GFACT

Classless Inter-Domain Routing (CIDR)

(CIDR) is pronounced 'cider'. In CIDR, the number after the '/' at the end of an IP address is the number of bits for the network identifier. 192.168.0.0 with the subnet mask of 255.0.0.0 (network identifier is 192.) would be written 192.168.0.0/8, and with a subnet mask of 255.255.255.0 (network identifier is 192.168.0), it would be 192.168.0.0/24.

1024?!

1 kilobyte = 1024 bytes. IEC introduced KiB instead: 1 byte is 8 bits. 1 kibibyte (KiB) is 1024 bytes. 1 mebibyte (MiB) is 1024 kibibytes. 1 gibibyte (GiB) is 1024 mebibytes. 1 tebibyte (TiB) is 1024 gibibytes.

Client errors

400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 408 Request Timeout

Boolean Logic

A boolean value is a value that can be either true or false. This kind of value is perfect for computers, which talk in bits: either a 1 or a 0. In other words, bits are Boolean values, like a switch they can be either on or off.

Buffer Overflows 1

A buffer overflow comes when the user can input something into the program.

Command Injection Identification

A command injection flaw in a web application takes advantage of the manner in which web applications process user input and pass it to the command line to perform a task.

Commits

A commit is an incremental change to the repository.

Computer Program

A computer program is a series of instructions to the processor of a computer.

Conditionals

A conditional allows us to check if certain conditions are being met before we run certain parts of the program.

Constraints

A constraint defines the rules for that field in the table. E.G. default NULL.

Authoritative Name Servers

A name server that is authoritative for a domain is one that controls the mapping between the domain name and the IP address. It has the final say on where the domain points.

Bootloader

A program that is loaded by the BIOS when a computer is first turned on, and is responsible for loading the operating system. Installed at the same time as the operating system, on the hard drive.

Active Directory

A system that allows the server to communicate with Windows desktops, allowing the administrator to easily configure all the connected desktops from one location, amongst other uses which we will cover in future modules. Active Directory allows administrators to configure settings on Windows desktops that are connected to a Windows server.

ARP Cache

ARP (address resolution protocol) is a protocol used on local networks to map IP addresses to MAC addresses. When a computer receives an ARP response, it saves it into the ARP cache.

Adding a new user

Adding a new user is as simple as running: net user /add <username> <password> This command will create a new user and set the password to what you specified. You can do so much more when creating users this way, such as configuring account expiry and setting times where the account can log on.

ASLR

Address Space Layout Randomisation is a protection that involves randomising the memory addresses that a program gets loaded into on each run.

ASCII

American Standard Code for Information Interchange. A table that maps binary to characters. Originally 7 bits wide for up 127 characters. Now is 8 bits wide and up to 255 characters.

Application Layer

An example of an application layer protocol is something like HTTP or FTP. HTTP GET request is an application layer protocol because the web browser will form the request necessary for displaying a page or submitting a form.

Command line user management

Another great time to head to the terminal is when you need to manage users on a machine.

Asymmetric cryptography

Asymmetric cryptography, you have two keys, a public and a private. You can lock the message with whichever one you would like, but you must unlock it with the opposite key.

Asymmetric Encryption

Asymmetric encryption: every party generates two encryption keys: one is private and one is public. The public encryption key is the one you send to whoever needs to communicate with you securely. The private encryption key should remain private only to you.

Audio Steganography

Audio steganography is a technique used to embed secret messages into digital audio. There are various methods of audio steganography, such as LSB and Echo Hiding.

Base 64

Base64 is a group of binary to text encoding systems that represent binary data in ASCII format. Each Base64 digit represents 6 bits of data; three 8 bit bytes can therefore be represented by four 6 bit Base64 digits.

BIOS

Basic Input Output System, is a program stored on the motherboard of your computer. When the computer is first turned on, it is the first program that is loaded, and prepares, or initialises, the hardware ready to load the bootloader. Modern computers use UEFI (Unified Extensible Firmware Interface).

Block Storage

Block storage is one of the more common forms of storage you will see on the cloud. It is also utilised in a Storage Area Network (SAN).

Branches

Branches in Git allow you to work on specific features independently, without touching the code in master.

Command line networking

By opening up Command Prompt and typing ipconfig you can access the current settings.

C

C is a fairly low-level programming language, it was created in 1972, and it was based on a programming language called B.

C

C isn't strictly a low-level programming language, but it's close.

CEO Fraud

CEO fraud is a type of spear phishing attack, although some people call it 'whaling', to indicate that the target is huge.

Chain of Custody

Chain of custody is vital to maintain the legal worthiness of the evidence.

Classes and Objects

Classes and objects are powerful object oriented mechanisms to organise your code and how parts of it interact.

Buffer Overflows 2

Code and data are just data, it depends on whether something reads them or executes them. This interpretation can be abused.

Analytics

Collecting stats and analysing interactions on a web server.

Companies House

Companies House is also a good information resource, but it typically only carries information on the officers of the company.

Connectors

Connectors that power supplies use are a four pin peripheral connector used for powering fans. SATA (Serial ATA) power connector, is for powering hard drives. Main ATX connection that runs to the motherboard, provide a 20 pin connector (provides extra pins). 12V power connector which runs to the motherboard (provides extra pins). PCI-E power connector, runs to a graphics card (provides extra pins).

Containers

Containers are powerful and lightweight ways to package an application, library and configuration for testing, replication, development or production.

Binary

Counting in binary is very similar to counting in denary. First, let's calculate the headings: 2^0 = 1 (Anything to the power of 0 is 1.) 2^1 = 2 (Anything to the power of 1 is itself!) 2^2 = 4. 2^3 = 8 (2 x 2 x 2 = 8). 2^4 = 16 (2 x 2 x 2 x 2 = 16). 1 KiB is 1024 bytes because 2^10 = 1024

Anti Forensics

Cyber criminals improve and modify their operational security (OpSec) in order to avoid being caught. NotPetya is part of the Petya family of encrypting ransomware that targets Microsoft Windows based systems.

Blue Team

Defensive; responsible for setting up secure network infrastructure, monitoring this infrastructure and responding to attacks.

/ qn

Don't launch with a graphical user interface.

/quiet

Don't show the user any messages.

/i

Don't try to run as administrator, run as a normal user instead (this won't matter because of AlwaysInstallElevated).

Capacity

Each drive has a maximum capacity, the largest amount of data that can be stored on the drive itself. Drives usually have a maximum capacity that is slightly lower than their advertised value. 4 TB drive cannot actually store 4 TB of data. The capacity will be about 3.8 TB.

Cloud Management Chart

Helps you identify the portions of control you typically get with each provider.

Caching

If a name server makes a query and discovers the IP address a domain points to, it can cache the result for a time. Future requests for that domain will use the saved value, to save from the name server having to make the request every time.

Bootkits

If malware can run at a high enough privilege level, it can write directly to the disk without having to use the file system as an intermediary.

Arrays

In C, you have to specify the type of the array when you create it, and it can only ever hold that type of data. You can't mix and match within the same array.

Conditionals

Learn how to use conditionals in C to control program flow.

Conditionals and lists

Lists are an important kind of data while programming, and conditionals also allow us to check if a value is in a list, or not in a list.

Add-ins

Microsoft Word allows for third parties to write 'add-ins', which extend the functionality of Microsoft Word.

Buffer Overflows 3

Mitigations have been built in to the OS given the frequency of buffer overflow mistakes. They are not a silver bullet but reduce exploitability.

Alternative Search Engines

No two search engines are the same. Alternative Search Engines - Google, Bing, Yahoo, DuckDuckGo, archive.org

Buses

Physical connections between the components that connect to the motherboard. Allows the components to communicate with each other.

Aliases

PowerShell comes with several aliases set up for common cmdlets. cat, cd, dir, ls, rm

Calculator

Search engines like Google have various apps you can call on, like calc, or co-ordinate converts, or currency

AlwaysInstall Elevated

Some administrators will configure this so that users can install software on their computers without administrator approval.

apropos

The 'apropos' tool is used to search man pages for keywords, usually to find the 'appropriate' tool to use in a particular situation. The 'apropos' command is used to find the 'appropriate' tool for a particular job.

Arguments

The 'argc' variable is an integer which contains the number of arguments passed to the program when it was executed. The 'argv' array contains the data passed in.

cat

The 'cat' command stands for 'concatenate'. It's used for joining the contents of several files together and then printing the result to the terminal. Most commonly it is used on just a single file to print the contents to the screen quickly.

Changing user groups

The 'net' utility is also where you go to manage the groups a user is a member of. To do this you will need to use net localgroup. When you create a new user, by default they are just a standard user, so to gain higher privileges they need to be added to the Administrators group. To check current group membership run: net user <username>

AS

The AS keyword is used to assign an alias to a table or field.They are used to make long SQL statements more readable, more descriptive or set the table headings for a query to make the results more descriptive.

ARP

The Address Resolution Protocol translates IP addresses to MAC addresses for transmission purposes. ARP is only for the local network.

APFS

The Apple File System supports permissions and encryption, and duplicate files can be stored without using additional space, with changes to one copy of a file being saved as a delta (the difference between the old file and the new file) to lower space requirements.

Arithmetic Logic Unit (ALU)

The Arithmetic Logic Unit is the part of the CPU responsible for performing arithmetic and logical operations.

Command Prompt

The Command Prompt is a command line interpreter (CLI) application available on most Windows operating systems. The Command Prompt is officially called the "Windows Command Processor" but is generally referred to as the command shell or prompt, and sometimes by its filename cmd.exe. When we open the prompt with the cmd command, even if our user account is an administrator, the prompt is opened as a standard user. If you need an administrative prompt you need to explicitly request it.

Clickjacking Mitigation

The X-Frame-Options header should have one of three values: DENY, SAMEORIGIN, ALLOW-FROM domain.com

apt-get

The apt command is incredibly useful to rapidly find, install, or remove software. The way 'apt' works is by having a list of 'sources'; these are servers which contain information about available packages, download links and version information. 'apt update' only updates the list of available packages.

Assertions

The assert function will cause the program to crash with the error message we provided if a condition is not met.

Authoritative nameserver

The authoritative nameserver will retrieve the specific IP address of the origin server for the provided web domain name, which the resolver will pass back to the client.

Command Injection Mitigation

The best way to prevent a command injection vulnerability is to program the application to do the work instead of using third party command line programs.

Client-Side

The client-side is the device that is being used to connect to the web site.

Bypassing UAC

The easiest way to bypass UAC is simply to ask the user for permission.

Changing directory

The first command you're going to need is cd, this enables you to change directory (move to a different folder). For example cd \ will take you to the root of the file system.

Breaking Encryption

The first method is to find a flaw in the encryption algorithm. The other way to break encryption is to guess the encryption key that was used.

ARP Spoofing / Poisoning

The flaw in the ARP protocol comes because, if an ARP response is sent to a computer, it will store that value in its ARP cache even if it didn't make an ARP request asking for a response.

Automatically Decoding Encoding

The purpose of encoding is to enable us to fit data that we need to store or transmit within a set of constraints that are suitable to the storage or transmission medium. Encoding is often used with encryption to make the results transmissible.

Bits

The smallest unit of data stored on a computer system. Only be two possible values stored in a single bit: a '1' or '0'. Known as a 'boolean', or 'bool', can only have two values. 4 bits (half a byte) is a nibble,1 byte is 8 bits, 1 kilobyte (kB) is 1000 bytes, 1 megabyte (MB) is 1000 kilobytes, 1 gigabyte (GB) is 1000 megabytes, 1 terabyte (TB) is 1000 gigabytes.

Clock Speed

The speed at which a processor can understand and execute instructions. Measured by executed instructions per second. E.G. a processor that can excecute one instruction per second has a clock speed of 1Hz (hertz). 4GHz can execute 4 billion instructions per second.

Compatibility

The two factors to pay attention to with RAM are type and speed. DDR# stands for double data rate, with the # (3,4 or 5) meaning the generation. Faster RAM is better. The speed of RAM is measured in MHz. DDR3-2133 RAM is DDR3 RAM with a max speed of 2133 MHz.

Comparison operators

There are several different ways of comparing things in conditionals. Equal to == Not equal to != Less than < Greater than > Less than or equal to <= Greater than or equal to >=

Comments

There are two types of code comments in C. The first is the double forward-slash (//). The second type of comment is the multi-line comment /* */.

Clearing the Terminal

There are two ways to clear the text on the terminal; the first is just to type - $ clear. CTRL + L which has the same function as 'clear'.

Character Types

There is no string data type in C. If you want a string, you have to make an array of characters.

Code Comments

This allows us to add notes and narration into our code without having to worry about syntax

Code Smells

This is a term programmers generally use to refer to visual symptoms that code has deeper underlying problems. Often, code that "smells" is confusing to understand.

Changing drives

To access another drive, we just type that drive's letter, followed by ":". For instance, if you wanted to change the drive from "C:" to "D:", you should type "d:" and then hit enter on your keyboard.

Command Injection Exploitation

To check that there is a command injection flaw here, we'll have to attempt to exploit it.

Break

Using a keyword allows us to immediately break out of a loop without executing any more code inside it, or requiring us to check the condition.

Checking multiple conditions

Using the 'and' to connect our two conditions in a single if statement. 'Or' an if statement that contains an 'Or' like this will run as soon as one condition is met.

Advanced Memory Forensics with Volatility

Volatility is one of the most widely used memory forensics tools. Useful Volatility commands: imageinfo - vol.py or volatility -f memdump.mem imageinfo

Alternate Number Bases

We are very used to counting in base 10, but other number bases like base 16 (hex) or base 2 (binary) are incredibly useful in computing.

Chaining Commands

We can chain commands together to run one after the other on one line. We can also use pipes and redirects if we want to. (Chain demo on page 187)

Compiled vs Interpreted

When a programming language is compiled, it is converted into machine code and then saved that way as an executable file. When a programming language is interpreted, the code is converted and executed at the time the user runs the program, and the converted instructions are not saved.

Clickjacking

When an attacker can trick a user in to clicking something without realising.

Cloud Storage Mechanisms

When it comes to storing data on the cloud there are three mechanisms that we must discuss. These are: File Block Object

Commands and Colons

You can restrict a Google search to a particular site using the site:. The most useful is filetype which can narrow down a search to files of a particular type.

Changing Directory

cd - stands for 'change directory'. Allows us to change directory into a different folder. To get back to the home folder, we could do one of three things. cd /home/user, cd ~, cd .. | pwd - print working directory, shows the path of the current working directory.