As part of the organization's activities, many parameters are tested against the regulation, what are they? (3 answers)

Information Sensitivity, User activity, Administrators

What is true about Nikto? (3 answers)

detects vulnerabilities such as programming errors or malicious files, is open-source software used to scan & detect web app vulnerabilities, has scanning & monitoring capabilities covering various web servers

What is the most common example of a Stored XSS?

a blog that loads all user comments when a page is visited

What is true about Manual Vulnerability Testing? (2 answers)

do not require a fixed script, flexible

Masscan has the ability to do what? (2 answers)

Internet scale scans, use asynchronous transmission

What is true about Acunetix? (3 answers)

a automated web application scanning tool, explores the site’s structure and attempts to locate available pages, crafts an auto pen testing report, downloaded from it's report dashboard

What are examples of vulnerabilities and exposures Nessus can scan for? (3 answers)

Unauthorized control or access to sensitive data on a system, Misconfiguration, Denials of Service

What are examples of SQL injection attacks? (3 answers)

Error-Based, Time-Based, Boolean-Based

What are the ways to mitigate Windows Local PE? (3 answers)

Encrypt the Drive, Limit physical access to the hardware., BIOS Password

The main advantage of Automated Scanning is what? (2 answers)

lower cost, performed regularly

studbud

Duplicate of Ethical Hacking Final Prep

97 termsStudBud Administration46 plays

Imported from external platform

Flashcards97 cardsFPractice quizPHost liveL

Questions 97

Answers

1
What is the most common among SQL injection attack that enables dynamic data retrieval from multiple tables?
UNIQUE-Based
Time-Based
UNION-Based
URL-Based
2
As part of the organization's activities, many parameters are tested against the regulation, what are they? (3 answers)
Chief Information Security Officer (CISO)
Information Sensitivity
User activity
Administrators
3
Administrators can access regular user accounts and can access all lower-level system settings.
True
False
4
user=‘admin’ or 1=1, is always a true statement.
False
True
5
Common, easy-to-use, C-based scripting language is what?
PHP
C++
ASP
CGI
6
What scanner would you use if you wanted to find vulnerabilities such as: DOS, Misconfiguration or Infrastructure?
NESSUS
ZAP
BURP SUITE
NETSPARKER
7
What XSS attack is the most advanced and affects the browser without server interaction?
Blind XSS
DOM XSS
Stored XSS
POST XSS
8
If an Automated Scanning Type uses a proxy, what type of scanning is this?
Progressive
POC
Projection
Passive
9
Which example of hashing uses salting and timestamps to prevent PTH?
PBKDF2
NetNTLM
SHA-256
MD5
10
What is true about Nikto? (3 answers)
detects vulnerabilities such as programming errors or malicious files
uses complex syntax
is open-source software used to scan & detect web app vulnerabilities
has scanning & monitoring capabilities covering various web servers
11
What is not a primary added value of Zenmap over Nmap?
host details
visualizations of topologies
sub-menus
banner grabbing techniques
12
A SFX icon can be generated to resemble what? (3 answers)
Excel document
Word document
a PDF
an image
13
What is not considered a SE attack method?
Phone-Based
Computer-Based
Physiological
Physical
14
What scanner would you use if you wanted to see back and forth traffic and were network troubleshooting?
BURP SUITE
ACUNETIX
ZAP
Wireshark
15
What is the most common example of a Stored XSS?
inconspicuous place, such as the user agent or a cookie
a blog that loads all user comments when a page is visited
within a tag, an attribute, or plain text
user login screen
16
Have the highest level of administrative permission within the domain.
Deity Admin
Destroyer Admin
Dominate Admin
Domain Admin
17
What is not a Client Side Technology?
CSS
JavaScript
JSP
HTML
18
What is true about Manual Vulnerability Testing? (2 answers)
work with static variables
do not require a fixed script
flexible
no customization
19
Can access any resource in the entire organization.
Elevated Admin
Emperor Admin
Enterprise Admin
Escalated Admin
20
What are two main On-Path attack positions that can be used by the attacker? (2 answers)
Wired
LANs
WANs
Wireless
21
Masscan has the ability to do what? (2 answers)
send 10 thousand packets per second
Internet scale scans
use asynchronous transmission
use continuously variable transmission
22
What is true about Acunetix? (3 answers)
a automated web application scanning tool
contains an AJAX Spider
explores the site’s structure and attempts to locate available pages
crafts an auto pen testing report, downloaded from it's report dashboard
23
Which SQL query puts new data into a database?
INSERT INTO
UPDATE
ALTER DATABASE
ADD
24
Which SQL injection relies on the server to reveal data as part of an error that may occur?
UNION-Based
Error-Based
Time-Based
URL-Based
25
WannaCry encrypted files in the system and sent a pop-up message to the victim.
True
False
26
What exploitation tool, which was developed by NSA (National Security Agency) and was used in the WannaCry attack?
Citadel
EternalBlue
Escapade
DeedAbuse
27
What cookie parameter protects against a cross-site request forgery (CSRF) attack?
samesite
RFI
Wscript
fopen=off
28
What are examples of vulnerabilities and exposures Nessus can scan for? (3 answers)
Unauthorized control or access to sensitive data on a system
Misconfiguration
Complex passwords
Denials of Service
29
Stored XSS occurs when a JS payload is stored on a vulnerable site’s server.
False
True
30
Any company that wants to be certified in information security management, must deal with what regulator?
ISM/IBO
IPS/IDS
ICM/IDC
ISO/IEC
31
What enabled service did WannaCry find a vulnerability?
FTP
SMB
POP
HTTP
32
Telecommunication-related hacking is called what?
phaking
phreaking
freaking
faking
33
What are examples of SQL injection attacks? (3 answers)
Date-Based
Error-Based
Time-Based
Boolean-Based
34
What XSS attack is the most most common type and inject JavaScript code to the site/server & returns as a code snippet?
Blind XSS
POST XSS
Reflected XSS
Stored XSS
35
256-bit cryptographic hash, used mainly in SSH and SSL cryptography.
SHA-SSL
SHA-128
SHA-160
SHA-256
36
What scanner would you use if you needed to find out about hosts and services running and what type of OS?
NIKTO
NMAP
NESSUS
NETSPARKER
37
What scanner is OWASP sponsored, written in JAVA and is similar to BURP SUITE?
VEGA
ZAP
CGI
JSP
38
If your company wants to be PCI DSS compliant, this would involve what?
bitcoin
credit cards
money transfers
US dollars
39
JavaServer Pages are web containers that are also known as what?
piglets
javlets
jslets
servlets
40
What are the ways to mitigate Windows Local PE? (3 answers)
Encrypt the Drive
Limit physical access to the hardware.
Override sethc.exe
BIOS Password
41
The main advantage of Automated Scanning is what? (2 answers)
work with dynamic variables
lower cost
locate more complex and less obvious vulnerabilities
performed regularly
42
The WannaCry malware was able to spread to all unpatched Windows systems from what to what?
8 to 2016
7 to 2016
XP to 2016
ME to 7
43
128-bit cryptographic hash that has been considered vulnerable since 2013.
SHA-12
SHA-2
SHA-10
MD5
44
Manipulating the file name is an optional feature to hide the fact that it is indeed an executable. What would you use?
Left-to-Right Override
Right-to-Left Override
Left-to-Left Override
Right-to-Right Override
45
Cookie stealing cannot be used to hijack sessions and replace original cookies
True
False
46
The user can change the GRUB setting by pressing what key on the keyboard when GRUB starts?
Z
F
X
E
47
What scanner has manual pen testing, is the most common used and has active/passive scanning?
ZAP
ACUNETIX
BURP SUITE
VEGA
48
Reg users can typically only access their files & applications, but can work with other system settings and directories.
True
False
49
Users responsible for controlling and enforcing specific roles and features, and usually have limited privileges.
Domain Admin
Deity Admin
Dominate Admin
Delegated Admin
50
If you were an inexperienced pen tester and need to do SQL and XSS testing what would you use?
BURP SUITE
ACUNETIX
VEGA
NIKTO
51
160-bit cryptographic hash.
SHA-16
SHA-1
SHA-11
SHA-111
52
What is true about ZAP? (3 answers)
written in Java and developed by the OWASP community
free graphical tool for web application security testing
stands for Zual Attack Proxy
contains extensions that are similar to Burp Suite
53
The Nmap scripting engine can use what type of scripts to automate processes and check for vulnerabilities?
Lana
Lerk
Lua
Lagos
54
How much was the randsom amount in the WannaCry attack?
500 Gold Sovereigns
1000 Iraqi Dinars
600 US Dollars in Bitcoin
400 Great British Pounds
55
What is true about HASHCAT? (3 answers)
supports around 110 different hash types and four attack modes
originally designed for password recovery
is multi-Algorithm based
is multi-hash and multi-OS based
56
What scanner provides a proof of concept and can parse JavaScript?
NETDISCOVER
VEGA
ZAP
NETSPARKER
57
Session hijacking can lead to what? (2 answers)
privilege escalation
Redis
RCE
user data disclosure
58
Which SQL query is used to combine the result sets of 2 or more SELECT statements?
UNION
MERGER
JOIN
CONCATENATE
59
What is not a Code of Ethics for a Pen Tester?
the use of illegal means as a method of accomplishing the goals
must be up to date regarding current laws
consider the client’s location
signing a non-disclosure agreement to protect clients
60
What is not true about Netdiscover?
Dedicated to networks without DHCP
Works in active and passive modes
Can jump between each ARP request
Produces a live display of identified hosts
61
As a means of protection against SQL injection, a developer should not allow what on the server-side?
uppercase characters
numbers
special characters
decimals
62
Re-encoded text hashed with MD4. Used in Windows OS.
MD4NTLM
NetNTLM
NTLM
PBKDF2
63
With Hashcat, an attacker doesn't have to specify the type of the hash.
False
True
64
Hashcat syntax is a bit tricky and doesn’t have a hash analyzer.
True
False
65
This account can access all system settings and directories, including low-level data.
Absolute Root
Admin
Executor of All
NT Authority
66
If you want to be SOX compliant, your regulator is who?
Securities and Exchange Commission
The Pipeline and Hazardous Materials Safety Administration
Bureau of Safety and Environmental Enforcement
Federal Energy Regulatory Commission
67
What enables direct execution of commands on servers?
JSP
CGI
SQL
Cobalt
68
What is true about Burp Suite Professional (3 answers)
offers both Passive and Active Scanning mode
the most common tool used by penetration testers
has the techniques & methodologies used for manual pen testing audits
provides a proof of concept
69
One of the first steps in performing an SQL injection is to try to enumerate what? (3 answers)
databases on the server
tables
columns
text files
70
What scanner would you use if you wanted to scan for web app vulner such as malicious files or programming errors?
NESSUS
NETSPARKER
VEGA
NIKTO
71
What is true about Netsparker? (3 answers)
an application rather than a web interface
can automatically parse, execute and analyze the output of JavaScript
provides a proof of concept (POC) to the attacker
contains a spider and a fuzzer
72
SE is not based on programming flaws or operating system errors, but rather on the human factor.
True
False
73
What is a popular tool for Kali Linux systems and is often used to initiate On-Path attacks?
echo 1
Arpspoof
NTAT
dSniff
74
Which scanner uses a GUI?
Gmap
Yenmap
Zenmap
Nmap
75
SFX does not have a built-in option to hide the files.
True
False
76
To obtain the client's cookie, an attacker may use what? (2 answers)
sQuery
jQuery
HRX
XHR
77
What automated web app scanning tool explores the site’s structure & crafts an auto pen testing report?
WEC.ACME
NETDISCOVER
NETSPARKER
ACUNETIX
78
In SFX, because an actual .docx file is open, the user should not suspect that an .exe is running.
True
False
79
Developers use the prepared statement function to make all special characters appear as what?
SQL statement
SQL command
string
interger
80
What cookie parameter does not allow JavaScript to access the cookie & protects against XSS attacks?
expire
session
httponly
value
81
What is true about GRUB? (2 answers)
executes INIT
responsible for bootloading most Linux systems
contains all system user account data required for the login process
executes the kernel
82
GDPR regulates sensitive information about what clients?
African
European
American
Indian
83
Which SQL query extracts data from a database?
PRINT
SELECT
AFTER
JOIN
84
If an attacker maniplulates the GRUB what will happen? (2 answers)
can view a file's permissions by reviewing the output
a rescue shell will run with root-level privileges
a new user can be added to the system
give the attacker write access to read-only memory
85
The best way to defend a certain Linux kernel is to what?
keep the kernel patched and updated
restrict access on http
manipulate the kernel into running a certain payload
give all users write access to read-only memory
86
To create the SFX, add all files into what?
cmd
document file
archive file
zip file
87
What is true about VEGA (3 answers)
focuses on SQL and XSS injections
open-source vulnerability scanner
can help less experienced penetration testers categorize findings
written in Java, command line based, and runs on Linux, but not Windows
88
ro initrd=/install/initrd.gz to rw init=/bin/bash does what to the GRUB?
restricts access
adds an existing user to sudo group
generates a hash in the pbkdf2
change from read only to read write
89
What is not part of Stage 1 ARP Poisoning Breakdown?
The attacker makes the victim believe that its machine is default gateway .
# echo 1 > /proc/sys/net/ipv4/ip_forward
# arpspoof -i eth0 -t 10.0.3.4 10.0.3.1
the attacker will “trick” the default gateway (the router)
90
What is Nmap used for? (2 answers)
TCP/IP packet assembly
Reveals hosts and which services are running on the target server
OS detection
UDP/IP packet assembly
91
Setting a GRUB password may protect the computer and prevent the boot order from being changed.
True
False
92
What is Wireshark used for? (3 answers)
used to test software
captures and displays data traveling back and forth on a network
network troubleshooting
scanning the most popular vlans
93
To create a malicious SFX, what two things are required? (2 answers)
legitimate document
HiddenEye
payload
BadUSB
94
If an Automated Scanning Type inspects a page via fuzzing, what type of scanning is this?
Access
Available
Action
Active
95
What technologies can Nessus scan for? (3 answers)
operating systems
compliance audits
critical infrastructure
BOTNETS
96
To route traffic from the victim to the router, and vice versa, what should be done first on the Kali machine?
# echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 10.0.3.4 10.0.3.1
# arpspoof -i eth0 -t 10.0.3.4 10.0.3.1
netsh interface IP delete arp cache
97
Which SQL injection focuses on detecting changes when injecting TRUE or FALSE statements?
Boolean-Based
Date-Based
Script-Based
URL-Based

Duplicate of Ethical Hacking Final Prep Flashcards | StudBud