric encryption to encrypt a given piece of information, there are two different mechanisms an algorithm can use, either:
Signup and view all the answers
Message Security Protocol (MSP), Secure Shell (SSH), and Secure Hypertext Transfer Protocol (S-HTTP) are:
Message Security Protocol (MSP), Secure Shell (SSH), and Secure Hypertext Transfer Protocol (S-HTTP) are:
Signup and view all the answers
The main function or capability of certificate authorities (CAs) is to:
The main function or capability of certificate authorities (CAs) is to:
Signup and view all the answers
To create a digital signature, two steps take place that result in the actual signature that is sent with data. In the first step, the message or information to be sent is passed through a hashing algorithm that creates a hash to:
To create a digital signature, two steps take place that result in the actual signature that is sent with data. In the first step, the message or information to be sent is passed through a hashing algorithm that creates a hash to:
Signup and view all the answers
To create a digital signature, two steps take place that result in the actual signature that is sent with data. In the first step, the message or information to be sent is passed through a hashing algorithm that creates a hash to:
To create a digital signature, two steps take place that result in the actual signature that is sent with data. In the first step, the message or information to be sent is passed through a hashing algorithm that creates a hash to:
Signup and view all the answers
To verify the integrity of the message when creating a digital signature, the message or information to be sent is passed through a hashing algorithm that creates a:
To verify the integrity of the message when creating a digital signature, the message or information to be sent is passed through a hashing algorithm that creates a:
Signup and view all the answers
What type of encryption uses the same key to encrypt and to decrypt information?
What type of encryption uses the same key to encrypt and to decrypt information?
Signup and view all the answers
Which of the following asymmetric algorithms is used to establish and exchange asymmetric keys over an insecure medium?
Which of the following asymmetric algorithms is used to establish and exchange asymmetric keys over an insecure medium?
Signup and view all the answers
Which of the following is used to bring trust, integrity, and security to electronic transactions?
Which of the following is used to bring trust, integrity, and security to electronic transactions?
Signup and view all the answers
Which of the following statements is NOT true regarding asymmetric encryption?
Which of the following statements is NOT true regarding asymmetric encryption?
Signup and view all the answers
Which of the following terms refers to functions employed in asymmetric encryption that are easy to compute in one direction, but tough to compute in the other?
Which of the following terms refers to functions employed in asymmetric encryption that are easy to compute in one direction, but tough to compute in the other?
Signup and view all the answers
Which of the following terms refers to the ability to have definite proof that a message originated from a specific part?
Which of the following terms refers to the ability to have definite proof that a message originated from a specific part?
Signup and view all the answers
Which of the following terms refers to the ability to verify that information has not been altered and has remained in the form originally intended by the creator?
Which of the following terms refers to the ability to verify that information has not been altered and has remained in the form originally intended by the creator?
Signup and view all the answers
Which of the following terms refers to the process of positively identifying a party as a user, computer, or service?
Which of the following terms refers to the process of positively identifying a party as a user, computer, or service?
Signup and view all the answers
Which password attack method tries every possible sequence of keys until the correct one is found?
Which password attack method tries every possible sequence of keys until the correct one is found?
Signup and view all the answers
Which password attack method uses long lists of words that have been predefined and can quickly download for use to break a password that is a word or a name?
Which password attack method uses long lists of words that have been predefined and can quickly download for use to break a password that is a word or a name?
Signup and view all the answers
Which of the following is NOT considered a source from which valuable information can be gleaned about an intended target?
Which of the following is NOT considered a source from which valuable information can be gleaned about an intended target?
Signup and view all the answers
Which of the following is specifically designed to passively gain information about a target?
Which of the following is specifically designed to passively gain information about a target?
Signup and view all the answers
A technique that has existed for more than 25 years as a footprinting tool and involves the use of modems is called: ______
A technique that has existed for more than 25 years as a footprinting tool and involves the use of modems is called: ______
Signup and view all the answers
An attacker using friendliness, trust, impersonation, and empathy to get a victim to do what they want him or her to do is participating in:
An attacker using friendliness, trust, impersonation, and empathy to get a victim to do what they want him or her to do is participating in:
Signup and view all the answers
Attackers observing victims as they enter codes at a bank cash machine or a gas pump are participating in:
Attackers observing victims as they enter codes at a bank cash machine or a gas pump are participating in:
Signup and view all the answers
Facebook, Twitter, and LinkedIn are examples of:
Facebook, Twitter, and LinkedIn are examples of:
Signup and view all the answers
Software that helps organize and track various usernames and passwords is called a:
Software that helps organize and track various usernames and passwords is called a:
Signup and view all the answers
Tricking or coercing people into revealing information or violating normal security practices is referred to as:
Tricking or coercing people into revealing information or violating normal security practices is referred to as:
Signup and view all the answers
Which of the following allows Facebook users to see how a piece of information appears to others?
Which of the following allows Facebook users to see how a piece of information appears to others?
Signup and view all the answers
Which of the following is NOT a networking mapping tool?
Which of the following is NOT a networking mapping tool?
Signup and view all the answers
The practice of identifying the operating system of a networked device through either passive or active techniques is called:
The practice of identifying the operating system of a networked device through either passive or active techniques is called:
Signup and view all the answers
Which of the following excels at allowing the security professional to find services that have been redirected from standard ports?
Which of the following excels at allowing the security professional to find services that have been redirected from standard ports?
Signup and view all the answers
Which of the following is a form of OS fingerprinting that involves actively requesting information from the target system?
Which of the following is a form of OS fingerprinting that involves actively requesting information from the target system?
Signup and view all the answers
Which of the following is a method of identifying the OS of a targeted computer or device in which no traffic or packets are injected into the network and attackers simply listen to and analyze existing traffic?
Which of the following is a method of identifying the OS of a targeted computer or device in which no traffic or packets are injected into the network and attackers simply listen to and analyze existing traffic?
Signup and view all the answers
Which of the following is a Windows-based port scanner designed to scan TCP and UDP ports, perform ping scans, run Whois queries, and use Traceroute?
Which of the following is a Windows-based port scanner designed to scan TCP and UDP ports, perform ping scans, run Whois queries, and use Traceroute?
Signup and view all the answers
Which of the following is the process of locating wireless access points and gaining information about the configuration of each?
Which of the following is the process of locating wireless access points and gaining information about the configuration of each?
Signup and view all the answers
Which of the following reveals telling information such as a version service data that will help an attacker?
Which of the following reveals telling information such as a version service data that will help an attacker?
Signup and view all the answers
Which of the following techniques is not used to locate network access points, but to reveal the presence of access points to others?
Which of the following techniques is not used to locate network access points, but to reveal the presence of access points to others?
Signup and view all the answers
A form of offline attack that functions much like a dictionary attack, but with an extra level of sophistication, is a:
A form of offline attack that functions much like a dictionary attack, but with an extra level of sophistication, is a:
Signup and view all the answers
An attacker can deprive the system owner of the ability to detect the activities that have been carried out by:
An attacker can deprive the system owner of the ability to detect the activities that have been carried out by:
Signup and view all the answers
Cain and Abel, John the Ripper, Pandora, and Pwdump3 are examples of:
Cain and Abel, John the Ripper, Pandora, and Pwdump3 are examples of:
Signup and view all the answers
Precomputed hashes are used in an attack type known as a:
Precomputed hashes are used in an attack type known as a:
Signup and view all the answers
Shoulder surfing, keyboard sniffing, and social engineering are considered:
Shoulder surfing, keyboard sniffing, and social engineering are considered:
Signup and view all the answers
The database on the local Windows system that is used to store user account information is called:
The database on the local Windows system that is used to store user account information is called:
Signup and view all the answers
The unique ID that is assigned to each user account in Windows that identifies the account or group is called a(n):
The unique ID that is assigned to each user account in Windows that identifies the account or group is called a(n):
Signup and view all the answers
Which of the following are considered passive online attacks?
Which of the following are considered passive online attacks?
Signup and view all the answers
Which of the following is NOT true regarding the use of a packet sniffer?
Which of the following is NOT true regarding the use of a packet sniffer?
Signup and view all the answers
Which of the following refers to a utility designed to detect Simple Network Management Protocol (SNMP)-enabled devices on a network and locate and identify devices that are vulnerable to SNMP attacks?
Which of the following refers to a utility designed to detect Simple Network Management Protocol (SNMP)-enabled devices on a network and locate and identify devices that are vulnerable to SNMP attacks?
Signup and view all the answers
Common database vulnerabilities include all the following EXCEPT:
Common database vulnerabilities include all the following EXCEPT:
Signup and view all the answers
Common forms of distributed denial of service (DDoS) attacks include all of the following EXCEPT:
Common forms of distributed denial of service (DDoS) attacks include all of the following EXCEPT:
Signup and view all the answers
Exploitative behaviors against Web applications include all the following EXCEPT:
Exploitative behaviors against Web applications include all the following EXCEPT:
Signup and view all the answers
NGSSquirrel and AppDetective are:
NGSSquirrel and AppDetective are:
Signup and view all the answers
Offloaded services from the local intranet to the Internet itself can be done by the use of:
Offloaded services from the local intranet to the Internet itself can be done by the use of:
Signup and view all the answers
Security issues that can arise in cloud computing that are above and beyond those with standard environments include all the following EXCEPT:
Security issues that can arise in cloud computing that are above and beyond those with standard environments include all the following EXCEPT:
Signup and view all the answers
SQLPing and SQLRecon are:
SQLPing and SQLRecon are:
Signup and view all the answers
The categories of Web application vulnerabilities include all of the following EXCEPT:
The categories of Web application vulnerabilities include all of the following EXCEPT:
Signup and view all the answers
Typical categories of databases include all of the following EXCEPT:
Typical categories of databases include all of the following EXCEPT:
Signup and view all the answers
Web applications that require a user to log on prior to gaining access can track information relating to improper or incorrect logons; this information typically lists entries such as all of the following EXCEPT:
Web applications that require a user to log on prior to gaining access can track information relating to improper or incorrect logons; this information typically lists entries such as all of the following EXCEPT:
Signup and view all the answers
What type of attack relies on a variation of the input validation attack but has the goal of going after a user instead of the application or data?
What type of attack relies on a variation of the input validation attack but has the goal of going after a user instead of the application or data?
Signup and view all the answers
Which category of risk inherent with Web servers includes risks such as the ability to steal information from a server, run scripts or executables remotely, enumerate servers, and carry out denial of service (DoS) attacks?
Which category of risk inherent with Web servers includes risks such as the ability to steal information from a server, run scripts or executables remotely, enumerate servers, and carry out denial of service (DoS) attacks?
Signup and view all the answers
Which class of individuals is primarily concerned with the security of the Web server because it can provide an easy means of getting into the local network?
Which class of individuals is primarily concerned with the security of the Web server because it can provide an easy means of getting into the local network?
Signup and view all the answers
Which class of individuals works the most with the server and is primarily concerned with access to content and services?
Which class of individuals works the most with the server and is primarily concerned with access to content and services?
Signup and view all the answers
Which of the following is hierarchical, structured format for storing information for later retrieval, modification, management, and other purposes?
Which of the following is hierarchical, structured format for storing information for later retrieval, modification, management, and other purposes?
Signup and view all the answers
Which of the following is NOT considered a vulnerability of Web servers?
Which of the following is NOT considered a vulnerability of Web servers?
Signup and view all the answers
Which of the following refers to a language used to interact with databases, making it possible to access, manipulate, and change data?
Which of the following refers to a language used to interact with databases, making it possible to access, manipulate, and change data?
Signup and view all the answers
Which of the following refers to encryption using short keys or keys that are poorly designed and implemented that can allow an attacker to decrypt data easily and gain unauthorized access to the information?
Which of the following refers to encryption using short keys or keys that are poorly designed and implemented that can allow an attacker to decrypt data easily and gain unauthorized access to the information?
Signup and view all the answers
Which of the following statements is NOT true regarding SQL injections?
Which of the following statements is NOT true regarding SQL injections?
Signup and view all the answers
Which of the following statements is NOT true regarding the protection of databases?
Which of the following statements is NOT true regarding the protection of databases?
Signup and view all the answers
A process where communications are redirected to different ports than they would normally be destined for is called:
A process where communications are redirected to different ports than they would normally be destined for is called:
Signup and view all the answers
Study Notes
Ethical Hacking Basics
- Ethical hackers adhere to a strict code of ethics, distinguishing them from malicious hackers.
- Breaking client trust can undermine the accuracy of testing results and lead to further complications in the engagement.
- The planning phase of a penetration test should clarify the necessity of the test and its associated tasks.
Penetration Testing Approaches
- Ethical hacking steps include planning, discovery, attack, and reporting.
- Black-box testing simulates an attacker’s perspective, assessing systems without inside knowledge.
- Physical attacks can target equipment, facilities, or involve social engineering threats.
Risk Management and Controls
- Controls in risk mitigation include administrative, technical, and physical measures; distribution is not a recognized control type.
- An exploit refers to software or techniques that target system vulnerabilities.
Cryptography and Security Measures
- Domain Name Service (DNS) translates IP addresses to domain names.
- The deny-all principle restricts access to only what is necessary.
- Digital certificates serve as a means of identification and ensure secure transactions online.
Hashing and Encryption
- A hash collision occurs when two different inputs yield the same hash value.
- Hashing functions are easy to compute one way but difficult to reverse; this is known as trapdoor functions in asymmetric encryption.
- Symmetric encryption uses the same key for encryption and decryption, while asymmetric encryption involves a key pair (public and private keys).
Certificate Authorities and Digital Signatures
- Certificate Authorities (CAs) generate key pairs and bind identities to public keys, crucial for secure communications.
- To create a digital signature, the original message is hashed to ensure integrity; this hash verifies that information is unaltered.
Password Attacks
- Common password attack methods include brute-force, which tests all possible combinations, and dictionary attacks, which utilize predefined lists of words.
- Social engineering involves manipulating individuals into divulging confidential information.
Social Networking and Information Gathering
- Social engineering sites include platforms like Facebook, LinkedIn, and Twitter, which can be leveraged for information gathering.
- Footprinting is a passive information-gathering technique about a target.
Security and Information Privacy
- A password manager helps to organize and secure usernames and passwords.
- Features like the Preview my profile button on social networks allow users to see how their information appears to others.
Summary of Networking Tools and Resources
- The Internet Assigned Numbers Authority (IANA) delegates internet resources, maintaining essential infrastructure such as domain registration and addressing.
- Footprinting techniques provide valuable insights into potential vulnerabilities and are fundamental for ethical hacking engagement.### Conquistador
- Refers to Spanish explorers and conquerors known for their expeditions in the Americas during the 16th century.
- Key figures include Hernán Cortés (who conquered the Aztecs) and Francisco Pizarro (who conquered the Inca Empire).
SolarWinds
- A software company known for providing enterprise-level IT management software.
- Its products help companies manage their networks, systems, and infrastructure.
Cheops
- Also known as Khufu, he was an ancient Egyptian pharaoh of the Fourth Dynasty.
- Credited for commissioning the Great Pyramid of Giza, one of the Seven Wonders of the Ancient World.
Harris Stat
- Refers to initiatives and methodologies used for statistical analyses in various fields.
- Commonly associated with data collection and analysis efforts.
Wardialing
- Technique used to identify phone numbers that connect to modems.
- It involves dialing a range of numbers to find vulnerable systems.
OS Identification
- Method of determining the operating system running on a networked device.
- Can be passive (observing traffic) or active (sending queries).
THC-Amap
- Tool that excels in discovering services redirected from standard ports.
- Useful for security professionals to uncover hidden services.
Active Fingerprinting
- Involves techniques that actively interact with a target system to obtain OS information.
- Contrasts with passive fingerprinting, which does not involve direct interaction.
Passive Fingerprinting
- Involves analyzing existing network traffic without injecting any packets.
- Useful for identifying the OS without alerting the target.
Superscan
- A Windows-based port scanner that scans both TCP and UDP ports.
- Capable of conducting ping scans, running Whois queries, and utilizing Traceroute.
Wardriving
- The practice of searching for Wi-Fi networks while traveling in a vehicle.
- Involves gathering information about wireless access points.
Banner
- A data string returned by a service that discloses version and configuration information.
- Often used by attackers to gather insights about systems.
Warchalking
- Technique that involves marking locations where Wi-Fi networks are available.
- Does not locate access points but rather indicates their presence.
Hybrid Attack
- An advanced form of offline attack similar to dictionary attacks but more sophisticated.
- Combines multiple techniques to crack passwords.
Disabling Auditing
- Technique that can prevent system owners from detecting unauthorized activities.
- Reduces the ability to monitor and identify breaches.
Password Crackers
- Tools like Cain and Abel, John the Ripper, and Pwdump3 that are designed to break passwords.
- Utilize various methods including dictionary and brute-force attacks.
Rainbow Table
- Attack type leveraging precomputed hashes to crack passwords.
- Uses a table of hashes to match against stored password data.
Nontechnical Attacks
- Include methods like shoulder surfing and social engineering.
- Aim to manipulate human behavior rather than exploit technical vulnerabilities.
Security Account Manager (SAM)
- Database that stores user account information on Windows systems.
- Critical for system access management.
Security Identifier (SID)
- Unique identifier assigned to each user account in Windows.
- Essential for managing permissions and access controls.
Passive Online Attacks
- Include techniques like packet sniffing or replay attacks.
- Focus on intercepting communications rather than interacting with targets.
Packet Sniffers
- Tools that capture network traffic and analyze data packets.
- Can be thwarted by network technologies that encrypt or limit visibility.
SNScan
- Utility designed to detect SNMP-enabled devices on a network.
- Useful for identifying devices that may be vulnerable to attacks.
Database Vulnerabilities
- Common issues include weak authentication methods and privilege misconfigurations.
- Strong audit logs are not considered a vulnerability.
DDoS Attack Types
- Common forms include SYN flooding, Smurf attacks, and Ping flooding.
- Buffer overflows are not typically associated with DDoS.
Web Application Exploits
- Include stealing sensitive data or destroying information.
- DNS attacks and data theft are notable methods.
Database Audit Software
- NGSSquirreL and AppDetective are tools used for database auditing.
- Help in identifying rogue installations and vulnerabilities.
Cloud Computing
- Allows offloading services from local intranets to the Internet.
- Raises unique security concerns beyond standard environments.
Web Application Vulnerabilities
- Include authorization, authentication issues, and session management.
- End-user education is not categorized as a vulnerability.
Database Categories
- Typical types include distributed, object-oriented, and relational databases.
- "Applied database" is not recognized as a category.
User Credential Log Tracking
- Logs track various login attempts including invalid entries.
- Valid user ID with valid password entries are not logged as incorrect.
Cross-Site Scripting (XSS)
- Attack that targets users rather than applications directly.
- Involves injecting scripts into web pages viewed by other users.
Web Server Risks
- Include information theft, remote script execution, and DoS attacks.
- Important for server administrators to monitor and mitigate.
Information Management Structures
- Databases serve as hierarchical structures for storing and manipulating information.
- Essential for data retrieval and management tasks.
Web Server Vulnerabilities
- Factors include improper design and susceptibility to DoS attacks.
- Poor training of end users does not count as a server vulnerability.
Structured Query Language (SQL)
- Language used for interacting with databases for data access and manipulation.
- Central to database management practices.
Weak Ciphers
- Refers to poor encryption methods that make data vulnerable to attacks.
- Essential to apply stronger encryption standards to protect data.
SQL Injection Attacks
- Execute arbitrary commands and exploit vulnerabilities in web applications.
- Not platform-dependent; they can affect multiple database systems.
Database Protection Tools
- Various tools exist for auditing and ensuring database security.
- Protection involves making database existence less obvious to potential attackers.
Port Redirection
- Process of rerouting communication to different ports.
- Can be part of a strategy to obscure network traffic patterns.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
Test your knowledge with these flashcards on ethical hacking. Quiz yourself on key concepts, differences between hackers, and code of ethics that define ethical hacking practices. Great study material for anyone looking to deepen their understanding of ethical hacking.