Ceh 1

Front 1

List the five phases of hacking

Back 1

Reconnaissance
Scanning
Gaining Access
Maintaining Access
Clearing Tracks

Front 2

Give an example of of Passive Reconnaissance

Back 2

Searching public records like Google or library records

Front 3

Give an example of active reconnaissance

Back 3

Interacting with company employees to solicit information

Front 4

What types of information do attackers gather from the scanning phase?

Back 4

computer names, IP addresses and user accounts

Front 5

What is meant by a "shrink wrap code attack"

Back 5

utilizing built in scripts in applications that were designed to make administrators jobs easier, which are inadvertantly left in during installation

Front 6

What is entailed in open source or passive information gathering?

Back 6

collecting information about a potential target from publicly available sources

Front 7

What is entailed in active information gathering?

Back 7

gathering information through social engineering, on-site visits, interviews and questionnaires.

Front 8

What is entailed in anonymous footprinting?

Back 8

Gathering information from sources where the author or source cannot be traced?

Front 9

What is pseudonymous footprinting ?

Back 9

collecting information that might be published under a different name in attempt to preserve privacy.

Front 10

What is organizational or private footprinting?

Back 10

collecting information from an organization's web-based calendar and email services

Front 11

What is internet footprinting

Back 11

collecting information about a target from in the internet.

Front 12

What are the three objectives of footprinting?

Back 12

collect network information, collect system information and collect organizational information

Front 13

Name the eight steps in the footprinting methodology

Back 13

Internet footprinting, competitive intelligence, whois footprinting, DNS footprinting, network footprinting, website footprinting, email footprinting, google hacking

Front 14

Name three tools useful in extracting target information from the internet

Back 14

web data extractor, spiderfoot, robtex

Front 15

Name eight tools useful for finding information about people on the internet

Back 15

yahoo people search, 123 people search, address.com, zaba search, wink people search, public people finder, people finders, people lookup

Front 16

Name eight competitive intelligence tools

Back 16

SEC info, business wire, c-span, choicepoint online, cnn money company research, web investigator, forbes 500, barrons

Front 17

Name eight whois lookup tools

Back 17

Sam Spade, My IP Suite, CountryWhois, LanWhois, NetRanger WhoIs, Lapshins Whois, Alchemy eye, WebFerret

Front 18

Name eight online whois tools

Back 18

whois, whois lookup, better whois, geek whois, arin whois database search, network solutions whois, domaintools, autowhois,

Front 19

What is a DNS Type A record

Back 19

Points to a host IP address

Front 20

What is a DNS MX record

Back 20

points to a domain's mail server

Front 21

What is a DNS NS record

Back 21

points to host's name server

Front 22

What is a DNS CNAME record

Back 22

canonical naming allows aliases to a host

Front 23

What is a SOA DNS record

Back 23

indicate authority for a domain

Front 24

What is a SRV record?

Back 24

service records

Front 25

What is a PTR record

Back 25

maps ip address to a host name

Front 26

What is a RP record

Back 26

responsible person

Front 27

What is a HINFO record

Back 27

host information record which includes CPU type and OS

Front 28

Name eight DNS interrogation tools

Back 28

netinspector, NSLookup, Digdug DNS Analyzer, MSR Strider URL Tracer, WhereISIP, DNSMap, Multiple Addresses, DNS Tool

Front 29

Name eight DNS Interrogation tools online

Back 29

Online DNS Tools, Better Whois, Professional Toolset, Geek Whois, DNS record, Mozzle Domain Name pro, Check DNS, Domain Information Groper

Front 30

Name sixteen traceroute tools

Back 30

VisualRoute Trace, GEOSpider, vTrace, Magic NetTrace, 3D Visual Trace Route, Visual IP Trace, Trout, Patrice Zwenger Traceroute, AnalogX HyperTrace, Layer Four Traceroute, TCP Trace Route, Ping Plotter, Network Systems Traceroute, Tracepath, Roadkil's Trace Route, Ping-Probe

Front 31

Name eight website mirroring tools

Back 31

Wget, Website Ripper Copier, Webripper, BlackWidow, WinWSD, Reamweaver, xaldon webspider 2, teleport pro

Front 32

How can you use Website Watcher in reconnaissance

Back 32

By watching changes on websites

Front 33

Name twelve tools used for email tracking

Back 33

emailTrackerPro, Read Notify, DidTheyReadIt, PoliteMail, VisualRoute Trace, GeoSpider, vTrace, Magic NetTrace, 3d Visual Trace Route, Visual IP Trace, Trout, Patrice Zwenger Traceroute

Front 34

What is the purpose of a ping sweep?

Back 34

to determine the live hosts from a range of IP addresses

Front 35

Name the six TCP communication flags

Back 35

SYN, ACK, FIN, PSH, RST, URG

Front 36

What is the command string using hping 3 to perform an ICMP Ping?

Back 36

hping3 -1 {IP Address}

Front 37

What is the command string to perform an ACK scan on port 25?

Back 37

hping3 -A {IP Address} -p 25

Front 38

What is the command string to perform a UDP scan on port 337?

Back 38

hping3 -2 {IP Address} -p 337

Front 39

What is the command string to determine the initial packet sequence number in hping3?

Back 39

hping3 {IP Address} -Q -p 139 -s

Front 40

What is the command in hping3 to perform a SYN scan on port 20-50?

Back 40

hping3 -8 20-50 -s {IP Address} -v

Front 41

What is the command in hping3 to perform a FIN, PSH and URG scan on port 80?

Back 41

hping3 -F -p -U {IP Address} -p 80

Front 42

What is the command in hping3 to scan an entire subnet for a live host?

Back 42

hping3 -1 10.0.0.x --rand-dest -I eth0

Front 43

What is the command in hping3 to intercept all traffic containing HTTP signature?

Back 43

hping3 -9 HTTP -I eth0

Front 44

Using half open scanning, if a a client sends a SYN packet to a server and the server responds with a RST packet, is the port open or closed?

Back 44

Closed

Front 45

Using half open scanning, if a a client sends a SYN packet to a server and the server responds with a SYN/ACK packet, is the port open or closed?

Back 45

Open

Front 46

True or False: Using an XMAS Tree scan against Windows 7 is a good way to determine open port information?

Back 46

False: XMAS tree scans do not work against any current version of MS Windows.

Front 47

In an XMAS Tree scan what flags in the TCP frame are set?

Back 47

URG, ACK, RST, SYN, FIN

Front 48

In an XMAS tree scan if the remote device responds with a RST packet, is the port open or closed?

Back 48

closed

Front 49

What is the command string to perform an XMAS tree scan in NMAP?

Back 49

nmap -sX {IP Address}

Front 50

What is the command string to peform an NMAP FIN scan?

Back 50

nmap -sF {IP Address}