19Xxx19 Sec+

Front 1

A network authentication protocol in a Microsoft Windows Active Directory domain or a Unix realm. It uses a database of objects such as Active Directory and a KDC (or TGT server) to issue timestamped tickets that expire after a certain time period.

Back 1

Kerberos

(TCP/UDP 88)

Front 2

Based on an earlier version of X.500, Windows Active Directory domains and Unix realms use this to identify objects in query strings with codes such as CN=Users and DC=GetCertifiedGetAhead, The secure version uses SSL or TLS to encrypt transmission.

Back 2

Lightweight Directory Access Protocol (LDAP)

Secure LDAP

LDAPv2 uses SSL

LDAPv3 uses TLS

(TCP/UDP 389)

Front 3

Enhances security by requiring users to use and remember only one set of credentials for authentication. Once signed on, this one set of credentials is used throughout a users's entire session. This can provide central authentication against a federated database for different operating systems.

Back 3

Single Sign On (SSO)

Front 4

Users have to reenter their credentials each time they access another system. However, they use the same credentials.

Back 4

Same Sign-on

(Not the same as SSO)

Front 5

An indirect trust relationship. In an LDAP-based network, domains use this for SSO.

Back 5

Transitive Trust

Front 6

Links a user's credentials from different networks or operating systems, but treats it as one identity. Provides central authentication in a non-homogeneous environment.

Back 6

Federated Identity Management System (Federation)

Front 7

An Extensible Markup Language (XML)-based standard used to exchange authentication and authorization information between different parties. Provides SSO for web-based applications.

Back 7

Security Assertion Markup Language (SAML)

Front 8

SAML defines 3 roles. What are they?

Back 8

-Principal; A typical user.

-Identity Provider; creates, maintains, manages identity info for principals.

-Service Provider; an entity that provides services to the principal.

Front 9

Provides access to an internal network from an outside source.

Back 9

Remote Access Service (RAS)

Front 10

This is a remote access authentication method that uses a password or a PIN. A significant weakness is that it sends the information across a network in cleartext, making it susceptible to sniffing attacks. It is used with Point-to-Point Protocol (PPP).

Back 10

Password Authentication Protocol (PAP)

Front 11

This is a remote access authentication method also uses PPP and authenticates users, but it is more secure than PAP. The goal of this is to allow the client to pass credentials over a public network without allowing attackers to intercept the data and later use it in an attack. Uses a shared secret in the authentication process; Uses hashing of a nonce (number used once).

Back 11

Challenge Handshake Authentication Protocol (CHAP)

Front 12

An improvement over CHAP with the ability to perform mutual authentication, where client authenticates to the server and the server authenticates to the client before data is transmitted.

Back 12

Microsoft CHAP (MS-CHAP, MS-CHAPv2)

Front 13

A centralized authentication service. Instead of each individual RAS server needing a separate database to identify who can authenticate, authentication requests are forwarded to a central server. Encrypts only the password.

Back 13

Remote Authentication Dial-In User Service (RADIUS)

UDP 1812/1813

Front 14

An extension of RADIUS and many organizations have switched to Diameter as a replacement for RADIUS due to its extra capabilities. Also supports EAP, which significantly enhances its security, and also uses TCP instead of UDP.

Back 14

Diameter

Front 15

An older Cisco proprietary authentication protocol that is rarely used today. Most organizations use either RADIUS, DIAMETER, or TACACS+.

Back 15

XTACACS

Front 16

The Cisco alternative to RADIUS, and is a recommended replacement for XTACACS. Can be used for authentication with routers and other network devices. The benefit over RADIUS is that it encrypts the entire authentication process.

Back 16

TACACS+

Front 17

Provides authentication, authorization, and accounting. Authentication verifies a user's identification. Authorization determines if a user should have access. Accounting tracks users access with logs. RADIUS, TACACS+ are examples of this protocol.

Back 17

AAA Protocols

Front 18

A server that is left open or appears to have been sloppily locked down, allowing an attacker relative easy access. Then intent is divert the attacker from the live network and observe the attack and learn from the attacker's methodologies.

Back 18

Honeypot

Front 19

A group of virtual servers contained within a single physical server. It mimics the functionality of a live network. An attacker looking in will not be able to determine if the servers are physical or virtual.

Back 19

Honeynets

Front 20

The most commonly used wireless antenna on both WAPs and wireless devices. It transmits and receives signals in all directions at the same time.

Back 20

Omnidirectional Antenna

Front 21

This type of antenna transmits in a single direction and receives signals back form the same direction. Has greater gain than an omni antenna because the power is focused in a single direction, and can transmit and receive signals over greater distances.

Back 21

Directional Antenna

Front 22

A theoretical concept where an antenna has a perfect three-dimensional radiation pattern of 360 degrees vertically and horizontally. Other antennas attempt to mimic this antenna.

Back 22

Isotropic Antenna

Front 23

Is an actual antenna. Assuming the antenna is standing vertically, it has a radiation pattern of 360 degrees horizontally, and about 75 degrees vertically. Most omnidirectional antennas used in wireless networks are a type of this antenna.

Back 23

Dipole Antenna

Front 24

A common type of directional antenna. This antenna typically uses a dipole, folded dipole, or half-wave dipole combined with additional elements such as a reflector or director element. Focus antenna in a single direction while also increasing the gain and reducing the radiation pattern.

Back 24

Yagi Antenna

Front 25

Was the original security protocol used to secure wireless networks. The goal was to provide the same level of privacy and security as wired network. Due to the widely published vulnerabilities, IEEE deprecated the use of this in 2004.

Back 25

Wired Equivalent Privacy (WEP)

Front 26

An interim replacement for WEP and originally used TKIP and RC4, which was compatible with older hardware.

Back 26

Wi-Fi Protected Access (WPA)

Front 27

The permanent replacement for WEP and WPA. Also known as 802.11i, uses stronger cryptography than both WEP and WPA with the use of CCMP (based on AES), which is much stronger than the older TKIP protocol.

Back 27

Wi-Fi Protected Access II (WPA2)

Front 28

A wireless security protocol introduced to address the problems with WEP. It was used with WPA but has been deprecated. WPA2 with CCMP is recommended instead.

Back 28

Temporal Key Integrity Protocol (TKIP)

Front 29

An encryption protocol based on AES and used with WPA2 for wireless security. It is more secure than TKIP, which was used with the original release of WPA.

Back 29

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)

Front 30

Server integrated with a database of accounts and it provides port-based authentication by requiring users and devices to authenticate before granting them access to a network. Prevents roque devices from being able to access the network.

Back 30

IEEE 802.1X

Front 31

When used with WPA and WPA2 in personal mode, this allows users access to the wireless network anonymously with a preshared key (PSK).

Back 31

IEEE 802.1X

Front 32

When used with WPA and WPA2 in Enterprise mode, it forces users to authenticate with unique credentials before granting them access to the wireless network.

Back 32

IEEE 802.1X

Front 33

An authentication framework that provides general guidance for authentication methods. Provides two systems to create a secure encryption key, also known as a Pairwise Master Key (PMK). Systems then use this key to encrypt all data transmitted between the devices. Both TKIP and CCMP use this key.

Back 33

Extensible Authentication Protocol (EAS)

Front 34

Provides an extra layer of protection for EAP. Encapsulates and encrypts the EAP conversation in a TLS tunnel. Requires certificates on a server, but not the clients. A common implementation is with MS-CHAPv2.

Back 34

Protected EAP (PEAP)

Front 35

An extension of PEAP, allowing systems to use some older authentication methods such as PAP within a TLS tunnel. It requires a certificate on the 802.1X server but not the clients.

Back 35

EAP-Tunneled TLS (EAP-TTLS)

Front 36

One of the most secure EAP standards and is widely implemented. The primary difference from PEAP is that it requires certificates on the 802.1x server and on each of the wireless clients.

Back 36

EAP-TLS

Front 37

Cisco created this using a modified version of CHAP and does not require a digital certificate. Most wireless devices support this, but it is susceptible to a known attack. Cisco recommends using stronger protocols.

Back 37

Lightweight EAP (LEAP)

Front 38

Used to encrypt traffic for smaller wireless devices.

Back 38

Wireless Transport Layer Security (WTLS)

Front 39

A technical solution that forces clients using web browsers to complete a specific process before it allows them access to the network.

Back 39

Captive Portal

Front 40

The practice of looking for a wireless network. Attackers use this to discover wireless networks that they can exploit and often use directional antennas (cantennas) to detect wireless networks with weak signals.

Back 40

War Driving

Front 41

Attackers use packet injection techniques to add additional packets into the data stream. The WAP responds with more packets, increasing the probability that it will reuse a key. This also decreases the time it takes to crack a WEP to a very short time, sometimes less than a minute.

Back 41

Initialization Vector (IV) Attack

Front 42

This involves three steps; Use a wireless sniffer or protocol analyzer to capture a wireless packet, wait for a wireless client to authenticate, use a brute force attack. The key here is that the attacker must capture the four-way handshake.

Back 42

WPA Cracking Attack

Front 43

An attacker keeps trying different PINs until it succeeds. Reaver, an open source tool, allows attackers to discover the PIN within 10 hours, and often much quicker. Once the PIN is discovered, it can discover the passphrase in both WPA and WPA2 wireless networks.

Back 43

WPS Brute Force Attack

Front 44

A WAP placed within a network by someone with some type of attack in mind. Sometimes called counterfeit access points. May be connected to a network device in wireless closets that lack adequate physical security.

Back 44

Rogue Access Points

Front 45

An access point with the same SSID as a legitimate access point. An attacker can set up a WAP using the same SSID as the public Wi-Fi as a service and many users will unsuspectingly connect to it.

Back 45

Evil Twin

Front 46

Attackers can transmit noise or another radio signal on the same frequency used by a wireless network. This interferes with the wireless transmissions and can seriously degrade performance. A type of denial-of-service attack can prevent users from connecting to a wireless network.

Back 46

Jamming or Interference

Front 47

A group of standards used on mobile devices that allow them to communicate with other mobile devices when they are close to them. This includes Bluetooth Wireless system.

Back 47

Near Field Communication (NFC)

Front 48

The practice of sending unsolicited messages to nearby Bluetooth devices (images or sounds). Although relatively harmless, it can cause some confusion when users start receiving messages.

Back 48

Bluejacking

Front 49

Any unauthorized access to or theft of information from a Bluetooth connection. Can access information, such as email, contact lists, calendars, and text messages. Attackers use tools such as hcitool and obexftp.

Back 49

Bluesnarfing

Front 50

Allows an attacker to take over a mobile phone and can listen in on phone conversations, enables call forwarding, send messages, and more.

Back 50

Bluebugging

Front 51

What is the single best protection against attacks on Bluetooth devices?

Back 51

Turn off discovery mode

Front 52

An extension of telephony, allows users to make phone calls using a network connection with access to the internet, rather than traditional phone systems.

Back 52

Voice over Internet Protocol (VoIP)

Front 53

Uses telephone technologies including phones and modems. Both the client and server need access to phone lines, and each must have a modem. Allows the client to have access to a remote network over traditional phone wires.

Back 53

Dial-Up Remote Access Service (RAS)

Front 54

Which IPSec mode encrypts the entire IP packets, and is the mode used with VPNs.

Back 54

Tunnel Mode

Front 55

Which IPSec mode encrypts the payload within the IP packets and is used within private networks.

Back 55

Transport Mode

Front 56

Is a secure encryption protocol used with VPNs by providing security in two ways; authentication and encryption.

Back 56

Internet Protocol Security (IPSec)

Front 57

IPSec includes this to allow each of the hosts in the IPSec conversation to authenticate with each other before exchanging data. Provides authentication and integrity. Uses protocol ID number 51.

Back 57

Authentication Header (AH)

Front 58

IPSec includes this to encrypt data and provide confidentiality. Includes AH so it provides CIA. Uses protocol ID number 50.

Back 58

Encapsulating Security Payload (ESP)

Front 59

Cisco and Microsoft joined forces to create this. It doesn't include any encryption, so it does not provide confidentiality of data. You can combine IPSec with L2TP (L2TP/IPSec) to provide security for the VPN tunnel.

Back 59

Layer 2 Tunneling Protocol (L2TP)

Front 60

When do you use SSL or TLS to secure the VPN channel? As an example, Secure Socket Tunneling Protocol (SSTP) encrypts VPN traffic using SSL over port 443.

Back 60

When the VPN tunnel must go through a device using NAT, and IPSec is not feasible.

Front 61

Includes two VPN servers that act as gateways for two networks separated geographically. Connects both networks without requiring additional steps on the part of the user.

Back 61

Site-to-site VPN

Front 62

What includes methods (such as health agents) to inspect clients for health, such as having up-do-date antivirus software. Can restrict access of unhealthy clients to a remediation network. You can use this for clients and for internal clients.

Back 62

Network Access Control (NAC)

Front 63

Uses one or more techniques to make it difficult to reverse engineer. Common techniques include using complex code, using encryption, or hiding the location.

Back 63

Armored Virus

Front 64

What has the ability to morph or mutate when it replicates itself, or when it executes. The goal is to create a virus or other malware with enough variations that AV software cannot detect it as the same malware. Over time, a single malware file could have thousands of variants.

Back 64

Polymorphic Malware

Front 65

A string of code embedded into an application or script that will execute in response to an event. The event may be a specific date or time, when a user launches a specific program, or any event the programmer decides on.

Back 65

Logic Bombs

Front 66

Provides another way of accessing a system. Many types of malware create this, allowing attackers to access systems from remote locations. Employees have also created backdoors in applications and systems.

Back 66

Backdoor

Front 67

Appears to be something useful but includes a malicious component, such as installing a backdoor o a user's system. Many are delivered via drive-by downloads. They can also infect systems with rogueware, pirated software, games, or infected USB drives.

Back 67

Trojans

Front 68

Includes multiple computers that act as software robots and function together in a network (such as the Internet), often for malicious purposes. Computers in this are called zombies and they do the bidding of whoever is in control of this network.

Back 68

Botnets

Front 69

A specific type of Trojan attack where attackers take control of the user's computer and then demand the user pay a ransom to get the control back.

Back 69

Ransomware

Front 70

A type of Ransomware virus, accuses users of being involved in illegal activities and demands they pay a fine. Often displays a notification from a law enforcement agency such as the US FBI.

Back 70

The Police Virus

Front 71

Doesn't try to trick the user, but instead uses basic kidnapping and ransom tactics by taking control of valuable user files. Encrypts valuable user files, such as photos, videos, and text documents, then demands the user pay a ransom.

Back 71

CryptoLocker

Front 72

A group of programs that hides the fact that the system has been infected or compromised by malicious code. System-level or kernel-level access and can modify system files and system access. Hide their running processes to avoid detection with hooking techniques.

Back 72

Rootkits

Front 73

A link included in the email that links to an image stored on an Internet server. The link includes unique code that identifies the receiver's email address.

Back 73

Beacon

Front 74

A targeted form of phishing. Instead of sending the email out to everyone indiscriminately, the attacker attempts to target specific groups of users, or even a single user.

Back 74

Spear Phishing

Front 75

A form of span using instant messaging (IM) and targets IM users. Sometimes trying to impersonate a user's friend and encourages the victim to click on a link.

Back 75

Spim

Front 76

Attacks use the phone system to trick users into giving up personal and financial information. Often using VoIP technologies to trick the user similar to phishing attacks. Attackers can spoof caller ID when using VoIP, making it appear that the call came from a real company.

Back 76

Vishing

Front 77

What is the most effective protection against unwanted adware in web browsers?

Back 77

Pop-up Blockers

Front 78

What is a vulnerability or bug that is unknown to trusted sources, such as operating systems and antivirus vendors? Operating system vendors write and release patches once they know about them, but until the vendors know about them, the vulnerability remains.

Back 78

Zero-Day

Front 79

What are all the different types of spoofing?

Back 79

IP, MAC, and Email

Front 80

An attack from two or more computers against a single target. These attacks often include sustained, abnormally high network traffic on the network interface card of the attacked computer. The goal is to prevent legitimate users from accessing services on the target computer.

Back 80

Distributed Denial-of-Service (DOS) Attack

Front 81

This attack spoofs the source address of a directed broadcast ping packet to a flood a victim with ping replies. The attacker sends a directed broadcast ping through a router into another network, spoofing the source IP address with the victim's address instead.

Back 81

Smurf Attack

Front 82

A common attack used against servers on the internet. They are easy for attackers to launch, difficult to stop, and can cause significant problems by disrupting the TCP handshake process and can prevent legitimate clients from connecting. The attacker sends a barrage of SYN packets, leaving the server with multiple half-open connections.

Back 82

SYN Flood Attack

Front 83

Many firewalls and intrusion detection systems include these, which are simply techniques to limit the success of a SYN flood attacks. They can block all traffic from the attacking IP, but attackers can still spoof the source IP address and launch attacks from multiple systems at the same time making it difficult to identify legitimate traffic.

Back 83

Flood Guards

Front 84

A type of port scan used to identify underlying details of an operating system. It has several bits set in the packet header and is reminiscent of lights. This attack sets specific flags within the TCP packet header. Different op systems respond in different ways, attackers analyze the response to determine the op system, sometimes they can even determine the version.

Back 84

Xmas Attack (Christmas Tree)

Front 85

A form of active interception or active eavesdropping. It uses a separate computer that accepts traffic from each party in a conversation and forwards traffic between the two. The two computers are unaware of the attacking computer, and it can interrupt the traffic at will or insert malicious code.

Back 85

Man-in-the-Middle Attacks

Front 86

This attack captures data in a session with the intent of later impersonating one of the parties in the session. Can occur on both wired and wireless networks. Timestamps and sequence numbers are effective countermeasures against this attack.

Back 86

Replay attacks

Front 87

This attack attempts to discover passwords from an online system. An attacker trying to log on to an account by trying to guess the user's password.

Back 87

Online Password Attack

Front 88

This attack attempts to discover passwords from a captured database or captured packet scan.

Back 88

Offline Password Attack

Front 89

This attack attempts to guess all possible character combinations. One of the best protections against this attack is to use complex passwords with sufficient length, and to use account lockout policies.

Back 89

Brute Force Attack

Front 90

This attack uses a dictionary of words and just attempts to use every word in the dictionary to see if it works. Easily thwarted by complex passwords.

Back 90

Dictionary Attack

Front 91

Attacks the hash of a password instead of passwords.

Back 91

Hash attack

Front 92

An attacker is able to create a password that produces the same hash as the actual user's password. Named after a mathematical paradox. This attack can be thwarted by increasing the number of bits used in the hash to increase the number of possible hashes.

Back 92

Birthday Attack

Front 93

This occurs when the hashing algorithm creates the same hash from different passwords.

Back 93

Hash Collision

Front 94

This is a type of attack that attempts to discover the password from the hash. They use a special table, huge databases storing pre-calculated passwords and their hashes. They include hashes for every possible combination.

Back 94

Rainbow Table Attack

Front 95

Attacks that use a combination of two or more attacks to crack a password.

Back 95

Hybrid Attack

Front 96

Attempts to modify or corrupt DNS results by modifying the IP address associated with a website and replacing it with the IP address of a malicious web site. Many current servers use Domain Name System Security Extensions (DNSSEC) to protect the DNS records and prevent these attacks.

Back 96

DNS Poisoning

Front 97

Another attack type of attack that manipulates the DNS name resolution process. It either tries corrupt the DNS server or the DNS client. They redirect the user to a different website. They do so by modifying the client's host file used on Windows Systems.

Back 97

Pharming Attacks

Front 98

An attack that misleads computers or switches about the actual MAC address of a system. These attacks can easily create ARP reply packets with spoofed or bogus MAC addresses, and poison the ARP cache on systems in the network.

Back 98

ARP Poisoning Attacks

Front 99

Can redirect network traffic, and in some cases insert malicious code. Instead of traffic going through the switch directly to the router, it is redirected to the attacker after poisoning the ARP cache of the victim.

Back 99

ARP Man-in-the-Middle Attack

Front 100

An attacker sends an ARP reply with a bogus MAC address for the default gateway. The default gateway is the IP address of a router connection that provides a path out of the network. If all of the computers cache a bogus MAC address for the default gateway, none of them can reach it, and it stops all traffic coming out of the network.

Back 100

ARP DoS Attack

Front 101

This occurs when someone buys a domain name that is close to a legitimate domain name, often for malicious purposes.

Back 101

Typo Squatting/URL Hijacking

Front 102

Attempts to discover which web sites employees are likely to visit and then infects those web sites with malware that can infect the visitors.

Back 102

Watering Hole Attacks

Front 103

A text file stored on a user's computer and used for multiple purposes, including tracking a user's activity. Places advertisements based on previous searches or purchases. Some web developers store sensitive data, such as usernames or passwords.

Back 103

Cookies

Front 104

The attacker learns the user's session ID and uses it to impersonate the user. This is possible when users only close the browser without logging off, because cookies stored on the user's system remain active until the user logs off.

Back 104

Session Hijacking Attacks

Front 105

A cookie created by Adobe and is different from a traditional cookie. They are also known as LSOs or locally shared objects. If cookies are deleted, this recreates them without the user's knowledge or consent.

Back 105

Flash Cookies or Locally Shared Objects (LSOs)

Front 106

Refers to the ability of an attacker to execute commands or run programs on a target machine.

Back 106

Arbitrary Code Execution

Front 107

Refers to the ability of an attacker to execute code from a remote system.

Back 107

Remote Code Execution

Front 108

This attack can manipulate the flags within the headers to modify behavior, in some cases, the attacker modifies data within the packet, such as the session ID. If the web browser uses the session ID to log the user on automatically, it gives the attacker access to the user's account.

Back 108

Header Manipulation Attack

Front 109

This protects against many attacks, such as buffer overflow, SQL injection, and cross-site scripting attacks by verifying the validity of inputted data before using it, and server-side validation is more secure than client-side validation.

Back 109

Input Validation

Front 110

This is when two or more modules of an application, or two or more applications, attempt to access a resource at the same time, it can cause a conflict.

Back 110

Race Condition

Front 111

This helps protect the integrity of the operating system and controls the errors shown to users. They ensure that an application can handle an error gracefully. When the application doesn't catch an error, it can cause the application to fail.

Back 111

Error and Exception Handling

Front 112

This occurs when an application receives more input, or different input, than it expects. This result is an error that exposes system memory that would otherwise be protected and inaccessible.

Back 112

Buffer Overflow

Front 113

This attack often includes no operation (NOP) instructions followed by malicious code. When successful, the attack causes the system to execute malicious code to cause a buffer overflow to crash the system or disrupt its services, it is a DoS Attack. Input validation helps prevent these attacks.

Back 113

Buffer Overflow Attacks

Front 114

This attack attempts to create a numeric value that is too big for an application to handle. In some situations, the application expects a positive number, but receives a negative instead. This is a problem if the application doesn't have proper error-handling and exception-handling routines.

Back 114

Integer Overflow

Front 115

This is used to communicate with databases. Many web sites use its statements to interact with a database providing the users with dynamic content.

Back 115

Structured Query Language (SQL)

Front 116

This attack starts by sending improperly formatted statements to the system to generate errors and pass queries to back-end databases through web servers. Many attacks use the phrase ' or '1'='1' to trick the database server in to providing information. Input validation and stored proper procedures reduce the risk of these attacks.

Back 116

SQL Injection

Front 117

If an application accepts XML data without input validation and without stored procedures, it is susceptible to an XML injection attack similar to a SQL injection. Additional data creates XPath statements to retrieve or modify data.

Back 117

XML Injection

Front 118

These typically hold one or more of the following types of data: documents, key value pairs, or graphs. This give developers much more flexibility in how they can store and query data. They are still susceptible to SQL Injection Attacks if input validation techniques are not implemented.

Back 118

NoSQL Databases

Front 119

Attackers embed malicious HTML or JavaScript code into an email or web site error message. If a user responds to the email or error message, it executes the code. They can redirect users to other websites and steal the user's cookies, passwords from their cache. The primary protection against this attack is to block the use of HTML tags and JavaScript tags.

Back 119

Cross-Site Scripting (XSS)

Front 120

An attack where an attacker tricks a user into performing an action on a web site such as making purchases without their knowledge. The attacker creates a specially crafted HTML link the user follows. Dual authentication and forcing the user to manually enter credentials is one way to stop these attacks or expire the cookie after a short period of time.

Back 120

Cross-Site Request Forgery (XSRF)

Front 121

Attackers are able to inject operating system commands into an application using web page forms or text boxes. Any web page that accepts input from users is a potential threat. This attack attempts to access a file by including the full directory path, or traversing the directory structure. Input validation can prevent these attacks.

Back 121

Directory Traversal/Command Injection

Front 122

This attack queries and modifies account data in Active Directory services

Back 122

LDAP Injection

Front 123

This attack uses an application on the client computer, such as a web browser.

Back 123

Client-Side Attack

Front 124

This attack attempts to access a back-end server through another server.

Back 124

Transitive Access Attack

Front 125

This sends random strings of data to applications looking for vulnerabilities. Administrators use this to test applications and attackers use this to detect attack methods.

Back 125

Fuzzing