Ethical Hacking Chapter #1

reusability

Having access controls on predefined parameters can help increase the level of security One user or program may not reuse or manipulate objects that another user or program is currently accessing in order to prevent violation of security

Active - modify the target system Passive - violate the confidentiality of a system's data without affecting the state of that system

How are attacks can be classified as?

TCP ICMP IP optimizes UDP scanning

How does unicorn scan handle port scanning

Many security testers use the ____ tool to bypass filtering devices by injecting modified IP packets. a. Tcpdump c. Nmap b. Hping d. Nessus

Hping

The ____ tool enables you to craft an IP packet to your liking. a. Unicornscan c. Nmap b. Hping d. Ethereal

Hping

port 80

Hypertext Transfer Protocol (HTTP) Used when connecting to a Web server

First byte is reserved for network address Last three bytes are available for host computers Supports more than 16 million host computers Limited number of Class A networks Reserved for large corporations and governments Format: network.node.node.node

IP addressing Class A consists of what?

Divided evenly Two-octet network address Two-octet host address Supports more than 65,000 hosts Assigned to large corporations and Internet Service Providers (ISPs) Format: network.network.node.node

IP addressing class A consists of what

Three-octet network address and one-octet host address More than two million Class C addresses Supports up to 254 host computers Usually available for small business and home use Format: network.network.network.node

IP addressing class C consists of what

Consists of four bytes Divided into two components Network address Host address

IP addressing consists of how many bytes? divided into how many components

enables multiple users to communicate over the Internet in discussion forums

IRC

program that sends automatic responses to users, giving the appearance of a person being present on the other side of the connection

IRC "bot"

Why are employees sometimes not told that the company is being monitored?

If a company knows that it's being monitored to assess the security of its systems, employees might behave more vigilantly and adhere to existing procedures. Many companies don't want this false sense of security; they want to see how personnel operate without forewarning that someone might attempt to attack their network.

If subnetting is used in an organization, you can include the broadcast address by mistake when performing ping sweeps. How might this happen?

If you decide to use ping sweeps, be careful not to include the broadcast address in your range of addresses. You can do this by mistake if subnetting is used in an organization. For example, if the IP address 193.145.85.0 is subnetted with a 255.255.255.192 subnet mask, four subnets are created: 193.145.85.0, 193.145.85.64, 193.145.85.128, and 193.145.85.192. The broadcast addresses for each subnet are 193.145.85.63, 193.145.85.127, 193.145.85.191, and 193.145.85.255, respectively. If a ping sweep was inadvertently activated on the range of hosts 193.145.85.65 to 193.145.85.127, an inordinate amount of traffic could flood through the network because the broadcast address of 193.145.85.127 was included. This would be more of a problem on a Class B address, but if you perform ping sweeps, make sure your client signs a written agreement authorizing the testing.

How can a computer criminal use HTTP methods before running an exploit on a server?

If you know HTTP methods, you can send a request to a Web server and, from the generated output, determine what OS the Web server is using. You can also find other information that could be used in an attack. After you determine which OS version a company is running, you can search for any exploits that might be used against that network's systems.

Why is port scanning useful for hackers?

Port scanning helps you answer questions about open ports and services by enabling you to quickly scan thousands or even tens of thousands of IP addresses. Many port-scanning tools produce reports of their findings, and some give you best-guess assessments of which OS is running on a system. Most, if not all, scanning programs report open ports, closed ports, and filtered ports in a matter of seconds. When a Web server needs to communicate with applications or other computers, for example, port 80 is opened. An open port allows access to applications and can be vulnerable to an attack. A closed port does not allow entry or access to a service. For instance, if port 80 is closed on a Web server, users wouldn't be able to access Web sites. A port reported as filtered might indicate that a firewall is being used to allow specified traffic in or out of the network.

port 110

Post Office Protocol 3 (POP3) Used for retrieving e-mail

reconnaissance

Preparatory phase where an attacker gathers as much information as possible about the target prior to launching the attack

Denial of service attack

Prevents legitimate users from accessing network resources Some forms do not involve computers

steganography

Process of hiding data in other data, for instance image and sound files

Macroviruses

Programs that support a macro programming language (e.g., Visual Basic for Applications) Lists of commands Can be used in destructive ways

"____" is not a domain tested for the CEH exam. a. Sniffers c. Footprinting b. Social engineering d. Red team testing

Red team testing

port 135

Remote Procedure Call (RPC) Critical for operation of Microsoft Exchange Server and Active Directory

Worms: examples are code red and numda Theoretically can infect every computer in the world over a short period

Replicates and propagates without a host

The ____ Institute Top 20 list details the most common network exploits and suggests ways of correcting vulnerabilities. a. SANS c. CERT b. CompTIA d. ISECOM

SANS

the main protocol for transmitting e-mail messages across the Internet

SMTP

primarily used to monitor devices on a network, such as remotely monitoring a router's state

SNMP

enables a remote user to log on to a server and issue commands

SSH

TCP header flag that signifies the beginning of a session

SYN

A computer that receives a SYN packet from a remote computer responds to the packet with a(n) ____ packet if its port is open. a. FIN c. SYN/ACK b. RST d. ACK

SYN/ACK

____ is a Web tool used to gather IP and domain information. It is available for both UNIX and Window OSs. a. Samba c. SamSpade b. Bugnosis d. FOCA

SamSpade

A ____ or batch file is a text file containing multiple commands that are normally entered manually at the command prompt. a. script c. snippet b. program d. signature

Script

Some hackers are skillful computer operators, but others are younger inexperienced people who experienced hackers refer to as ____. a. script kiddies c. packet sniffers b. repetition monkeys d. crackers

Script kiddies

In a(n) ____, the tester does more than attempt to break in; he or she also analyzes the company's security policy and procedures and reports any vulnerabilities to management. a. penetration test c. hacking test b. security test d. ethical hacking test

Security Test

____ takes penetration testing to a higher level. a. Hacking c. Security testing b. Cracking d. Packet sniffing

Security testing

Internet Control Message Protocol (ICMP)

Sends messages related to network operations Helps troubleshoot network connectivity problems Ping command Tracks the route a packet traverses Traceroute command

____ can be used to read PINs entered at ATMs or to detect long-distance authorization codes that callers dial. a. Shoulder surfing c. Zone transferring b. Footprinting d. Social engineering

Shoulder surfing

To help prevent ____ attacks, you must educate your users not to type logon names and passwords when someone is standing directly behind them—or even standing nearby. a. shoulder-surfing c. piggybacking b. footprinting d. social engineering

Shoulder-surfing

port 25

Simple Mail Transfer Protocol (SMTP) E-mail servers listen on this port

____ means using a knowledge of human nature to get information from people. a. Fingerprinting c. Zone transferring b. Footprinting d. Social engineering

Social engineering

What type of information is usually gathered by social engineering?

Social engineering means using a knowledge of human nature to get information from people. In computer attacks, the information is usually a password to a network or other information an attacker could use to compromise a network. A salesperson can get personal information about customers, such as income, hobbies, social life, drinking habits, music preferences, and the like, just by asking the customer the right questions. A salesperson uses charm and sometimes guile to relax customers. In a sense, a salesperson attempts to bond with customers by pretending to be empathetic with them. After leaving the store, customers might regret some of the information they freely gave, but if the salesperson was personable, they might not think twice about the personal information the salesperson elicited. Social engineers might also use persuasion tactics, intimidation, coercion, extortion, and even blackmail to gather the information they need. They are probably the biggest security threat to networks and the most difficult to protect against.

____ can be used to gather information useful for computer criminals, like company phone directories, financial reports, interoffice memos, resumes of employees, etc. a. Shoulder surfing c. Piggybacking b. Footprinting d. Dumpster diving

dumpster diving

Describe an example of a macro virus.

The most infamous macro virus is Melissa, which appeared in 1999. The virus was initiated after a user opened an infected document; the virus then sent an e-mail message to the first 50 entries it located in the infected computer's address book.

What is a Class B IP address?

These address are evenly divided between a two-octet network and a two-octet host address, allowing more than 65,000 host computers per Class B network address. Large organizations and Internet service providers are often assigned Class B Internet addresses. Class B addresses have the format "network.network.node.node".

Often technical personnel who aren't familiar with security techniques think that restricting access to ports on a router or firewall can protect a network from attack. Is this a good solution?

This is easier said than done. After all, if a firewall prevents any traffic from entering or exiting a network on port 80, you have indeed closed a vulnerable port to access from hackers. However, you have also closed the door to Internet access for your users, which probably isn't acceptable to your company. The tricky (and almost impossible) part for security personnel is attempting to keep out the bad guys while allowing the good guys to work and use the Internet.

What are the problems on depending on ping sweeps to find out which hosts are "live"?

To find out which hosts are "live," ping sweeps simply ping a range of IP addresses and see what type of response is returned. The problem with relying on ping sweeps to identify live hosts is that a computer might be shut down at the time of the sweep, indicating that the IP address does not belong to a live host. Another problem with ping sweeps is that many network administrators configure nodes to not respond to an ICMP Echo Request (type 8) with an ICMP Echo Reply (type 0). This doesn't mean the computer isn't alive; it just means it isn't replying to the attack computer at that moment. Add to that the possibility of a firewall filtering out ICMP traffic, and you have many reasons for using caution when running ping sweeps.

What is the most important recommendation that should be made to a client to help prevent viruses from being introduced into corporate networks?

To help prevent viruses from being introduced into corporate networks, the most important recommendation you should make to a client is to update virus signature files as soon as they're available from the vendor. Most antivirus software does this automatically or prompts the user to do so. An organization can't depend on employee vigilance to protect its systems, so centralizing all antivirus software updates from a corporate server is prudent.

can be set to 0 off or 1 on

each flag occupies one bit of the TCP segment

secure shell (SSH)

enables a remote user to log on to a server securely and issue commands interactively

internet relay chat (IRC)

enables multiple users to comm over the internet in discussion forums

telnet

enables users to log on to a server remotely and issue commands interactively

Attempt to cause users on a network to flood each other with data, making it appear as if everyone is attacking each other

What are smurf attacks

Persuasion Intimidation Coercion Extortion/blackmailing

What are social engineering tactivs

black box testing, white box testing, and gray box testing

What are the 3 categories for ethical hacking testing?

former black hats white hats consulting firms

What are the ethical hackers categories?

preparation, conduct, and conclusion

What are the three phases of security testing

used to erase the attacker's activities from the system's log files

What are trojans like ps or netcat used for

sometimes employed by companies to perform penetration tests

ethical hacker

Disclosure, deception, disruption, and usurpation

examples of loss

A closed port can be vulnerable to an attack.

false

A closed port responds to a SYN scan with an RST packet, so if no packet is received, the best guess is that the port is open.

false

A disadvantage of Nmap is that it is very slow because it scans all the 65,000 ports of each computer in the IP address range.

false

A hex number is written with two characters, each representing a byte.

false

In the TCP/IP stack, the Transport layer includes network services and client software.

false

Malware programs cannot be detected by antivirus programs.

false

Namedroppers is a tool that can be used to capture Web server information and possible vulnerabilities in a Web site's pages that could allow exploits such as SQL injection and buffer overflows.

false

The HTTP CONNECT method starts a remote application-layer loopback of the request message.

false

To retrieve e-mail from a mail server, you most likely access port 119.

false

might indicate that a firewall is being used

filtered port

Based on the starting decimal number of the ____ byte, you can classify IP addresses as Class A, Class B, or Class C. a. first c. third b. second d. fourth

first

In computer jargon, the process of finding information on a company's network is called ____________________.

footprinting

accesses a computer system or network without the authorization of the system's owner

hacker

An April 2009 article in USA Today revealed that the federal government is looking for ____ to pay them to secure the nation's networks. a. crackers c. hackers b. IT professionals d. security testers

hackers

suicide hackers

hacktivists who are willing to become martyrs for their cause

Each character represents a nibble Value contains alphabetic letters A representing 10 and F representing 15

hex consists of 2 characters

Convert each nibble to binary Convert binary value to decimal

hex number in binary or decimal

Uses 16 as its base Supports numbers from 0 to 15

hexadecimal number system uses what as a base

Group of 8 bits Can represent 28 (256) different colors

how are bytes grouped?

Encoding base 64 Used to reduce size of e-mail attachments Represents zero to 63 using six bits A is 000000... Z is 011001

how are viruses encoded

Use turnstiles Train personnel to notify security about strangers Do not hold secured doors for anyone Even people they know All employees must use access cards

how do you prevent piggybacking

Watch authorized personnel enter an area Quickly join them at security entrance Exploit desire to be polite and helpful Attacker wears a fake badge or security card

how does piggybacking work

Attacker creates a large ICMP packet More than allowed 65,535 bytes Large packet is fragmented into small packets Reassembled at destination Destination point cannot handle reassembled oversize packet Causes it to crash or freeze

how does ping of death attacks work?

1023

how many ports are considered well known

Create groups of four characters Convert decimal value of each letter to binary Rewrite as three groups of eight bits Convert binary into decimal

in viruses, how do you convert 64 strings to decimal equivalent

application layer

includes network services and client software

In TCP, the ______________________________ is a 32-bit number that tracks the packets received by the node and allows reassembling of large packets that have been broken up into smaller packets.

initial sequence number (ISN) ISN initial sequence number

IDS stands for ____. a. Intrusion Detection System c. Information Destruction System b. Information Dissemination System d. Intruder Dispersal System

instruction detection system

In the TCP/IP stack, the ____ layer uses IP addresses to route packets. a. Internet c. Transport b. Network d. Application

internet

____ are devices or computer programs that can be used to capture keystrokes on a computer. a. Viruses c. Macro viruses b. Keyloggers d. Firewalls

keyloggers

network layer

layer represents the physical network pathway and the network interface card

A(n) ____________________ is a virus encoded as a macro in programs that support a macro programming language, such as Visual Basic for Applications (VBA).

macro virus

____________________ is malicious software, such as a virus,worm, or Trojan program, introduced to a network for just that reason.

malware

2005 hybrid worm with backdoor capabilities spread by mass e-mailing and exploiting Windows vulnerabilities

mytob

____________________ or rootkits are computer programs that give attackers a means of regaining access to the attacked computer later.

backdoors

gray hats

believe in full disclosure (information is better out in the open than kept in secret

puts the burden on the tester to find out what technologies the company is using

black box model

In the TCP/IP stack, the ____ layer is concerned with physically moving electrons across a medium. a. Internet c. Transport b. Network d. Application

network

allows access to applications

open port

Derogatory term referring to people who copy code from knowledgeable programmers instead of creating the code themselves.

packet monkey

copies code from knowledgeable programmers instead of creating the code himself/herself

packet monkey

operates on ports 65301, 22, 5631, and 5632

pcAnywhere

In a(n) ____________________, an ethical hacker attempts to break into a company's network to find the weakest link in that network or one of its systems.

penetration test

____ is trailing closely behind an employee who has access to an area without the person realizing that you didn't use a PIN or a security badge to enter the area. a. Shoulder surfing c. Piggybacking b. Footprinting d. Dumpster diving

piggybacking

To verify if all the IP addresses of a network are being used by computers that are up and running, you can use a port scanner to ____________________ the range of IP addresses.

ping

Port scanners can also be used to conduct a(n) ____________________ of a large network to identify which IP addresses belong to active hosts.

ping sweep

An OpenVAS____________________ is a security test program (script) that can be selected from the client interface.

plug-in

A(n) ____ is the logical, not physical, component of a TCP connection. a. ISN c. port b. socket d. SYN

port

simple network management protocol (SNMP)

primarily used to monitor devices on a network, such as monitoring a router's state remotely.

PKI stands for ____. a. Public Key Infrastructure c. Protected Key Infrastructure b. Private Key Infrastructure d. Primary Key Infrastructure

public key infratructure

composed of people with varied skills who perform penetration tests

red team

A ____ is created after an attack and usually hides itself within the OS tools, so it's almost impossible to detect. a. toolbox c. shell b. rootkit d. macro virus

rootkit

Trojan Programs can install a backdoor or ____ on a computer. a. rootkit c. worm b. shell d. macro virus

rootkit

set of instructions that runs in sequence to perform tasks on a computer system

script

Many experienced penetration testers can write computer programs or ____ in Perl or the C language to carry out network attacks. a. kiddies c. scripts b. packets d. crackers

scripts

____ enables an attacker to join a TCP session and make both parties think he or she is the other party. a. A DoS attack c. A buffer overflow attack b. The Ping of Death d. Session hijacking

session hijacking

____ is an attack that relies on guessing the ISNs of TCP packets. a. ARP spoofing c. DoS b. Session hijacking d. Man-in-the-middle

session hijacking

executable piece of programming code that should not appear in an e-mail attachment

shell

A(n) ____________________ is a person skilled at reading what users enter on their keyboards, especially logon names and passwords.

shoulder surfer

Antivirus software compares ____________________ of known viruses against the files on the computer; if there's a match, the software warns you that the program or file is infected.

signatures programming code

SYN flag: synch flag ACK flag: acknowledgment flag PSH flag: push flag URG flag: urgent flag RST flag: reset flag FIN flag: finish flag

six TCP segment flags

purported to have shut down more than 13,000 ATMs

slammer

Some attackers want to be hidden from network devices or IDSs that recognize an inordinate amount of pings or packets being sent to their networks, so they use ____________________ attacks that are more difficult to detect.

stealth

In addition to a unique network address, each network must be assigned a(n) ____________________, which helps distinguish the network address bits from the host address bits.

subnet mask

Simple mail transfer protocol (SMTP)

the main protocol for transmitting email messages across the internet

Hypertext transfer protocol (HTTP)

the primary protocol used to communicate over the web

security

the state of well-being of a system's data and infrastructure

The collection of tools for conducting vulnerability assessments and attacks is sometimes referred to as a "____". a. black box c. gray box b. white box d. tiger box

tiger box

TCP stands for ____. a. Transfer Control Protocol c. Transfer Congestion Protocol b. Transmission Control Protocol d. THE Control Protocol

transmission control protocol

In the TCP/IP stack, the ____ layer is concerned with controlling the flow of data, sequencing packets for reassembly, and encapsulating the segment with a TCP or UDP header. a. Internet c. Transport b. Network d. Application

transport

One of the most insidious attacks against networks and home computers worldwide is ____, which disguise themselves as useful computer programs or applications. a. macro viruses c. spyware programs b. worms d. Trojan programs

trojan programs

Software keyloggers behave like ____ and are loaded on a computer. a. Trojan programs c. shells b. viruses d. firewalls

trojan programs

An octal digit can be represented with only three bits because the largest digit in octal is seven.

true

Computer crime is the fastest growing type of crime worldwide.

true

Network attacks often begin by gathering information from a company's Web site.

true

No matter what medium connects computers on a network—copper wires, fiber-optic cables, or a wireless setup—the same protocol must be running on all computers if communication is going to function correctly.

true

Port scanning is a method of finding out which services a host computer offers.

true

Some cookies can cause security issues because unscrupulous people might store personal information in cookies that can be used to attack a computer or server.

true

The average home user or small-business owner doesn't typically use Telnet.

true

The most effective approach to protect a network from malware being introduced is to conduct structured training of all employees and management.

true

To limit the amount of information a company makes public, you should have a good understanding of what a competitor would do to discover confidential information.

true

Wget is a tool that can be used to retrieve HTTP, HTTPS, and FTP files over the Internet.

true

You can search for known vulnerabilities in a host computer by using the Common Vulnerabilities and Exposures Web site.

true

Limited vulnerability analysis Attack and penetration testing

two most common approaches to security testing conduct phase

Half a byte or four bits Helps with reading numbers by separating the byte Example: 1111 1010 versus 11111010

understanding nibbles

In an ACK scan, if the attacked port returns an RST packet the attacked port is considered to be "____". a. open c. unfiltered b. closed d. unassigned

unfiltered

white hats

use skills for defensive purposes

black hats

use skills for illegal or malicious purposes

internet layer

uses IP addresses to route packets to the correct destination network

A ____ can replicate itself, usually through an executable program attached to an e-mail. a. shell c. keylogger b. virus d. rootkit

virus

Obtain confidential information (passwords) Obtain other personal information

what are goals of social engineering

Used to capture keystrokes on a computer Software Loaded on to computer Behaves like Trojan programs Hardware Small and easy to install device Goes between keyboard and computer Examples: KeyKatcher and KeyGhost

what are keyloggers

Can pick deadbolt lock in less than five minutes After only a week or two of practice

what are lock up servers

Executable piece of programming code Creates interface to OS for issuing commands Should not appear in an e-mail attachment

what are shells in viruses

Binoculars or high-powered telescopes Key positions and typing techniques Popular letter substitutions $ equals s, @ equals a

what are shoulder surfer tools

Reads what users enter on keyboards Logon names Passwords PINs

what are shoulder surfers

Urgency Quid pro quo Status quo Kindness Position

what are social engineering techniques

software (personal) and hardware (enterprise)

what are the 2 firewalls?

Owner permissions (rwx) Group permissions (rwx) Other permissions (rwx) Setting permission (rwxrwxrwx) means they all have read, write, and execute permissions

what are the UNIX permissions

Insidious attack against networks and computers Disguise themselves as useful programs Can install backdoors and rootkits Allow attackers remote access

what are trojan programs

Discarded computer manuals Passwords jotted down Company phone directories Calendars with schedules Financial reports Interoffice memos Company policy Utility bills Resumes

what can be found in dumpster diving

Web server OS Names of IT personnel

what can you determine with just a URL

pull info from a web server

what do HTTP commands do?

Identifies traffic on unfamiliar ports

what do good software or hardware firewall do?

Open ports Closed ports Filtered ports Best-guess running OS

what do port scanning programs report

Cripples the network Makes it vulnerable to other attacks

what does attempting to access information do

OS runs this code Code elevates attacker's permission Administrator, owner, or creator

what happens when an attacker writes code that overflows buffer

Commonly used Gathers IP address and domain information Attackers can also use it

what is Whois

One-pixel by one-pixel image file Referenced in an <IMG> tag Usually works with a cookie Purpose similar to spyware and adware Comes from third-party companies Specializing in data collection

what is a web bug

purpose: Determine user's purchasing habits Tailors advertisement problem: Slows down computers

what is adware's main purpose? or problem?

Look over the location Find weakness in security systems Types of locks and alarms used

what is case the joint

Gathering information using technology

what is competitive intelligence

Finding information on company's network Passive and nonintrusive Several available Web tools

what is footprinting

Powerful tool for UNIX and Windows OSs Requires Java J2SE

what is paros

Usually framed as urgent request to visit a Web site Web site is a fake

what is phishing

Trailing closely behind an employee cleared to enter restricted areas

what is piggybacking

Finds which services are offered by a host Identifies vulnerabilities

what is port scanning

Enables attacker to join a TCP session Attacker makes both parties think he or she is the other party Complex attack Beyond the scope of this book

what is session hijacking

adware: installed without users being aware

what is similar to spyware.

Convincing other people to reveal information such as unlisted phone numbers, passwords, etc.

what is social engineering

Combines social engineering and exploiting vulnerabilities E-mail attacks directed at specific people Comes from someone the recipient knows Mentions topics of mutual interest

what is spear phishing

helps protect against spyware and and adware

what is spybot and ad-aware?

Uses 8 as its base Supports values from 0 to 7

what is the base for the octal numbering system

spyware

what sends information from infected computer to attacker

Loss of bandwidth Degradation or loss of speed

what will flooding a network with billions of packets do

In the ____________________ model, the tester is told what network topology and technology the company is using and is given permission to interview IT personnel and company employees.

white box

Require pushing in a sequence of numbered bars

why are rotary locks harder to pick

New viruses, worms, and Trojan programs appear daily

why is it difficult to protect against malware attacks

A ____ is a computer program that replicates and propagates itself without having to attach itself to a host. a. virus c. worm b. Trojan d. shell

worm

In a Linux script, the line ____ is important because it identifies the file as a script. a. #!/bin/sh c. #!/bin/shscript b. #!/bin/script d. #!/bin/sc

#!/bin/sh

In a ____ attack, a programmer finds a vulnerability in poorly written code that doesn't check for a defined amount of memory space use. a. buffer overflow c. DDoS b. DoS d. session hijacking

buffer overflow

the primary protocol used to communicate over the World Wide Web

HTTP

Request not understood by server

HTTP 400 Bad Request

Server understands request but refuses to comply

HTTP 403 Forbidden

Unable to match request

HTTP 404 Not Found

Request not allowed for the resource

HTTP 405 Method Not Allowed

Request not made by client in allotted time

HTTP 408 Request Timeout

Request could not be fulfilled by server

HTTP 500 Internal Server Error

Server received invalid response from upstream server

HTTP 502 Bad Gateway

Server is unavailable due to maintenance or overload

HTTP 503 Service Unavailable

Server did not receive a timely response

HTTP 504 Gateway Timeout

Operating system attacks Application-level attacks Shrink-wrap code attacks Misconfiguration attacks

Hacker attacks can be categorized as what?

The U.S. Department of Justice labels all illegal access to computer or network systems as "____". a. cracking c. sniffing b. hacking d. trafficking

Hacking

port 119

Network News Transfer Protocol Used to connect to a news server for use with newsgroups

List at least five domains tested for the Certified Ethical Hacker (CEH) exam.

- Ethics and legal issues - Footprinting - Scanning - Enumeration - System hacking - Trojan programs and backdoors - Sniffers - Denial of service - Social engineering - Session hijacking - Hacking Web servers - Web application vulnerabilities - Web-based password-cracking techniques - Structured Query Language (SQL) injection - Hacking wireless networks - Viruses and worms - Physical security - Hacking Linux - Intrusion detection systems (IDSs), firewalls, and honeypots - Buffer overflows - Cryptography - Penetration-testing methodologies

What are four different skills a security tester needs?

- Knowledge of network and computer technology - Ability to communicate with management and IT personnel - An understanding of the laws that apply to your location - Ability to apply the necessary tools to perform your tasks

The ____ option of Nmap is used to perform a TCP SYN stealth port scan. a. -sS c. -sV b. -sU d. -S

-sS

What steps are involved in TCP's "three-way handshake"?

1. Host A sends a TCP packet with the SYN flag set (that is, a SYN packet) to Host B. 2. After receiving the packet, Host B sends Host A its own SYN packet with an ACK flag (a SYN-ACK packet) set. 3. In response to the SYN-ACK packet from Host B, Host A sends Host B a TCP packet with the ACK flag set (an ACK packet).

The POP3 service uses port ____. a. 110 c. 135 b. 119 d. 139

110

The Network News Transport Protocol service uses port ____. a. 110 c. 135 b. 119 d. 139

119

The Microsoft RPC service uses port ____. a. 110 c. 135 b. 119 d. 139

135

The NetBIOS service uses port ____. a. 110 c. 135 b. 119 d. 139

139

The binary number 11000001 converted to decimal is ____. a. 128 c. 193 b. 164 d. 201

193

Currently, the CEH exam is based on ____ domains (subject areas) with which the tester must be familiar. a. 11 c. 31 b. 22 d. 41

22

The SMTP service uses port ____. a. 25 c. 69 b. 53 d. 80

25

Each Class C IP address supports up to ____ host computers. a. 254 c. 65,000 b. 512 d. 16 million

254

ISN

32-bit number Tracks packets received by a node Allows reassembly of large packets Sent on steps one and two of TCP three-way handshake Sending node ISN is sent with SYN packet Receiving node ISN is sent back to sending node with SYN-ACK packet

The DNS service uses port ____. a. 25 c. 69 b. 53 d. 80

53

To represent 0 to 63 characters you need only ____ bits. a. four c. six b. five d. seven

6

The TFTP service uses port ____. a. 25 c. 69 b. 53 d. 80

69

An octet is equal to ____________________ bits, which equals one byte.

8

HTTP uses port ____ to connect to a Web service. a. 21 c. 25 b. 22 d. 80

80

The HTTP service uses port ____. a. 25 c. 69 b. 53 d. 80

80

What is the purpose of a Web bug? How do they relate to or differ from spyware?

A Web bug is a 1-pixel x 1-pixel image file referenced in an <IMG> tag, and it usually works with a cookie. Its purpose is similar to that of spyware and adware: to get information about the person visiting the Web site. Web bugs are not from the same Web site as the Web page creator. They come from third-party companies specializing in data collection. Security professionals need to be aware of cookies and Web bugs to keep these information-gathering tools off company computers.

exposure

A breach in security Can vary from one company to another, or even from one department to another loss due to an exploit

Reconnaissance Scanning Gaining access Maintaining access Covering tracks

What are five phases that make up an attack

____ is concerned with the security of computers or devices that are part of a network infrastructure. a. Attack security c. Computer security b. Cybercrime d. Network security

Network security

The ____ tool was originally written for Phrack magazine in 1997 by Fyodor. a. Unicornscan c. Nessus b. Fping d. Nmap

Nmap

What is a DDoS attack?

A distributed denial-of-service (DDoS) attack is launched against a host from multiple servers or workstations. In a DDoS attack, a network could be flooded with literally billions of packets; typically, each participant in the attack contributes only a few of the total number of packets. If one server bombards an attacked server with hundreds or even thousands of packets, available network bandwidth could drop to the point that legitimate users notice a performance degradation or loss of speed. Now imagine 1000 servers or even 10,000 servers involved, with each server sending several thousand IP packets to the attacked server. There you have it: a DDoS attack. Keep in mind that participants in the attack often aren't aware their computers are taking part in the attack. They, too, have been attacked by the culprit. In fact, in one DDoS attack, a company was flooded with IP packets from thousands of Internet routers and Web servers belonging to Yahoo.com.

What types of ports do successful Trojan programs commonly use?

A good software or hardware firewall would most likely identify traffic that's using unfamiliar ports, but Trojan programs that use common ports, such as TCP port 80 (HTTP) or UDP port 53 (DNS), are more difficult to detect. The programmer who wrote Backdoor.Slackbot.B controlled a computer by using Internet Relay Chat (IRC), which is on port 6667.

Architecture and configuration of the target system Skill level of the perpetrator Initial level of access obtained

A hacker's chances of gaining access into a target system are influenced by factors such as:

exploit

A specific way to breach the security of an IT system through a vulnerability

What is Spyware

A spyware program sends information from the infected computer to the person who initiated the spyware program on your computer. This information could be confidential financial data, passwords, PINs—just about any data stored on your computer. You need to make sure your users understand that this information collection is possible, and that spyware programs can register each keystroke entered. It's that simple. This type of technology not only exists, but is prevalent. It can be used to record and send everything a user enters to an unknown person located halfway around the world.

Why is "attach" a key word when talking about viruses?

A virus does not stand on its own. It can't replicate itself or operate without the presence of a host program. A virus attaches itself to a host program, just as the flu attaches itself to a host organism.

Describe some actions which security testers cannot perform legally.

Accessing a computer without permission, destroying data, or copying information without the owner's permission is illegal. Certain actions are illegal, such as installing worms or viruses on a computer network that deny users access to network resources. As a security tester, you must be careful that your actions don't prevent customers from doing their jobs. For example, DoS attacks should not be initiated on your customer's networks.

threat

Action or event that might compromise security

Source IP address Destination IP address Flags

What are packet components

What is Back Orifice

Back Orifice is still one of the most common Trojan programs used today. It allows attackers to take full control of the attacked computer, similar to the way Windows XP Remote Desktop functions, except that Back Orifice works without the user's knowledge. The program has been around since 1999, but it's now marketed as an administrative tool rather than a hacking tool.

____ is currently the standard port-scanning tool for security professionals. a. Unicornscan c. Nessus b. Fping d. Nmap

Nmap

a port scanning tool

Nmap

typically used to get past a firewall

ACK scan

Why is ATM shoulder surfing much easier than computer shoulder surfing?

ATM theft is much easier than computer shoulder surfing because a keypad has fewer characters to memorize than a computer keyboard. If the person throws away the receipt in a trash can near the ATM, the shoulder surfer can match the PIN with an account number and then create a fake ATM card. Often shoulder surfers use binoculars or high-powered telescopes to observe PINS being entered, making it difficult to protect against this attack.

____ is a reasonably priced commercial port scanner with a GUI interface. a. AW Security Port Scanner c. Ethereal b. Common Vulnerabilities and Exposures d. Tcpdump

AW Security Port Scanner

NDA, to protect the client's confidential data Clause stating that the ethical hacker has full consent of the client to hack into their systems

After discussing security issues with the client, a formal contract should be drawn up that contains

attack

Any attempt by an unauthorized person to access, damage, or use network resources

binary octal hexadecimal

As a security professional, knowledge of numbering systems will come into play:

What are the critical components of a TCP header? How may hackers abuse them?

As a security professional, you should know the critical components of a TCP header: TCP flags, the initial sequence number, and source and destination port numbers. Hackers abuse many of these TCP header components; for example, when port scanning,many hackers use the method of sending a packet with a SYN-ACK flag set even though a SYN packet was not sent first.

Which ports should security professionals scan when doing a test? Why?

As a security tester, you need to know which ports attackers are going after so those ports can be closed or protected. Security professionals must scan all ports when doing a test, not just the well-known ports (Ports 1 to 1023, the most common, are covered in Chapter 2). Many computer programs use port numbers outside the range of well-known ports. For example, pcAnywhere operates on ports 65301, 22, 5631, and 5632. A hacker who discovers that port 65301 is open might want to check the information at the Common Vulnerabilities and Exposures Web site for a possible vulnerability in pcAnywhere. After a hacker discovers an open service, finding a vulnerability or exploit isn't difficult.

As a security tester, should you use social-engineering tactics?

As a security tester, you should never use social-engineering tactics unless the person who hired you gives you permission in writing. You should also confirm on which employees you're allowed to perform social-engineering tests, and document the tests you conduct. Your documentation should include the responses you received, and all test results should, of course, be confidential.

Remove evidence of their entry Install a backdoor or a Trojan to gain repeat access Install rootkits at the kernel level to gain full administrator access to the target compute

Attackers, who choose to remain undetected do what

Inside - initiated from within a network by an authorized user Outside - caused by an external intruder who does not have authorization to access the network

Attacks can be categorized as inside or outside attacks by what

Why is it hard for an ethical hacker to avoid breaking any laws?

Because the job of an ethical hacker is fairly new, the laws are constantly changing. Even though a company has hired you to test its network for vulnerabilities, be careful that you aren't breaking any laws for your state or country. If you're worried that one of your tests might slow down the network because of excessive bandwidth use, that concern should signal a red flag. The company might consider suing you for lost time or monies caused by this delay.

common Trojan program

Black Orifice

In the ____ model, management does not divulge to staff that penetration testing is being conducted, nor does it give the tester any diagrams or describe what technologies the company is using. a. gray box c. black box b. white box d. red box

Black box

A ____ can be created that welcomes new users joining a chat session, even though a person isn't actually present to welcome them. a. byte c. switch b. packet d. bot

Bot

The HTTP ____________________ method is used with a proxy that can dynamically switch to a tunnel connection, such as Secure Socket Layer (SSL).

CONNECT

The ____ certification for security professionals is issued by the International Information Systems Security Certifications Consortium (ISC2). a. Global Information Assurance Certification (GIAC) b. OSSTMM Professional Security Tester (OPST) c. Certified Information Systems Security Professional (CISSP) d. Certified Ethical Hacker (CEH)

Certified Information Systems Security Professional (CISSP)

The International Council of Electronic Commerce Consultants (EC-Council) has developed a certification designation called ____. a. CompTIA Security+ b. OSSTMM Professional Security Tester (OPST) c. Certified Information Systems Security Professional (CISSP) d. Certified Ethical Hacker (CEH)

Certifies Ethical Hacker (CEH)

What type of class has the IP address 193.1.2.3? a. Class A c. Class C b. Class B d. Class D

Class C

Some of the most infamous cases are hacks carried out by ____ students, such as the eBay hack of 1999. a. graduate c. college b. high-school d. engineering

College

Ethical hackers are employed or contracted by a company to do what illegal hackers do: break in. Why?

Companies need to know what, if any, parts of their security infrastructure are vulnerable to attack. To protect a company's network, many security professionals recognize that knowing what tools the bad guys use and how they think enables them to better protect (harden) a network's security.

TCP three way handshake

Computer A sends computer B a SYN packet Computer B replies with a SYN-ACK packet Computer A replies with an ACK packet

Crimes facilitated by use of a computer Crimes where the computer is the target

Computer crimes can be separated into two categories:

network security

Concern with security of network infrastructure

computer security

Concerned with security of a stand alone computer Not part of a network infrastructure

assurance

Confidence that the system will behave according to its specifications

TCP is a(n) ____________________ protocol, which means the sender doesn't send any data to the destination node until the destination node acknowledges that it's listening to the sender.

Connection-oriented

Remote network Remote dial-up network Local network Stolen equipment Social engineering Physical entry

Ethical hacker will attempt attacks over various channels:

Shut down computers cannot respond Networks may be configured to block ICMP Echo Requests Firewalls may filter out ICMP traffic

What are ping sweeps problems

Text file Contains multiple commands

What are script or batch file

What can an attacker see on the target system? What can an intruder do with that information? Are the attackers' attempts being noticed on the target systems?

Ethical hacker's evaluation of a client's information system security seeks answers to what 3 basic questions?

subnet mask

Each network must be assigned a subnet mask Helps distinguish network from host address bits Subnetting concepts are important Utilities return information based on IP address and subnet information May be useful when penetration testing

transport layer

Encapsulates data into segments Use TCP or UDP to reach a destination host TCP is a connection-oriented protocol

white box testing

Ethical hacker is given full advance knowledge of the system

black box testing

Ethical hacker is given no prior knowledge or information about a system

the tester might get information about which OSs are used, but not get any network diagrams

Gray box model

attack

Deliberate assault on that system's security

antivirus programs

Detection based on virus signatures Signatures are kept in virus signature file Must update periodically Some offer automatic update feature

With commands such as ____, you can perform zone transfers of all DNS records. a. Dig c. DNS b. Whois d. Netcat

Dig

____ is a tool that is used to perform DNS zone transfers. a. Whois c. Metis b. Netcat d. Dig

Dig

A ____ attack prevents legitimate users from accessing network resources. a. buffer overflow c. social engineering b. session hijacking d. DoS

DoS

port 53

Domain Name Service (DNS) Connects to Web sites using URLs instead of IP addresses

The HTTP ____ method is the same as the GET method, but retrieves only the header information of an HTML document, not the document body. a. CONNECT c. POST b. PUT d. HEAD

HEAD

What is the "poor man's firewall"?

Even though IPX/SPX is not widely used today, many corporations have legacy systems that rely on it. In fact, some users separate their internal networks from the outside world by running IPX/SPX internally. An intruder attempting to attack a network over the Internet would be blocked when the protocol changes from TCP/IP to IPX/SPX. This tactic is referred to as "the poor man's firewall." Of course, it's not a recommended solution for protecting a network, but as a network security professional, you might see it used.

When a TCP three-way handshake ends, both parties send a(n) ____ packet to end the connection. a. SYN c. FIN b. ACK d. RST

FIN

____ was the standard for moving or copying large files and is still used today, although to a lesser extent because of the popularity of HTTP. a. FTP c. SNMP b. TFTP d. SMTP

FTP

allows different operating systems to transfer files between one another

FTP

All states look at port scanning as noninvasive or nondestructive in nature and deem it legal.

False

An ethical hacker is a person who performs most of the same activities a cracker does, but with the owner or company's permission.

False

Macro viruses are hard to create.

False

UDP

Fast but unreliable delivery protocol Operates on Transport layer Used for speed Does not need to verify receiver is listening or ready Depends on higher layers of TCP/IP stack handle problems Referred to as a connectionless protocol

computer crime

Fastest growing type of crime worldwide

port 20 and 21

File Transfer Protocol (FTP) Was the standard for moving or copying large files Used today to a lesser extent Popularity of HTTP Requires a logon name and password More secure than Trivial File Transfer Protocol (TFTP)

1 represents having permission 111 (rwx): all permissions apply 0 removes permission 101 (r-x): user can read and execute but not write

File permissions are represented with bits

With the ____ tool, you can ping multiple IP addresses simultaneously. a. Fping c. Nessus b. Nmap d. Unicornscan

Fping

The HTTP ____ method retrieves data by URI. a. GET c. POST b. PUT d. HEAD

GET

____ is the most basic HTTP method. a. GET c. CONNECT b. PUT d. HEAD

GET

The SysAdmin,Audit,Network, Security (SANS) Institute offers training and IT security certifications through ____. a. Global Information Assurance Certification (GIAC) b. OSSTMM Professional Security Tester (OPST) c. Certified Information Systems Security Professional (CISSP) d. Certified Ethical Hacker (CEH)

Global Information Assurance Certification (GIAC)

What is "competitive intelligence"?

If you want to open a piano studio to compete against another studio that has been in your neighborhood for many years, getting as much information as possible about your competitor is wise. How could you know the studio was successful without being privy to its bank statements? First, many businesses fail after the first year, so the studio being around for years is a testament to the owner doing something right. Second, you can simply park your car across the street from the studio and count the students to get a good idea of the number of clients. You can easily find out the cost of lessons by calling the studio or looking for ads in newspapers, flyers, telephone books, billboards, and so on. Numerous resources are available to help you discover as much as is legally possible about your competition. Business people have been doing this for years. Now this information gathering, called competitive intelligence, is done on an even higher level through technology. As a security professional, you should be able to explain to the company that hired you all the methods competitors use to gather information. To limit the amount of information a company makes public, you should have a good understanding of what a competitor would do to discover confidential information.

If you're good at your job, many IT employees resent you discovering vulnerabilities in their systems. In fact, it's the only profession in which the better you do your job, the more enemies you make!

If you're good at your job, many IT employees resent you discovering vulnerabilities in their systems. In fact, it's the only profession in which the better you do your job, the more enemies you make!

How does a buffer overflow attack work?

In a buffer overflow attack, a programmer finds a vulnerability in poorly written code that doesn't check for a defined amount of space use. For example, if a program defines a buffer size of 100 MB (the total amount of memory the program is supposed to use), and the program writes data over the 100 MB mark without triggering an error or preventing this occurrence,you have a buffer overflow. Basically, the attacker writes code that overflows the buffer; this is possible because the buffer capacity hasn't been defined correctly in the program. The trick is to not fill the overflow buffer with meaningless data, but to fill it with executable program code. That way, the OS runs the code, and the attacker's program does something harmful. Usually, the code elevates the attacker's permissions to that of an administrator's level or gives the attacker the same privileges as the program's owner or creator.

How does a SYN scan work?

In a normal TCP session, a packet is sent to another computer with the SYN flag set. The receiving computer sends back a packet with the SYN/ACK flag set, indicating an acknowledgment. The sending computer then sends a packet with the ACK flag set. If the port to which the SYN packet is sent is closed, the computer responds to the SYN packet with an RST/ACK packet. If a SYN/ACK packet is received by an attacker's computer, it quickly responds with an RST/ACK packet, closing the session. This is done so that a full TCP connection is never made and logged as a transaction. In this sense, it is "stealthy." After all, you don't want a transaction to be logged showing the IP address that connected to the attacked computer.

What is a UDP scan?

In this type of scan, a UDP packet is sent to the target computer. If the port sends back an ICMP "Port Unreachable" message, the port is closed. Again, not getting that message might imply the port is open, but this isn't always true. A firewall or packet-filtering device could undermine your assumptions.

target of evaluation

Information resource or asset that is being protected from attacks

ethical hackers

Information security professionals who specialize in evaluating and defending against threats from attackers

gray box testing

Internal testing performed by system administrator and network professionals

What is ICMP used for?

Internet Control Message Protocol (ICMP) is used to send messages that relate to network operations. For example, if a packet cannot reach its destination, you might see the "Destination Unreachable" error. ICMP makes it possible for network professionals to troubleshoot network connectivity problems (with the Ping command) and to track the route a packet traverses from a source IP address to a destination IP address (with the Traceroute command).

port 143

Internet Message Access Protocol 4 (IMAP4) Used for retrieving e-mail

The IP in TCP/IP stands for ____________________.

Internet Protocol

hardware keylogger

KeyGhost

protocol

Language used by computers Transmission Control Protocol/Internet Protocol (TCP/IP) Most widely used

port

Logical, not physical, TCP connection component Identifies running service Example: HTTP uses port 80

attack side of a sophisticated cybercrime toolkit that spreads when Web surfers visit a hacked Web site hosting the malware

Luckysploit

____ commands that open and close files can be used in destructive ways. a. Macro c. Keylogger b. Firewall d. Adware

Macro

Most infamous macro virus

Melissa

____ is a tool that is used to gather competitive intelligence from Web sites. a. Whois c. Metis b. Netcat d. Dig

Metis

What is DNS used for?

Most networks require a DNS server so that users can connect to Web sites with URLs instead of IP addresses. When a user enters a URL, such as www.yahoo.com, the DNS server resolves the name to an IP address. The DNS server might be internal to the company, or each computer might be configured to point to the IP address of a DNS server that's serviced by the company's ISP.

Why is port scanning considered legal by most security testers and hackers?

Most security testers and hackers argue that port scanning is legal simply because it doesn't invade others' privacy; it merely discovers whether the party being scanned is available. The typical analogy is a person walking down the street and turning the doorknob of every house along the way. If the door opens, the person notes that the door is open and proceeds to the next house. Of course, entering the house would be a crime in most parts of the world, just as entering a computer system or network without the owner's permission is a crime.

Penetration testers and security testers usually have a laptop computer configured with ____ and hacking tools. a. multiple OSs c. packet sniffers b. tiger boxes d. script kiddies

Multiple OSs

TCP scan with all the packet flags are turned off

NULL scan

Avoid typing when: Someone is nearby Someone nearby is talking on cell phone

Name prevention of shoulder surfing

Nmap Unicornscan Nessus and OpenVAS

Name some port scanning tools

1. Talk with the client about the importance of security and the necessity of testing 2. Prepare NDA (nondisclosure agreement) documents and have the client sign them 3. Prepare an ethical hacking team and create a schedule for testing 4. Conduct the test 5. Analyze the results and prepare the report 6. Deliver the report to the client

Name the ethical hacking assignment six basic steps

port 139

NetBIOS Used by Microsoft's NetBIOS Session Service

To see additional parameters that can be used with the ____ command, you can type nc -h at the command prompt. a. Nslookup c. Netcat b. Namedroppers d. Whois

Netcat

____ is a tool that is used to read and write data to ports over a network. a. Whois c. Metis b. Netcat d. Dig

Netcat

In the TCP/IP stack, the ____________________ layer represents the physical network pathway and the network interface card.

Network

TCP/IP stack Four distinct layers

Network Internet Transport Application

Elaborate on the following statement: "The most difficult job of a security professional is preventing social engineers from getting crucial information from company employees."

No matter how thorough a security policy is or how much money is spent on firewalls and intrusion detection systems (IDSs), employees are still the weakest link in an organization. Attackers know this fact and use it. Employees must be trained and tested periodically on security practices. Just as fire drills help prepare people to evacuate during a fire, random security drills can improve a company's security practices. For example, randomly selecting and testing employees each month to see whether they would give their passwords to someone within or outside the organization is a good way to see if your security memos are being read and followed.

The ____ certification uses the Open Source Security Testing Methodology Manual (OSSTMM), written by Peter Herzog, as its standardized methodology. a. CEH c. CISSP b. OPST d. GIAC

OPST

The ____ certification is designated by the Institute for Security and Open Methodologies (ISECOM), a nonprofit organization that provides security training and certification programs for security professionals. a. CompTIA Security+ b. OSSTMM Professional Security Tester (OPST) c. Certified Information Systems Security Professional (CISSP) d. Certified Ethical Hacker (CEH)

OSSTMM Professional Security tester (OPST)

What is the SANS Institute Top 20 list?

One of the most popular SANS Institute documents is the Top 20 list, which details the most common network exploits and suggests ways of correcting vulnerabilities. This list offers a wealth of information for penetration testers or security professionals.

Even though you might think you're following the requirements set forth by the client who hired you to perform a security test, don't assume that management will be happy with your results. Provide an example of an ethical hacking situation that might upset a manager.

One tester was reprimanded by a manager who was upset that the security testing revealed all the logon names and passwords to the tester. The manager believed that the tester shouldn't know this information and considered stopping the security testing.

What makes the ____________________ tool unique is the ability to update security check plug-ins when they become available.

OpenVAS

____, an open-source fork of Nessus, functions much like a database server, performing complex queries while the client interfaces with the server to simplify reporting and configuration. a. Unicornscan c. OpenVAS b. NetScanTools d. Nmap

OpenVAS

The HTTP ____ allows data to be sent to a Web server. a. GET c. POST b. PUT d. HEAD

POST

TCP header flag used to deliver data directly to an application

PSH

The HTTP ____ method requests that the entity be stored under the Request-URI. a. GET c. POST b. PUT d. HEAD

PUT

The ____ tool can generate a report that can show an attacker how a Web site is structured and lists Web pages that can be investigated for further information. a. Netcat c. Dig b. Paros d. Whois

Paros

In the ____ attack, the attacker simply creates an ICMP packet that's larger than the maximum allowed 65,535 bytes. a. DoS c. buffer overflow b. Ping of Death d. session hijacking

Ping of Death

type of DoS attack

Ping of Death

Some security professionals use fear tactics to scare users into complying with security measures. Is this a good tactic?

Some security professionals use fear tactics to scare users into complying with security measures. Their approach is to tell users that if they don't take a particular action, their computer systems will be attacked by every malcontent who has access to the Internet. This method is sometimes used to generate business for security testers and is not only unethical, but also against the OSSTMM's Rules of Engagement. The rule states: "The use of fear, uncertainty, and doubt may not be used in the sales or marketing presentations, websites, supporting materials, reports, or discussion of security testing for the purpose of selling or providing security tests. This includes but is not limited to crime, facts, criminal or hacker profiling, and statistics." Your approach to users or potential customers should be promoting awareness rather than instilling fear. You should point out to users how important it is not to install computer programs—especially those not approved by the company—on their desktops because of the possibility of introducing malware. Users should be aware of potential threats, not terrified by them.

Why is it important for you as a security tester to understand and be able to create scripts?

Some tools might need to be modified to better suit your needs as a security tester. Creating a customized script—a computer program that automates a task that takes too much time to perform manually—can be a time-saving solution. Fping can use an input file to perform ping sweeps. Creating an input file manually with thousands of IP addresses isn't worth the time. Instead, most security testers rely on their basic programming skills to write a script for creating an input file.

The two most popular spyware and adware removal programs are ____ and Ad-Aware. a. Zone Alarm c. McAfee Desktop Firewall b. BlackIce d. SpyBot

Spybot

____ is a remote control program. a. Slammer c. Symantec pcAnywhere b. BlackIce d. Zone Alarm

Symantec pcAnywhere

The ____ disseminates research documents on computer and network security worldwide at no cost. a. International Council of Electronic Commerce Consultants (EC-Council) b. SysAdmin,Audit,Network, Security (SANS) Institute c. Institute for Security and Open Methodologies (ISECOM) d. International Information Systems Security Certifications Consortium (ISC2)

SysAdmin, Audit, Network, Security (SANS) Institute

accountability

System administrators or concerned authorities need to be able to know by whom, when, how and why system resources have been accessed An audit trail or log files can address this

TCP critical components

TCP flags Initial sequence number (ISN) Source and destination port numbers

The most widely used is protocol is ____. a. IPX/SPX c. TCP/IP b. ATM d. NetBIOS

TCP/IP

transport layer

TCP/UDP services layer is responsible for getting data packets to and from the application layer by using port numbers. TCP also verifies packet delivery by using acknowledgements

tunneling

Takes advantage of the transmission protocol by carrying one protocol over another

____ is a protocol packet analyzer. a. Nmap c. Tcpdump b. Fping d. Nessus

Tepdump

Text file generated by a Web server Stored on a user's browser Information sent back to Web server when user returns Used to customize Web pages Some cookies store personal information Security issue

What are cookies and what do they do?

How can computer criminals use the Whois utility for their purposes?

The Whois utility is a commonly used tool for gathering IP address and domain information. With just a company's Web address, you can discover a tremendous amount of information. Unfortunately, attackers can also make use of this information. Often companies don't realize that they're publishing information on the Web that computer criminals can use. The Whois utility gives you information on a company's IP addresses and any other domains the company might be part of.

What is the binary numbering system and why was it chosen by computer engineers to be used in computers?

The binary system uses the number two as its base. Each binary digit, or bit, is represented by a one or zero. Bits are usually grouped by eight because a byte contains eight bits. Computer engineers chose this numbering system because logic chips make binary decisions based on true or false,on or off,and so forth. With eight bits, a computer programmer can represent 256 different colors for a video card, for example. (Two to the power of eight, or 28, equals 256.) Therefore, black can be represented by 00000000, white by 11111111, and so on.

What is the difference between spyware and adware?

The difference between spyware and adware is a fine line. Both programs can be installed without the user being aware of their presence. Adware, however, sometimes displays a banner that notifies the user of its presence. Adware's main purpose is to determine a user's purchasing habits so that Web browsers can display advertisements tailored to that user. The biggest problem with adware is that it slows down the computer it's running on.

List at least five tools available for footprinting.

The following tools can be used for footprinting: Google groups, Whois, SamSpade, Web Data Extractor, FOCA, Necrosoft NS Scan, Google search engine, Namedroppers, White Pages, Metis, Dig, Netcat, Wget, Paros, and Maltego.

In the context of penetration testing, what is the gray box model?

The gray box model is a hybrid of the white and black box models. In this model, the company gives a tester only partial information. For example, the tester might get information about which OSs are used, but not get any network diagrams.

How does the octal numbering system relate to network security? You may answer this question by providing an example.

To see how the octal numbering system relates to network security, take a look at UNIX permissions. Octal numbering is used to express the following permissions on a directory or a file: Owner permissions, Group permissions, and Other permissions. Setting the permission (rwxrwxrwx) for a directory means that the owner of the directory, members of a group, and everyone else (Other) have read, write, and execute permissions for that directory. Because each category has three unique permissions, and each permission can be expressed as true or false (on or off), three bits are used. You don't need all eight bits because three bits (rwx) are enough. Recall from binary numbering that zero is counted as a number, so with three bits, there are eight possible occurrences: 000, 001, 010, 011, 100, 101, 110, and 111. Using octal numbering, 001 indicates that the execute (x) permission is granted, 010 indicates that the write (w) permission is granted, but not read and execute, and so on.

In the TCP/IP stack, the ____________________ layer is responsible for getting data packets to and from the Application layer by using port numbers.

Transport

port 69

Trivial File Transfer Protocol Used for transferring router configurations

As a security tester, you can't make a network impenetrable.

True

Even though the Certified Information Systems Security Professional (CISSP) certification is not geared toward the technical IT professional, it has become one of the standards for many security professionals.

True

The SysAdmin, Audit, Network, Security (SANS) Institute offers training and IT security certifications through Global Information Assurance Certification (GIAC).

True

TCP packet

Two 16-bit fields Contains source and destination port numbers

Passive: attacker does not interact with the system directly Active: attacker interacts with the target system by using tools to detect open ports, accessible hosts, router locations, network mapping, details of operating systems, and applications

Types of reconnaissance

Unicornscan optimizes ____ scanning beyond the capabilities of any other port scanner. a. TCP c. ICMP b. UDP d. IP

UDP

____ is a connectionless protocol. a. TCP c. FTP b. UDP d. POP3

UDP

____ is a fast but unreliable delivery protocol that operates on the Transport layer. a. IP c. TFTP b. TCP d. UDP

UDP

UDP is an unreliable data delivery protocol. Why is it widely used on the Internet?

UDP is a widely used protocol on the Internet because of its speed. UDP doesn't need to verify whether the receiver is listening or ready to accept the packets. The sender doesn't care—it just sends, even if the receiver isn't ready to accept the packet.

TCP header flag that is used to signify urgent data

URG

____ was developed to assist security testers in conducting tests on large networks and to consolidate many of the tools needed for large-scale endeavors. a. Unicornscan c. Nessus b. NetScanTools d. Nmap

Unicornscan

List the five techniques used by social engineers in their attempts to gain information from unsuspecting people.

Urgency - Quid pro quo - Status quo - Kindness - Position

UDP stands for ____. a. User Datagram Protocol c. User Data Packet b. Universal Datagram Protocol d. Universal Data Packet

User Datagram protocol

worm that uses UDP port 8998 to contact the attacker's server

W32/Sobig.F

internet protocol version 6 (IPv6)

Wasn't designed with security in mind Many current network vulnerabilities

vulnerability

Weakness in a defined asset that could be taken advantage of or exploited by some threat primary entry point an attacker can use to gain access to a system or to its data

A(n) ____ is a 1-pixel x 1-pixel image file referenced in an <IMG> tag, and it usually works with a cookie. a. image bug c. Bugnosis detector b. zone transfer d. Web bug

Web bug

Automates tasks Time saving Requires basic programming skills

What are customized scripts

Trojans to transfer user names, passwords, and any other information stored on the system

What can hackers use trojans for?

Educate users Dumpster diving Proper trash disposal Format disks before disposing them Software writes binary zeros Done at least seven times Discard computer manuals offsite Shred documents before disposal

What can you do to prevent dumpster diving

Discovering system design faults and weaknesses that might allow attackers to compromise a system Keeping informed of new products and technologies in order to find news related to current exploits Checking underground hacking Web sites for newly discovered vulnerabilities and exploits Checking newly released alerts regarding relevant innovations and product improvements for security systems

What does vulnerability research include?

Resolves host names to IP addresses People prefer URLs to IP addresses Extremely vulnerable

What is DNS

Closed port responds with an RST packet

What is FIN scan

Ping multiple IP addresses simultaneously Accepts a range of IP addresses Entered at a command prompt File containing multiple IP addresses Input file Usually created with shell-scripting language

What is FPing

Used to: Perform ping sweeps Bypass filtering devices Allows users to inject modified IP packets

What is Hping

First released in 1998 No longer under GPL license Still available for download

What is Nessus

Originally written for Phrack magazine One of the most popular tools New features frequently added

What is Nmap?

Open-source fork of Nessus Performs complex queries while client interfaces with server Capable of updating security check plug-ins Security test programs (scripts)

What is OpenVAS

Identify which IP addresses belong to active hosts Ping a range of IP addresses

What is Ping sweeps

Stealthy scan

What is SYN scan

FIN, PSH and URG flags are set

What is XMAS scan

Packet flags are turned off

What is a NULL scan

Closed port responds with ICMP "Port Unreachable" message

What is a UDP scan

Used to get past firewall

What is an ACK scan

Completes three-way handshake

What is connect scan?

Looking through an organization's trash for any discarded sensitive information

What is dumpster diving

Use it to increase awareness of their social or political agendas Considered a crime, irrespective of intentions

What is hacktivism used for?

Technique used to exploit the system be pretending to be a legitimate user

What is spoofing

Command: nmap 193.145.85.201 Scans every port on computer with this IP address

What is the standard tool for security professionals

Developed to assist with large network tests Ideal for large-scale endeavors Scans 65,535 ports in three to seven seconds

What is unicornscan

dig and host

What is zone transfer tools

What makes the OpenVAS tool unique?

What makes this tool unique is the capability to update security check plug-ins when they become available. An OpenVAS plug-in is a security test program (script) that can be selected from the client interface. The person who writes the plug-in decides whether to designate it as dangerous, and the author's judgment on what's considered dangerous might differ from yours.

hacktivism

When hackers break into government or corporate computer systems as an act of protest

In the ____ model, the company might print a network diagram showing all the company's routers, switches, firewalls, and intrusion detection systems (IDSs) or give the tester a floor plan detailing the location of computer systems and the OSs running on these systems. a. black box c. red box b. white box d. gray box

White box

The ____________________ utility gives you information on a company's IP addresses and any other domains the company might be part of.

Whois

____ is a tool that is used to gather IP and domain information. a. Whois c. Metis b. Netcat d. Dig

Whois

To identify and correct network vulnerabilities To protect the network from being attacked To get information that helps to prevent security issues To gather information about viruses and malware To find weaknesses in the network and to alert the network administrator before a network attack To know how to recover from a network attack

Why do hackers need vulnerability research?

In order to detect Trojans and compromised files and directories

Why do system administrators deploy host-based IDS

All security testers must be familiar with tool Supports many parameters

Why is Hping a powerful tool

How many host addresses can be assigned with a subnet mask of 255.255.255.0? Give a brief description of how you calculated the result.

With a default subnet mask of 255.255.255.0, 254 host addresses can be assigned to each segment. You use the formula 2x - 2 for this calculation. For this example, x equals 8 because there are eight bits in the fourth octet: 28 - 2 = 254 You must subtract two in the formula because the network portion and host portion of an IP address can't contain all ones or all zeros.

How can DNS be used for footprinting?

Without going into too much detail, DNS uses name servers to resolve names. After you determine what name server a company is using, you can attempt to transfer all the records for which the DNS server is responsible. This process, called a zone transfer, can be done with the Dig command. (For those familiar with the Nslookup command, Dig is now the recommended command.) To determine a company's primary DNS server, you can look for a DNS server containing a Start of Authority (SOA) record. An SOA record shows for which zones or IP addresses the DNS server is responsible. After you determine the primary DNS server, you can perform another zone transfer to see all host computers on the company network. In other words, the zone transfer give you an organization's network diagram. You can use this information to attack other servers or computers that are part of the network infrastructure.

Closed ports respond to a(n) ____ with an RST packet. a. XMAS scan c. Connect scan b. SYN scan d. ACK scan

XMAS scan

in this type of scan, the FIN, PSH, and URG flags are set

XMAS scan

Nmap has a GUI version called ____________________ that makes it easier to work with some of the more complex options.

Zenmap

____ enable you to see all the host computers on a network. In other words, they give you an organization's network diagram. a. Web bugs c. Zone transfers b. Footprints d. Namedroppers

Zone transfers

____ sometimes displays a banner that notifies the user of its presence. a. Spyware c. Webware b. Adware d. Malware

adware

File transfer protocol (FTP)

allows diff OSs to transfer files b/t one anohter

The virus signature file is maintained by ____ software. a. antivirus c. remote control b. keylogger d. firewall

antivirus

In the TCP/IP stack, the ____ layer is where applications and protocols, such as HTTP and Telnet, operate. a. Internet c. Transport b. Network d. Application

application

The ____-layer protocols are the front ends to the lower-layer protocols in the TCP/IP stack. a. Internet c. Transport b. Network d. Application

application

viruses

attaches itself to a file or program Needs host to replicate Does not stand on its own No foolproof prevention method

The ____ vi command deletes the current line. a. d c. dd b. dl d. dw

dd

Which of the following provides the most secure method of securing a company's assets? a. rotary locks c. card access b. combination locks d. deadbolt locks

card access

In any *NIX system, after saving a script, you need to make it executable so that you can run it. From the command line, type ____. a. chmod +execute script_name c. chmod -execute script_name b. chmod +x script_name d. chmod -x script_name

chmod +x script_name

does not allow entry or access to a service

closed port

Components High-order nibble: left side Low-order nibble: right side

components of nibbles

The U.S. government now has a new branch of computer crime called __________________________________________________.

computer hacking and intellectual property (CHIP) CHIP computer hacking and intellectual property

____________________ is defined as securing a stand-alone computer that's not part of a network infrastructure.

computer security

The ____ relies on the OS of the attacked computer, so it's a little more risky to use than the SYN scan. a. NULL scan c. XMAS scan b. connect scan d. ACK scan

connect scan

similar to the SYN scan, except that it does complete the three-way handshake

connect scan

Employees of a security company are protected under the company's ____________________ with the client.

contract

A(n) ____________________ is a text file generated by a Web server and stored on a user's browser.

cookie

Those who break into systems to steal or destroy data are often referred to as ____________________.

crackers