What is true about Nikto? (3 answers)

detects vulnerabilities such as programming errors or malicious files, is open-source software used to scan & detect web app vulnerabilities, has scanning & monitoring capabilities covering various web servers

The best way to defend a certain Linux kernel is to what?

keep the kernel patched and updated

What is true about HASHCAT? (3 answers)

is multi-Algorithm based, originally designed for password recovery, is multi-hash and multi-OS based

What is true about Burp Suite Professional (3 answers)

has the techniques & methodologies used for manual pen testing audits, the most common tool used by penetration testers, offers both Passive and Active Scanning mode

What is not a Code of Ethics for a Pen Tester?

the use of illegal means as a method of accomplishing the goals

What are the ways to mitigate Windows Local PE? (3 answers)

Encrypt the Drive, BIOS Password, Limit physical access to the hardware.

If an attacker maniplulates the GRUB what will happen? (2 answers)

a new user can be added to the system, a rescue shell will run with root-level privileges

As part of the organization's activities, many parameters are tested against the regulation, what are they? (3 answers)

User activity, Administrators, Information Sensitivity

What is Nmap used for? (2 answers)

OS detection, Reveals hosts and which services are running on the target server

What is not true about Netdiscover?

Can jump between each ARP request

What is true about VEGA (3 answers)

focuses on SQL and XSS injections, open-source vulnerability scanner, can help less experienced penetration testers categorize findings

What are examples of SQL injection attacks? (3 answers)

Boolean-Based, Time-Based, Error-Based

studbud

Ethical Hacking Final Prep

97 termsStudBud Administration149 plays

Imported from external platform

Flashcards97 cardsFPractice quizPHost liveL

Questions 97

Answers

1
With Hashcat, an attacker doesn't have to specify the type of the hash.
False
True
2
Developers use the prepared statement function to make all special characters appear as what?
SQL statement
interger
SQL command
string
3
Reg users can typically only access their files & applications, but can work with other system settings and directories.
False
True
4
What scanner has manual pen testing, is the most common used and has active/passive scanning?
BURP SUITE
ZAP
VEGA
ACUNETIX
5
What is not a Client Side Technology?
JavaScript
CSS
JSP
HTML
6
If your company wants to be PCI DSS compliant, this would involve what?
US dollars
credit cards
bitcoin
money transfers
7
Common, easy-to-use, C-based scripting language is what?
CGI
C++
PHP
ASP
8
Administrators can access regular user accounts and can access all lower-level system settings.
False
True
9
If an Automated Scanning Type uses a proxy, what type of scanning is this?
POC
Projection
Progressive
Passive
10
WannaCry encrypted files in the system and sent a pop-up message to the victim.
False
True
11
This account can access all system settings and directories, including low-level data.
Admin
Absolute Root
Executor of All
NT Authority
12
What is true about Nikto? (3 answers)
detects vulnerabilities such as programming errors or malicious files
is open-source software used to scan & detect web app vulnerabilities
has scanning & monitoring capabilities covering various web servers
uses complex syntax
13
GDPR regulates sensitive information about what clients?
European
Indian
American
African
14
160-bit cryptographic hash.
SHA-1
SHA-111
SHA-11
SHA-16
15
Can access any resource in the entire organization.
Escalated Admin
Elevated Admin
Emperor Admin
Enterprise Admin
16
The Nmap scripting engine can use what type of scripts to automate processes and check for vulnerabilities?
Lagos
Lerk
Lua
Lana
17
The best way to defend a certain Linux kernel is to what?
keep the kernel patched and updated
restrict access on http
manipulate the kernel into running a certain payload
give all users write access to read-only memory
18
The WannaCry malware was able to spread to all unpatched Windows systems from what to what?
7 to 2016
8 to 2016
XP to 2016
ME to 7
19
What enabled service did WannaCry find a vulnerability?
SMB
FTP
HTTP
POP
20
What is true about HASHCAT? (3 answers)
is multi-Algorithm based
supports around 110 different hash types and four attack modes
originally designed for password recovery
is multi-hash and multi-OS based
21
What is true about Burp Suite Professional (3 answers)
has the techniques & methodologies used for manual pen testing audits
provides a proof of concept
the most common tool used by penetration testers
offers both Passive and Active Scanning mode
22
What is a popular tool for Kali Linux systems and is often used to initiate On-Path attacks?
dSniff
echo 1
Arpspoof
NTAT
23
What automated web app scanning tool explores the site’s structure & crafts an auto pen testing report?
NETSPARKER
NETDISCOVER
ACUNETIX
WEC.ACME
24
What exploitation tool, which was developed by NSA (National Security Agency) and was used in the WannaCry attack?
Citadel
EternalBlue
Escapade
DeedAbuse
25
What is not a Code of Ethics for a Pen Tester?
consider the client’s location
must be up to date regarding current laws
signing a non-disclosure agreement to protect clients
the use of illegal means as a method of accomplishing the goals
26
Manipulating the file name is an optional feature to hide the fact that it is indeed an executable. What would you use?
Right-to-Right Override
Left-to-Right Override
Left-to-Left Override
Right-to-Left Override
27
What are the ways to mitigate Windows Local PE? (3 answers)
Encrypt the Drive
BIOS Password
Override sethc.exe
Limit physical access to the hardware.
28
Which example of hashing uses salting and timestamps to prevent PTH?
SHA-256
PBKDF2
MD5
NetNTLM
29
As a means of protection against SQL injection, a developer should not allow what on the server-side?
special characters
decimals
numbers
uppercase characters
30
What enables direct execution of commands on servers?
CGI
Cobalt
SQL
JSP
31
If an attacker maniplulates the GRUB what will happen? (2 answers)
give the attacker write access to read-only memory
a new user can be added to the system
can view a file's permissions by reviewing the output
a rescue shell will run with root-level privileges
32
In SFX, because an actual .docx file is open, the user should not suspect that an .exe is running.
True
False
33
What scanner would you use if you wanted to find vulnerabilities such as: DOS, Misconfiguration or Infrastructure?
BURP SUITE
NESSUS
NETSPARKER
ZAP
34
As part of the organization's activities, many parameters are tested against the regulation, what are they? (3 answers)
Chief Information Security Officer (CISO)
User activity
Administrators
Information Sensitivity
35
user=‘admin’ or 1=1, is always a true statement.
True
False
36
256-bit cryptographic hash, used mainly in SSH and SSL cryptography.
SHA-SSL
SHA-160
SHA-256
SHA-128
37
Any company that wants to be certified in information security management, must deal with what regulator?
ICM/IDC
ISM/IBO
IPS/IDS
ISO/IEC
38
Which scanner uses a GUI?
Nmap
Yenmap
Zenmap
Gmap
39
Which SQL query puts new data into a database?
ADD
INSERT INTO
ALTER DATABASE
UPDATE
40
What are two main On-Path attack positions that can be used by the attacker? (2 answers)
WANs
Wireless
Wired
LANs
41
What is Nmap used for? (2 answers)
OS detection
UDP/IP packet assembly
TCP/IP packet assembly
Reveals hosts and which services are running on the target server
42
If an Automated Scanning Type inspects a page via fuzzing, what type of scanning is this?
Active
Access
Action
Available
43
Which SQL injection focuses on detecting changes when injecting TRUE or FALSE statements?
URL-Based
Date-Based
Boolean-Based
Script-Based
44
What is not true about Netdiscover?
Can jump between each ARP request
Works in active and passive modes
Produces a live display of identified hosts
Dedicated to networks without DHCP
45
Re-encoded text hashed with MD4. Used in Windows OS.
NTLM
MD4NTLM
NetNTLM
PBKDF2
46
If you were an inexperienced pen tester and need to do SQL and XSS testing what would you use?
BURP SUITE
NIKTO
ACUNETIX
VEGA
47
What is true about VEGA (3 answers)
focuses on SQL and XSS injections
written in Java, command line based, and runs on Linux, but not Windows
open-source vulnerability scanner
can help less experienced penetration testers categorize findings
48
What scanner would you use if you wanted to see back and forth traffic and were network troubleshooting?
BURP SUITE
ZAP
Wireshark
ACUNETIX
49
What are examples of SQL injection attacks? (3 answers)
Boolean-Based
Time-Based
Error-Based
Date-Based
50
To create a malicious SFX, what two things are required? (2 answers)
HiddenEye
BadUSB
legitimate document
payload
51
What scanner provides a proof of concept and can parse JavaScript?
NETSPARKER
ZAP
VEGA
NETDISCOVER
52
The user can change the GRUB setting by pressing what key on the keyboard when GRUB starts?
E
X
Z
F
53
To obtain the client's cookie, an attacker may use what? (2 answers)
jQuery
XHR
HRX
sQuery
54
To create the SFX, add all files into what?
archive file
zip file
document file
cmd
55
Session hijacking can lead to what? (2 answers)
RCE
user data disclosure
privilege escalation
Redis
56
What cookie parameter does not allow JavaScript to access the cookie & protects against XSS attacks?
httponly
value
session
expire
57
Setting a GRUB password may protect the computer and prevent the boot order from being changed.
False
True
58
To route traffic from the victim to the router, and vice versa, what should be done first on the Kali machine?
# echo 1 > /proc/sys/net/ipv4/ip_forward
# arpspoof -i eth0 -t 10.0.3.4 10.0.3.1
netsh interface IP delete arp cache
arpspoof -i eth0 -t 10.0.3.4 10.0.3.1
59
What is true about Manual Vulnerability Testing? (2 answers)
do not require a fixed script
flexible
no customization
work with static variables
60
What cookie parameter protects against a cross-site request forgery (CSRF) attack?
RFI
fopen=off
Wscript
samesite
61
What is the most common among SQL injection attack that enables dynamic data retrieval from multiple tables?
Time-Based
UNION-Based
URL-Based
UNIQUE-Based
62
What is not considered a SE attack method?
Physiological
Computer-Based
Physical
Phone-Based
63
SE is not based on programming flaws or operating system errors, but rather on the human factor.
False
True
64
Hashcat syntax is a bit tricky and doesn’t have a hash analyzer.
True
False
65
What technologies can Nessus scan for? (3 answers)
critical infrastructure
compliance audits
BOTNETS
operating systems
66
The main advantage of Automated Scanning is what? (2 answers)
performed regularly
locate more complex and less obvious vulnerabilities
work with dynamic variables
lower cost
67
128-bit cryptographic hash that has been considered vulnerable since 2013.
MD5
SHA-10
SHA-2
SHA-12
68
What is the most common example of a Stored XSS?
within a tag, an attribute, or plain text
user login screen
a blog that loads all user comments when a page is visited
inconspicuous place, such as the user agent or a cookie
69
Have the highest level of administrative permission within the domain.
Deity Admin
Domain Admin
Dominate Admin
Destroyer Admin
70
If you want to be SOX compliant, your regulator is who?
Federal Energy Regulatory Commission
Securities and Exchange Commission
Bureau of Safety and Environmental Enforcement
The Pipeline and Hazardous Materials Safety Administration
71
What is true about Netsparker? (3 answers)
contains a spider and a fuzzer
an application rather than a web interface
can automatically parse, execute and analyze the output of JavaScript
provides a proof of concept (POC) to the attacker
72
ro initrd=/install/initrd.gz to rw init=/bin/bash does what to the GRUB?
change from read only to read write
adds an existing user to sudo group
generates a hash in the pbkdf2
restricts access
73
What is true about ZAP? (3 answers)
free graphical tool for web application security testing
written in Java and developed by the OWASP community
contains extensions that are similar to Burp Suite
stands for Zual Attack Proxy
74
What are examples of vulnerabilities and exposures Nessus can scan for? (3 answers)
Unauthorized control or access to sensitive data on a system
Denials of Service
Complex passwords
Misconfiguration
75
How much was the randsom amount in the WannaCry attack?
1000 Iraqi Dinars
500 Gold Sovereigns
400 Great British Pounds
600 US Dollars in Bitcoin
76
What scanner would you use if you needed to find out about hosts and services running and what type of OS?
NETSPARKER
NIKTO
NMAP
NESSUS
77
Masscan has the ability to do what? (2 answers)
use continuously variable transmission
use asynchronous transmission
send 10 thousand packets per second
Internet scale scans
78
What is not a primary added value of Zenmap over Nmap?
visualizations of topologies
banner grabbing techniques
host details
sub-menus
79
Which SQL query is used to combine the result sets of 2 or more SELECT statements?
CONCATENATE
JOIN
MERGER
UNION
80
What is true about GRUB? (2 answers)
responsible for bootloading most Linux systems
executes the kernel
contains all system user account data required for the login process
executes INIT
81
JavaServer Pages are web containers that are also known as what?
piglets
servlets
jslets
javlets
82
Cookie stealing cannot be used to hijack sessions and replace original cookies
True
False
83
What XSS attack is the most most common type and inject JavaScript code to the site/server & returns as a code snippet?
Reflected XSS
POST XSS
Blind XSS
Stored XSS
84
Which SQL query extracts data from a database?
SELECT
PRINT
JOIN
AFTER
85
What is Wireshark used for? (3 answers)
captures and displays data traveling back and forth on a network
network troubleshooting
scanning the most popular vlans
used to test software
86
Stored XSS occurs when a JS payload is stored on a vulnerable site’s server.
False
True
87
What is true about Acunetix? (3 answers)
explores the site’s structure and attempts to locate available pages
crafts an auto pen testing report, downloaded from it's report dashboard
a automated web application scanning tool
contains an AJAX Spider
88
Users responsible for controlling and enforcing specific roles and features, and usually have limited privileges.
Dominate Admin
Delegated Admin
Deity Admin
Domain Admin
89
What scanner would you use if you wanted to scan for web app vulner such as malicious files or programming errors?
NIKTO
NETSPARKER
NESSUS
VEGA
90
What XSS attack is the most advanced and affects the browser without server interaction?
Stored XSS
POST XSS
Blind XSS
DOM XSS
91
What is not part of Stage 1 ARP Poisoning Breakdown?
# echo 1 > /proc/sys/net/ipv4/ip_forward
the attacker will “trick” the default gateway (the router)
The attacker makes the victim believe that its machine is default gateway .
# arpspoof -i eth0 -t 10.0.3.4 10.0.3.1
92
What scanner is OWASP sponsored, written in JAVA and is similar to BURP SUITE?
ZAP
JSP
VEGA
CGI
93
SFX does not have a built-in option to hide the files.
True
False
94
Which SQL injection relies on the server to reveal data as part of an error that may occur?
Error-Based
URL-Based
Time-Based
UNION-Based
95
Telecommunication-related hacking is called what?
phaking
freaking
faking
phreaking
96
One of the first steps in performing an SQL injection is to try to enumerate what? (3 answers)
text files
tables
databases on the server
columns
97
A SFX icon can be generated to resemble what? (3 answers)
Word document
Excel document
a PDF
an image

Ethical Hacking Final Prep Flashcards | StudBud