Active Ex Unix

Front 1

What are the 8 phases to exploitation?

Back 1

Foot printing
Scanning
Enumeration
Gain access (exploitation)
Privilege escalation
Situational awareness
Covering tracks
Creating backdoors

Front 2

What are 3 commonly used techniques used for foot printing?

Back 2

Trace Route
Record Route (ping -r)
Ping Sweep

Front 3

What are the 3 types of trace routes?

Back 3

ICMP
UDP
TCP

Front 4

What type of trace route is the default for windows?

Back 4

ICMP

Front 5

How many packets are sent with an ICMP trace route?

Back 5

3

Front 6

What type of trace route is the default for unix?

Back 6

UDP

Front 7

What does a UDP trace route include other than a destination IP address?

Back 7

destination port

Front 8

Where does a UDP trace route destination port normally start?

Back 8

33000

Front 9

True or False

During a UDP trace route:

The client will increment the destination port?

Back 9

TRUE

Front 10

True or False

During a TCP trace route:

The trace route will be directed to a specific TCP port?

Back 10

TRUE

Front 11

During a TCP trace route what will be returned when the target is reached?

Back 11

RST

Front 12

This command and option combination will will store the outbound interfaces that a trace route can't retrieve; this information is stored in the IP header options field.

Back 12

ping -r (windows)

ping -R -s -v (unix)

-R invokes record route
-s send 1 datagram/sec collect stats
-v verbose mode (display results)

Front 13

_____ is used to determine if a given range of IP address are live. It consists of ICMP echo requests sent to multiple hosts.

Back 13

ping sweeping

Front 14

This phase identifies the target OS and listening ports/applications.

Back 14

Scanning

Front 15

What are the 2 types of OS fingerprinting?

Back 15

Active & Passive

Front 16

_____ fingerprinting is defined as analyzing the TCP/IP stack of an OS.

Back 16

Active

Front 17

_____ sends a packet with the "FIN" control flag set to an open port of a host and waits for a response.

Back 17

FIN Probe

Front 18

The correct response to a _____ is to not respond, however, some systems such as windows, HP-UX, and Iris will respond with the "RST" "ACK" flags set

Back 18

FIN Probe

Front 19

A _____ sends a packet with one of the bits set in the reserver undefined TCP flag section of the TCP header. Linux systems prior to kernel 2.0.35 will keep the flag set in their response. Other OSs will reset the connections when they receive it.

Back 19

BOGUS Flag Probe

Front 20

_____is used to find patterns in the initial sequence numbers ISN chosen by the TCP implementation when responding to a connection request.

Back 20

TCP ISN Samling

Front 21

_____ relies on intentionally creating a half-open connections with a target. When the target does not see the final ACK, it sends another SYN plus ACK based on the time out interval between re-transmissions you could fingerprint the OS.

Back 21

(RTO) Re-transmission Time OUT

Front 22

_____ fingerprinting is defined as monitoring network traffic and analyzing it to determine an OS

Back 22

Passive

Front 23

What are four items you can look at in a packet capture to passively ID an OS?

Back 23

TTL
Window Size
DF (Don't Fragment)
TOS (Type of Service)

Front 24

List some passive OS finger printing tools.

Back 24

P0f
Ettercap
Wireshark

Front 25

_____ is the most basic form of TCP scanning. It uses the connect system call of the OS on a target system to open a connection to every open port on that machine.

Back 25

TCP connect scan

Front 26

_____ is referred to as a "half-open" scan. The scanner sends a packet with the SYN flag set to all ports on the target and waits for the responses from the target, however, it does not send teh final ACK back

Back 26

SYN stealth scan

Front 27

True or False

Closed ports always send a RST in response to a SYN?

Back 27

True

Front 28

____ sends a packet with the SYN control flag set to all ports on the target and waits for the responses. It completes the 3-way handshake.

Back 28

TCP connect scan

Front 29

_____ sends a packet with the SYN control flag set to all ports on the target and waits for the responses from the target, but does not send the final ACK back to the target.

Back 29

SYN Stealth scan (half-open)

Front 30

_____ sends a packet with NO control flag set to all ports on the target machine and waits for the responses. Open ports will ignore the packet, while closed ports will respond with a RST.

Back 30

TCP Null scan

(not effective against MS)

Front 31

_____ sends a packet with the FIN control flag set to all ports on the target and waits for the responses. Open ports will ignore the packet, while closed ports wil respond with a RST.

Back 31

TCP FIN scan

(not effective against MS)

Front 32

_____ sends a packet with the FIN, URG, and PSH control flags set to all ports on the target and waits for the responses. Open ports will ignore the packet, while closed ports will respond with a RST.

Back 32

TCP Xmas scan

(not effective against MS)

Front 33

_____ sends a connect scan, but breaks it up into a fragmented scan set to all ports on the target machine.

Back 33

TCP Frag scan

Front 34

_____ utilizes the Identification protocol to provide disclosure of the owner of processes connected to TCP services. The target must be running Identd.

Back 34

TCP reverse Ident scan

Front 35

_____ sends an ACK packet (with random acknowledgment/sequence numbers) to the ports specified.

Back 35

ACK stealth scan

Front 36

_____ similar to the ACK scan except that it can sometimes detect open ports as well as filtered/unfilered ports due to an anomaly in the TCP window size reporting by some OSs.

Back 36

TCP window scan

Front 37

_____ uses exclusion sequence rule. It sends UDP requests and if no replies come back, it's assumed open. If it receives "Destination Unreachable", it's assumed closed.

Back 37

UDP scan

Front 38

_____ sends raw IP packets without any further protocol header to each specified protocol on the target; if it receives an ICMP protocol unreachable message, then the protocol is not in use. Otherwise, it assumes it is open.

Back 38

IP protocol scan

Front 39

_____ simply generates and prints a list of IP addresses or host names without actually pinging or port scanning them.

Back 39

List scan

Front 40

_____ is an advanced scan method that allows for a truly blind TCP port scan. It uses the IP identification field in teh IP header. This field is utilized to reassemble fragment packets. Most OSs increment this field by a value of 1, regardless if there is fragmentation.

Back 40

Zombie scan (Idle Scan)

Front 41

This option Floods open TCP/UDP ports with SunRPC program NULL commands to determine whether they are RPC ports, and if so, what program they call up.

Back 41

RPC scan

Front 42

The _____ option attempts to determine what type of OS you are scanning

Back 42

OS detection

Front 43

This option communicates with open TCP/UDP ports to determine more about what is actually running.

Back 43

version detection

Front 44

_____ is a command line TCP/UDP port scanning tool provided by Foundstone. It's small size makes it a great "take it with you" scanner.

Back 44

FCscan

Front 45

The _____ phase focuses on validating user accounts and verifying application versions which leads to the exploitation selection.

Back 45

enumeration

Front 46

_____ involves connecting to common applications on the target to identify the version of teh applications.

Back 46

Banner grabbing

Front 47

Most popular methods of banner grabbing are done in what 2 ways.

Back 47

Telnet
Netcat

Front 48

The _____ command displays the target host's NFS exported file system.

Back 48

showmount

Front 49

The _____ command displays information on logged-in users.

Back 49

finger

Front 50

The _____ command displays information on logged-in users. similar to the finger command.

Back 50

rusers

Front 51

The _____ command displays RPC services running on the target host by program #, transport, service name, and owner.

Back 51

rpcifo

Front 52

The _____ utility uses SNMP GETNEXT requests to query objects in the management information base.

Back 52

SNMP-Walk

Front 53

What group does each ASN# represent? (7th digit)

Back 53

ASN 1= name, location, description of equipment
ASN 2= network Interface and their measure traffic
ASN 3= address translation
ASN 4= IP packet statistics
ASN 5= stats about received ICMP messages
ASN 6= TCP algorithms, paramaters, and statistics
ASN 7= UDP traffic statistics
ASN 8= EGP protocol traffic statistics
ASN 10= Reserved for media-specific MIBs
ASN 11= SNMP traffic statistics

Front 54

A _____ occurs when data written to a buffer, due to insufficient bounds checking, corrupts data valued in memory addresses adjacent to the allocated buffer.

Back 54

buffer overflow

Front 55

What are the 2 types of buffer overflows?

Back 55

Stack Buffer Overflow
Heap Buffer Overflow

Front 56

A _____ stems from the use of unfiltered user input in the format string parameter of various C programming language functions that perform formatting.

Back 56

Format String Attack

Front 57

A _____ attack is derived from the process of converting data that has more than one possible representation. This type of attack is normally associated with web servers to access information OUTSIDE the root web directory. Normally used for directory traversal attacks.

Back 57

canonicalization

Front 58

_____ refers to inputting raw transact SQL queries into an application to perform an unexpected action or result.

Back 58

SQL injection

Front 59

This attack sends a modified RPC packet set to the host name of the remote system, it will then be processed as if it was a local request.

Back 59

Sadmin exploit

Front 60

This tool overflows the telnet client environment variable buffer with 65 characters which caused the remote system to drop the user into a shell.

Back 60

TTYPrompt Exploit

Front 61

This attack targets a specific function in the ftpd service called globbing. It sends bogus RNFR requests with 73 self-referencing directory locations "./" this is done four times, escaping the boundary of the ftpd service and then stores exploit code into memory.

Back 61

WU-ftpd exploit (7350wurm)

Front 62

This attack loads user-specifig kernel modules by using directory traversal sequences and employing the mount() or sysfs() system calls. If successful it will call out a shell with root privileges.

Back 62

Solaris vfs_getvfssw() exploit

Front 63

What are the 4 modes for john the ripper?

Back 63

external
internal
single
wordfile

Front 64

What category involves identifying logged on users, specific processes, identifying hardware components, possible security packages, and logging capabilities?

Back 64

Situational awareness

Front 65

The _____ command displays a summary of system and user activity.

Back 65

w

Front 66

The _____ command displays logged in username, terminal, login time, and where the user logged in from.

Back 66

who

Front 67

The _____ command displays logged in username, active processes/CPU time owned by the user and login time. The header displays the time of day and machine name.

Back 67

whodo

Front 68

The _____ command displays information on all users (regardless of whether they are logged in) and system accounts. Output displays user, UID, froup name, GUID, and comment name.

Back 68

logins

Front 69

The _____ command prints information on active processes.

Back 69

ps

Front 70

The _____ command for solaris and the _____ command for linux provides interactive monitoring of active processes. Also provides a summary of how many processes are running and the owner.

Back 70

solaris: prstat

linux: top

Front 71

The _____ command displays information about the processor to include the type, co-processor, and processor chip.

Back 71

psrinfo

Front 72

The _____ command displays information about terminal, disk, and tape I/O activity.

Back 72

iostat

Front 73

The _____ command displays information about the current system.

Back 73

uname

Front 74

The _____ command displays information about disk space usage.

Back 74

df

Front 75

The _____ command displays information about installed software packages.

Back 75

pkginfo

Front 76

The _____ command displays all patches on the system.

Back 76

showrev -p

Front 77

What file controls what will be logged and where it will be logged?

Back 77

/etc/syslog.conf

Front 78

What file controls where the logs will be sent (what system)?

Back 78

/etc/hosts

Front 79

This utility removes user's last entry from the WTMP, UTMP, LASTLOG, WTMPX, and UTMPX binaries. It works with most unix variants.

Back 79

zap3

Front 80

What is the only shell that does not have a shell history file?

Back 80

bourne shell (sh)

Front 81

What are 3 ways to modify a history file or log file?

Back 81

vi
copy and replace
echo complete file to /dev/null (most intrusive)

Front 82

What command would you use to modify the date of a file?

Back 82

touch

Front 83

_____ provide an easy means to return to the target after is has been exploited.

Back 83

Back doors

Front 84

_____ is a program that will add 3 back doors on a target.

Back 84

SM4CK

Front 85

_____ a collection of programs that support the following concepts: Hiding processes/directories/files, running packet sniffers, clearing logs, allowing back doors, and capturing local logins and passwords.

Back 85

Root kits

Front 86

What are the 2 types of root kits?

Back 86

application

kernel