Fichas
Ethical Hacking Final flashcards
Fichas del conjunto (63)
- 1What is the goal of hacking?- To obtain passwords, active usernames, and the highest level of permissions.
- 2What do you need to successfully hack a system?- Identify various password cracking techniques and tools.
- Understand escalation of privilege.
- Understand how to hide files, cover tracks, perform steganography, and erase evidence. - 3Characteristics of a strong password.Strong passwords must not contain the username, have a minimum of 8 characters, and contain a mix of special characters, numbers, upper and lower case letters.
- 4What are the four types of password attacks?- Passive Online
- Active Online
- Offline
- Non-electronic - 5Passive Online Attacks- Also known as sniffing and are not detectable by the end user. The password is captured during the authentication process and then compared against a word list or dictionary file.
- Two types of passive attacks MITM and Replay attack. - 6Man-in-the-middle- Sniff traffic between client and server.
- Intercept authentication requests.
- Forwards request to server. - 7Replay Attack- Intercepts password on the way to the server.
- Resend authentication packets. - 8Password sniffing tools- L0phtcrack
- KerbCrack
- Cain & Abel - 9Active Online Attacks- The easiest way to gain access is to guess a simple password. Password guessing can be done by creating a null share.
- Attackers run scripts using the NET USE command to hit many targets at once. A drawback of this is that it can cause a DoS if lockout policies exist. - 10Automated password guessing tools.- Legion
- NetBIOS Auditing Tool - 11Offline AttacksOffline attacks are performed from a different location than the target system that holds the passwords. This requires physical access to the target system so we can copy the files and crack them elsewhere.
- 124 types of offline attacks- Dictionary
- Hybrid
- Brute-force
- Rainbow Table - 13Dictionary attack- A dictionary attack uses passwords from a list of dictionary words. The password is hashed and then compared against the user account password file. The only works if the password is a list of dictionary words.
- 14Hybrid attack- Substitutes or adds numbers/symbols for password characters.
- 15Brute-force attack- Tries all possible combinations of letters, numbers, and special characters. It's the slowest type of attack but it will always find the password if given enough time.
- 16Rainbow table attack- Similar to a dictionary attack except the words in the list have already been hashed so the account password hash is simply looked up from the list off hashed passwords.
- 17Non-electronic attack- Does not employ any technical knowledge. Examples include social engineering, shoulder surfing, keyboard sniffing, dumpster diving, and coercion.
- 18Password Cracking- Passwords are stored and transmitted in an encrypted form called a hash. In Windows, passwords are stored in the Security Accounts Manager (SAM) file. In Linux, passwords are stored in a shadow file.
- Prior to Windows NT 4.0 SP4, windows supported two types of Challenge/Response, Lan Manager (LM) and NTLM.
- LM has been replaced with NTLMv2 which has 128 bits of key space, Windows 2000 SP2 and later allow the disabling of LAN manager. - 19LAN Manager- Lan Manager is not case sensitive and converts all password characters to uppercase, and all passwords are stored as two 7 character hashes. If the password is less than 14 characters long padding is added. Passwords longer than 14 characters will be stored using NTLM, which uses all 14 characters and allows upper and lowercase letters.
- 20SAM filesIn Windows NT/2000/2003 contained the usernames and encrypted passwords and are located in the %systemroot%\system32\config folder. The file is locked when the system is running and starting with WINNT SP3 a second layer of 128-bit encryption was added called SYSKEY.
- A copy of the SAM file can be grabbed from the c:\windows\repair directory. PWDump and FGDump can be used to extra the SAM file on a running system. - 21Password cracking tools- John the Ripper
- Brutus
- Ophcrack
- RainbowCrack
- Pwdump - 22Password Cracking Countermeasures- Use a strong password
- Physically isolate the server
- Use SYSKEY
- Monitor logs for brute-force attempts
- Don't use default passwords
- Don't use dictionary words
- Make password unrelated to username or any personal info
- Force password changes
- Use a passphrase - 23SMB Logon- Another way to discover passwords is to redirect the SMB logon, tricking the victim into attempting windows authentication on your computer. Often done by sending the victim an email with an embedded link to a fake SMB server.
- 24Tools for redirecting SMB logon- SMBRelay
- SMBRelay2
- Pwdump2, fgdump, samdump
- C2MYAZZ
- SMBDie - 25SMB logon countermeasures- Use SMB signing.
- 26NetBIOS DoS Attack- Involves sending a NetBIOS Name Release message to the the NetBIOS service which forces the system to place its name in conflict and can no longer communicate on the network.
- NBName is a tool that can disable an entire LAN and prevent machines from rejoining by making systems think their name is already in use. - 27Keyloggers and Spyware- Keystroke loggers intercept the targets keystrokes and stores/transmits them to be read later. There are two types of keyloggers, hardware and software. Hardware loggers required physical access and are difficult to detect. Software loggers are installed directly on the system and are typically part of a trojan.
- 28Keylogger tools- Spector
- eBlaster
- SpyAnywhere
- Remote Spy - 29Privilege Escalation- Administrator accounts and passwords often cannot be obtained, so we will have to settle with accessing a normal user account and escalating the privileges for it. Privilege escalation tools must be executed on the normal machine, although some can be used remotely.
- 30Privilege Escalation Tools- GetAdmin.exe
- Hk.exe
- BillyBastard
- Getad - 31Buffer Overflows- Buffer overflows exploit a flaw in apps code where too much data is sent into a field or variable which overwrites areas in the system's RAM. The app either executes a command in the overflow data or displays a command prompt.
- 32Rootkits- Rootkits allow a hacker to access the victims machine at a later time. Rootkits are a collection of software tools that a hacker uses to obtain admin access. They can also monitor traffic, keystrokes, create backdoors, alter log files, attack other systems, and alter existing tools to avoid detection.
- 33Types of Rootkits- Kernel-level
- Library-level
- Application-level - 34Kernel-level rootkit- Kernel-level rootkits add and/or replace portions of the kernel code to hide the attackers activity. Often done through a device driver or module and are very hard to detect.
- 35Library-level rootkit- Library-level rootkits patch or replace system calls with malicious versions.
- 36Application-level root kits- Replace regular app binaries with trojanized ones.
- 37Rootkit Countermeasures- Backup critical data
- Delete the partition
- Reinstall the OS or App from a trusted source
- Scan the backed up data
- Place the data back on the system - 38Hiding Files- There are two ways of hiding files in Windows: File attributes and NTFS Alternate Data Streaming (ADS). ADS allows a hidden file to be created within another file and prevent it from showing up in the directory listings.
- 39Steganography- The process of hiding data in other types of data such as images or text files. Most common method is hiding data in graphic images.
- Tools:
1. ImageHide
2. Blindside
3. MP3Stego - 40Covering Tracks- Disable Auditing
- Clear the Event Log - 41Trojans and Backdoors- A trojan is a program that performs functions unwanted by the target. There are three accepted definitions.
1. An unauthorized program contained within a legitimate program that performs functions unknown and unwanted by the user.
2. A legitimate program that has been altered by the placement of unauthorized code within it and that performs functions unknown and unwanted by the user.
3. Any program that appears to perform a desirable and necessary function but that, because of hidden and unauthorized code, perform functions unknown and unwanted by the user.
- A backdoor allows remote access to the system and allows the attack to bypass normal authentication. - 42Trojan types- Remote Access Trojan (RAT)
- Keystroke logger
- Software detection killers
- Service denying
- FTP - 43Trojan Attack Vectors- Email and attachments
- Deception and Social Engineering
- Web bugs and driveby downloads
- NetBIOS remote plants
- Physical Access
- Web pages
- P2P networks - 44Trojan tools and creation kits- Tini
- QAZ
- Donald Dick
- NetBus
- Back Oriface 2000 - 45Wrappers- A program used to combine two or more executables into a single program. It attaches a harmless executable to a trojans payload and when the executable is run the trojan is launched.
- 46Wrapper programs- ELiTeWrap
- Silk Rope - 47Port Redirection- Port redirection is when you listen on a preconfigured port and then redirect all packets to a secondary destination.
- 48Port Redirection tools- Netcat
- Reverse telnet
- Datapipe - 49Anti-Trojan Software and Countermeasures- Educate users and develop effective policies
- Cleaner
- Windows File Protection (WFP)
- Tripwire
- Fport
- TCPView - 50Sniffers- A sniffer is a piece of software that captures packets going in and out of a computer. They are commonly used to gather login credentials and MAC flooding and ARP spoofing are common attacks performed.
- Passive sniffing requires a hub or network tap and only the packets that pass through hubs or tabs are captured. Active sniffing involves routing traffic through the attackers computer. MAC flooding and ARP spoofing are two methods of active sniffing. - 51Sniffing Tools- Snort
- Dsniff
- Wireshark - 52Arp Spoofing/Poisoning- Attacker configures IP forwarding on their PC
- Sends a fake ARP response to change the default gateways IP to the attackers IP on the victims ARP table
- Victims packets are forwarded through the attackers PC and gets captured and forwarded - 53ARP Poisoning Tools- Ettercap
Cain - 54MAC Flooding- The attempt of overloading a switches content addressable memory (CAM) table. If the CAM table becomes full the switch often fails open and all frames flood out all ports. This may draw attention as overall network performance decreases.
- 55MAC flooding tools- Etherflood
- Macof - 56DNS Spoofing/Poisoning- The process of distributing incorrect IP address information for a specific host with the intent to divert traffic from its real destination.
- 57Security Audit and Vulnerability Assessment- This involves scanning network and hosts for security weakness. This involves:
1. Locating live systems
2. Enumerating users
3. Identifying OS and applications
4. Looking for config errors
5. Looking for known and unknown vulnerabilities - 58Three pen test phases- Pre-Attack
- Attack
- Post-Attack - 59Pre-attack phase- Involves reconnaisance
- 60Attack phase- Penetrate the network
- Gain access to the target
- Test security policies
- Escalate privileges
- Execute, Implant, and retract attacks/exploits - 61Post-Attack- Involves restoring the system to normal pretest configurations.
- 62Automated Pen Test Tools- Nessus
- GFI LANguard
- Retina
- CORE IMPACT
- Metasploit - 63Pen test format report- A list of finding ranked highest to lowest
- Analysis of findings
- Explanation of findings
- Remediation measures
- Log Files
- Names of testers
- Date of test
- Positive findings and negative findings
Información
- Descripción
- Ethical Hacking Fichas sobre Ethical Hacking Final flashcards, creado por Jose Peralta el 12/12/2017.
- Creado por
- Jose Peralta
- Visitas
- 0
- Valoración