Ethical Hacking Module 12

Which of the following best describes the SQL Power Injector tool? An injection framework that can exploit SQL injection vulnerabilities on most databases. An injection tool that be can used for retrieving user and password hashes, fingerprinting, accessing a file system, and executing commands. A tool used for heavy queries to complete time-based blind SQL injection attacks. A tool used to find SQL injections on a web page.

A tool used to find SQL injections on a web page.

Which of the following best describes a phishing attack? This attack is used to intercept communications between an authorized user and the web server. In this attack, attackers use various weaknesses to hack into seemingly secure passwords. An attacker alters the XSS to run a Trojan horse with the victim's web browser. A user is tricked into believing that a legitimate website is requesting their login information.

A user is tricked into believing that a legitimate website is requesting their login information.

Which of the following HTTP response messages would you receive if additional action needs to be taken to complete the request? 1xx: Informational 4xx: Client Error 2xx: Success 3xx: Redirection

3xx: Redirection

Which of the following best describes a web application? Web applications require special administration because they involve updates on client computers. A web application is software that has been installed on a web server. A web application taxes the client's processor and storage space. Web applications need to be developed for every operating system.

A web application is software that has been installed on a web server.

Which of the following best describes Microsoft Internet Information Services (IIS)? A web server technology An email server technology A database server technology A name server technology

A web server technology

Which of the following is an open-source web server technology? Microsoft Internet Information Services (IIS) LightSpeed Web Server Nginx Apache Web Server

Apache Web Server

Which of the following is a password cracking tool that can make over 50 simultaneous target connections? Wfetch Brutus TCH-Hydra Metasploit

Brutus

HTTP headers can contain hidden parameters such as user-agent, host headers, accept, and referrer. Which of the following tool could you use to discover hidden parameters? WinDump Burp Suite Wikto Hackalert

Burp Suite

Frank wants to do a penetration test. He is looking for a tool that checks for vulnerabilities in web applications, network systems, wireless networks, mobile devices, and defense systems such as IDS or IPS. Which of the following tools would you recommend to him? Arachni Syhunt Dynamic COREImpact Pro Immunity CANVAS

COREImpact Pro

In 2011, Sony was targeted by an SQL injection attack that compromised over a million emails, usernames, and passwords. Which of the following could have prevented the attack? Using VPN technology to protect client data when connecting from a remote system. Scanning the operating system and application coding regularly for bugs and errors. Blocking, or at least monitoring, activity on ports 161 and 162. Careful configuration and penetration testing on the front end.

Careful configuration and penetration testing on the front end.

Which type of web application requires a separate application to be installed before you can use the app? Browser-based web app Mobile apps Server-based web app Client-based web app

Client-based web app

A hacker has used an SQL injection to deface a web page by inserting malicious content and altering the contents of the database. Which of the following did the hacker accomplish? Information disclosure Bypass authentication Compromise data integrity Compromise data availability

Compromise data integrity

Web applications use sessions to establish a connection and transfer sensitive information between a client and a server. Attacking an application's session management mechanisms can help you get around some of the authentication controls and allow you to use the permissions of more privileged application users. Which of the following type of attacks could you use to accomplish this? Hash stealing Buffer overflow Cookie parameter tampering Web script injection

Cookie parameter tampering

As a penetration tester, you have found there is no data validation being completed at the server, which could leave the web applications vulnerable to SQL injection attacks. Which of the following could you use to help defend against this vulnerability? Always use default error messaging. Be sure that the database server account is being run with maximum rights. Decline any entry that includes binary input, comment characters, or escape sequences. Use a higher privileged account for database connectivity.

Decline any entry that includes binary input, comment characters, or escape sequences.

The following are countermeasures you would take against a web application attack: Secure remote administration and connectivity testing Perform extensive input validation Configure the firewall to deny ICMP traffic Stop data processed by the attacker from being executed. Which of the following attacks would these countermeasures prevent? Directory traversal DoS attacks XSS attacks Web services attack

DoS attacks

Gathering information about a system, its components, and how they work together is known as ________? Footprinting Attacking Spoofing Analyzing

Footprinting

You are looking for a web server security tool that will detect hidden malware in websites and advertisements. Which of the following security tools would you most likely use? Wikto Syhunt Dynamic Hackalert MBSA

Hackalert

An attacker is attempting to connect to a database using a web application system account instead of user-provided credentials. Which of the following methods is the attacker attempting to use? Cookie exploitation Password attacks Cookie parameter tampering Hijacking web credentials

Hijacking web credentials

Which of the following functions does a single quote (') perform in an SQL injection? Indicates that the comment has ended and data is being entered. Indicates that data has ended and a command is beginning. Indicates that everything after the single quote is a comment. Indicates that code is ending and a comment is being entered.

Indicates that data has ended and a command is beginning.

Which of the following web server countermeasures is implemented to fix known vulnerabilities, eliminate bugs, and improve performance? Install patches and updates. Perform a vulnerability scan. Remove inactive accounts. Disable the directory listing option.

Install patches and updates.

There are several types of signature evasion techniques. Which of the following best describes the obfuscated codes technique? Code can be used to represent an SQL query. Inserts in-line comments between SQL keywords. Is an SQL statement that is hard to read and understand. Uses the CHAR function to represent a character.

Is an SQL statement that is hard to read and understand.

The SQL injection methodology has four parts. Which of the following parts is similar to playing the game 20 questions? Test for SQL injection vulnerabilities Information gathering Advanced SQL injection Launch a SQL attack

Launch a SQL attack

Which of the following best describes the countermeasures you would take against a cross-site request forgery attack? Set the secure flag on all sensitive cookies. Ensure that certificates are valid and are not expired. All non-SSL web page requests should be directed to the SSL page. Log off immediately after using a web application. Clear the history after using a web application, and don't allow your browser to save your login details. Avoid using redirects and forwards. If you must use them, be sure that the supplies values are valid and the user has appropriate authorization. Use SSL for all authenticated parts of an application. Verify whether user information is stored in a hashed format. Do not submit session data as part of a GET or POST.

Log off immediately after using a web application. Clear the history after using a web application, and don't allow your browser to save your login details.

Which of the following steps in the web server hacking methodology involves setting up a web server sandbox to gain hands-on experience attacking a web server? Session hijacking Footprinting Vulnerability scanning Mirroring

Mirroring

You are looking for a web application security tool that runs automated scans looking for vulnerabilities susceptible to SQL injection, cross-site scripting, and remote code injection. Which of the following web application security tools would you most likely use? N-Stalker VampireScan dotDefender Netsparker

Netsparker

Which of the following best describes the HTTP Request/Response TRACE? Performs a loopback test to a target resource. Only transfers the status line and the header section. Establishes a communication tunnel to the server. Stores web pages and distributes them to clients.

Performs a loopback test to a target resource.

Which of the following types of injections can be injected into conversations between an application and a server to generate excessive amounts of spam email? SQL injection XPath injection LDAP injection SMTP injection

SMTP injection

Upload bombing and poison null byte attacks are designed to target which of the following web application vulnerabilities? Buffer overflow Scripting errors Flawed web design Input validation

Scripting errors

Which of the following footprinting methods would you use to scan a web server to find ports that the web server is using for various services? Service discovery Detect proxy servers Port scanning Detect firewalls

Service discovery

SQL injections are a result of which of the following flaws? The file system The database The web server Web applications

Web applications

Which of the following explains why web servers are often targeted by attackers? Web servers provide an easily found, publicly accessible entrance to a network that users are encouraged to enter into and browse. Web servers are standalone servers that seldom interact with other network resources. Web servers are placed behind firewalls to make them less accessible to users. Web servers are simple devices with few complex features, making their attack surfaces easy to exploit.

Web servers provide an easily found, publicly accessible entrance to a network that users are encouraged to enter into and browse.

Which of the following statements is true regarding cookies? They load tons of files onto a server, hoping to fill up the server's drives and crash the system. They assign session IDs, encryption, and permissions to a specific client for a period of time. They were created to store information about user preferences and web activities. They will overflow when an application or process tries to send more data than they are able to hold.

They were created to store information about user preferences and web activities.

You are analyzing the web applications in your company and have newly discovered vulnerabilities. You want to launch a denial-of-service (DoS) attack against the web server. Which of the following tools would you most likely use? WebInspect Wireshark WebScarab Burp Suite

WebInspect

Which of the following types of web server attacks is characterized by altering or vandalizing a website's appearance in an attempt to humiliate, discredit, or annoy the victim? Footprinting Website defacement Cross-site scripting Directory traversal

Website defacement