Comptia Security+ Chapter 3 Application And Networking-Based Attacks

Front 1

ActiveX

Back 1

A set of rules for how applications under the Microsoft Windows operating system should share information

Front 2

Buffer overflow attack

Back 2

An attack that occurs when a process attempts to store data in RAM beyond the boundaries of a fixedlength storage buffer

Front 3

Command injection

Back 3

Injecting and executing commands to execute on a server.

Front 4

Denial of Service

Back 4

An attack that attempts to prevent a system from performing its normal functions by overwhelming the system with requests

Front 5

Directory Traversal attack

Back 5

An attack that takes advantage of a vulnerability so that a user can move from the root directory to restricted directories

Front 6

DNS cache poisoning

Back 6

AnattackthatsubstitutesDNSaddressessothatthe computerisautomaticallyredirectedtoanattacker’sdevice

Front 7

Drive-by download attack

Back 7

results in a user’s computer becoming compromised
just by viewing a webpage and not even clicking on any content. This type of attack,
known as a drive-by download, is a serious threat. Attackers first identify a vulnerable
web server and inject content by exploiting the server through vulnerable scripting applications.

Front 8

Flash cookie

Back 8

Another name for locally shared object (LSO)

Front 9

Session Hijacking

Back 9

is an attack in which an attacker attempts to impersonate the user by using
her session token.

Front 10

Host Table

Back 10

A list of the mappings of host names to IP addresses

Front 11

How can you erase an entire SQL database table?

Back 11

whatever’; DROP TABLE members; --

Front 12

How do you control where users can go on your website?

Back 12

?

Front 13

HTTP Header

Back 13

Part of HTTP that is comprised of fields that contain the different characteristics of the data that is being transmitted.

Front 14

Microsoft IIS

Back 14

Microsoft's web server (Make your own webpage) Can be turned on in "Turn on/off windows features"

Front 15

Passive man-in-the-middle

Back 15

the attacker captures

the data that is being transmitted, records it, and then sends it on to the original recipient

without the attacker’s presence being detected.

Front 16

Privilege Escalation

Back 16

An attack that exploits a vulnerability in software to gain access to resources that the user normally would be restricted from accessing

Front 17

Replay

Back 17

An attack that makes a copy of the transmission before sending it to the recipient

Front 18

Session Hijacking

Back 18

An attack in which an attacker attempts to impersonate the user by using the user’s session token

Front 19

Session Token

Back 19

A form of verification used when accessing a secure web application.

Front 20

Smurf attack

Back 20

An attack that broadcasts a ping request to computers yet changes the address so that all responses are sent to the victim

Front 21

SQL Injection

Back 21

An attack that targets SQL servers by injecting commands to be manipulated by the database

Front 22

Syn flood attack

Back 22

An attack that takes advantage of the procedures for initiating a TCP/IP session

Front 23

What does ../ do in Linux? Why is it dangerous?

Back 23

Traverses up one directory level.

Could display the contents of a document

Front 24

What is ARP poisoning?

Back 24

An attack that corrupts the ARP cache

Front 25

What is significant about web-based attacks?

Back 25

is a serious threat. Attackers first identify a vulnerable

web server and inject content by exploiting the server through vulnerable scripting applications.

These vulnerabilities permit the attacker to gain direct access to the server’s

underlying operating system and then inject new content into the compromised website.

To avoid visual detection, the attackers often craft a zero-pixel IFrame

Front 26

whatever' OR full_name LIKE ‘%Mia%’

Back 26

Find specific users

Front 27

whatever; AND email IS NULL; --

Back 27

Determine the names of different fields in the

database

Front 28

XSS (Cross Site Scripting)

Back 28

XSS injects

scripts into a web application server to direct attacks at unsuspecting clients.