Ethical Hacking Final Part 4
Session hijacking can be thwarted with which of the following?
Authentication
What is a covert channel?
A backdoor
When an attacker computer tells a network the IP address of bigbank.com is an illigitimate address, that is a form of what attack?
IP Spoofing Attack
What phase of a virus is when it is replicating iteself?
Propogation Phase
XSS is typically targeted toward which of the following?
Web Browsers
What is NOT a benefit of hardware keyloggers?
Difficult to Install
A virus does NOT do which of the following?
Display pop-ups
Which protocols below can be sniffed and "read" without additional processing/analyzing?
HTTP, DNS, DHCP, FTP, anything not secure
An ethical hacker sends a packet with a deliberate and specific path to its destination. What technique is the hacker using?
IP Spoofing
Jennifer has been working with sniffing and session hijacking toolson her company network. Since she wants to stay white hat - that is ethical - she has gotten permission to undertake these activities. What would Jennifer's activites be categorized as?
Passive
What are worms typically known for?
Rapid Replication across a network
A man-in-the-browser attack is typically enabled by using which mechanism?
Trojans
A public use workstation contains the browsing history of multiple users who logged in during the lsat seven days. While digging through the history, a user runs across the following web address: www.snaz22enu.com/&w25/session=22525. What kind of embedding are you seeing?
URL Embedding
Malicious code triggered by user action is an example of what?
Virus, Trojan
Which is/are a characteristic of a virus?
Viruses are malware, can replicate on it's own or with user interaction, can run silently
A Trojan relies on ______ to be activated.
Vulnerabilities
Session fixation is a vulnerability in which of the following?
Web Apps
A self-replicating, self-propagating, self-contained program that uses networking mechanisms to spread itself is a?
Worm
Conficker is an example of which malware?
Worm
Session hijacking can be performed on all of the following protocols except which one?
IPSec
Which technology can provide protection against session hijacking?
IPSec
Which malware is named after ancient Greek history?
Trojans
A logic bomb has how many parts, typically?
Two
When Computer B tells Computer A, "I have that MAC. My IP address is [what it is]" is an example of what?
ARP Reply
Malware is code that has an adverse impact on which of the following?
Confidentiality, Integrity, Availability
A session hijack can be initiated from all of the following except which one?
Devices
A remote access Trojan would be used to do all of the following except _____
Sniff traffic
Network level hijacking focuses on the mechanics of a connection such as the manipulation of packet sequencing. What is the main focus of web app session hijacking?
Stealing Session IDs
Which of the following is NOT a trojan?
TCPTrojan
Which utility will tell you in real time which ports are listening or in another state?
TCPView
A logic bomb is activated by which of the following?
Time, Date, Actions, Events
When using Meterpreter, what command provides you with the Windows Password store?
hashdump
What command is used to listen to open ports with netstat?
nestat -an
Which of the following is capable of port redirection?
netcat
Jennifer is a junior system administrator for a small firm of 50 employees. For the lst week a few users have been complaining of losing connectivity intermittently with no suspect behavior on their part such as large downloads or intensive processes. Jennifer runs wireshark on Monday morning to investigate. She sees a large amout of ARP broadcasts being sent at a fairly constant rate. What is Jennifer most likely seeing?
ARP Poisoning
When Computer A asks the network, "Who has this IP address?" is an example of what?
ARP Request
A MITM attack depends on which of the following successful attacks to be completed first?
ARP or DNS Poisoning
What phase of a virus is when it performs its malicious action or payload?
Action Phase
What form of malware can track browsing or buying habits?
Adware
A covert channel or backdoor may be detected using all of the following except _________
An SDK
An overt channel is _______
An obvious, defined method of using a system
Which of the following is not a source of session IDs?
Anonymous Logon
What is the name of the Graphical Front End to Metasploit?
Armitage
Julie has sniffed an ample amount of traffic between the targeted victim and an authenticated resource. She has been able to correctly guess the packet sequence numbers and inject packets, but she is unable to receive any of the responses. What does this scenario define?
Blind Hijacking
A polymorphic virus _______
Evades detection by altering it's own code
Session hijacking can do all of the following except which one?
Take over an authenticated session
A Trojan can include which of the following?
Remote Access Trojan (RAT)
When a logical condition causes a virus to move from a dormant or propagation phase is which phase?
Triggering phase
A sparse infector virus _______
Infects files selectively
A man-in-the-middle attack is an attack where the attacking party does which of the following?
Inserts themselves in the middle of an active session
Which statement(s) defines malware most accurately?
Malware covers all malicious software
Which of the following is/are true of a worm?
Malware, can replicate on it's own or with user interaction across a network
In order to perform network sniffing, the network card needs to be put in which mode?
Monitor Mode
In order to perform network sniffing across "all" virtual networks on a switch, what type of port needs to be created on the switch?
Monitor Port, SPAN (Switched Port Analyzer) port
A session hijack can happen with which of the following?
Networks and Applications
Which kind of values is injected into a connection to the host machine in an effort to increment the sequence number in a predictable fashion?
Null
What malware modified an operating system to hide the existence of itself or other malware?
Rootkit
Which statement defines session hijacking most accurately?
Session hijacking is an attack that aims at stealing a legitimate session and posing as that user while communicating with the web resource or host machine.
What form of malware can track user data such as keystrokes or screen capture?
Spyware
A sender starts with an innocuous image but adjusts ever 100th pixel to correspond to a letter in the alphabet is an example of what?
Steganograph