Dion Training #2

Question 1

hex code for directory traversal attack

Answer 1

%2E%2E%2F

Question 2

What is executing a script to inject a remote file into the web app or the website

Answer 2

Remote File Inclusion (RFI)

Question 3

What is adding a file to the web app or website that already exists on the hosting server

Answer 3

Local File Inclusion (LFI)

Question 4

Type of web attack where an attacker tricks a victum into making an unwanted request

Answer 4

CSRF

Question 5

Type of attack where the attacker tricks the server into making requests to unintended locations

Answer 5

SSRF (Server-Side Request Forgery)

Question 6

responder command to enable a SMB relay attack

Answer 6

-r

Question 7

MAC address is on which layer

Answer 7

2

Question 8

A shell where a listening port is opened on the victim’s machine is

Answer 8

Bind Shell

Question 9

A command-line tool in Kali that is used to poison NetBIOS, LLMNR and mDNS name resolution requests

Answer 9

Responder

Question 10

Automated, all-in-one mobile application pentesting framework that can perform static and dynamic analysis

Answer 10

MobSF

Question 11

Open-source tool that provides powerful capabilities for Pent Testing across various mobile operating systems

Answer 11

Frida

Question 12

Which mobile tool can: Dump process memory, Perform in process fuzzing, detect anti-jailbreak and Alter a program;s behaviour

Answer 12

Frida

Question 13

A mobile security tool that provides a comprehensive security and attack framework for Android

Answer 13

Drozer

Question 14

Versatile command-line tool that allows testers to communicate with an Android device

Answer 14

Android Debug Bridge (ADB)

Question 15

______________________ is an open-source Python library (with a collection of example scripts) that implements low-level network protocols used by Microsoft Windows — things like SMB/CIFS, MS-RPC, DCE/RPC, NetBIOS, LDAP, Kerberos, NTLM, and others.

Answer 15

Impacket

Question 16

Schedules Tasks and Cron Jobs are for which respective OS

Answer 16

Windows and Linux

Question 17

Certificate stapling allows a webserver to perform certificate status checking instead of having the

Answer 17

browser perform the checking.

Question 18

Tool for misconfigured AD certificates services

Answer 18

Certify

Question 19

What is a master key that creates valid Kerberos tickets for any user, giving the ability to impersonate anyone in the domain

Answer 19

Golden Ticket

Question 20

Tool to use for Kerberos ticket manipulation

Answer 20

Rubius

Question 21

A remote administration tool that allows users to execute processes on other systems

Answer 21

PsExec

Question 22

A Critical vulnerability that allows attackers to run malicious code on a target system

Answer 22

Arbitrary Code Excution

Question 23

Tool that looks for security problems in Kubernetes clusters

Answer 23

Kube-Hunter

Question 24

Tool that checks the Docker setup against best practice for securing Docker containers

Answer 24

Docker Bench

Question 25

To search for criteria — such as name, size, date, permissions, owner, or type you use the command

Answer 25

find

Question 26

To find a string value you would use

Answer 26

grep

Question 27

Parts of STRIDE

Answer 27

Spoofing Tampering REpudiation Information disclosure Denial-of-Service Elevation of Privilege

Question 28

Octave is good to manage

Answer 28

organizational risks

Question 29

Octave has how many phases and processes

Answer 29

3 phases and 8 processes

Question 30

What is the method used by web browsers to automatically detect the presence of a proxy server ina network

Answer 30

WPAD

Question 31

a tool used in penetration testing to exploit Bluetooth vulnerabilities and perform attacks like bluesnarfing and bluejacking

Answer 31

Bluecrack

Question 32

the attack thst does not alter the messages but instead relays them between the parties,

Answer 32

relay attack

Question 33

REST API uses the support document called

Answer 33

swagger

Question 34

SOAP based services use the support document called

Answer 34

WSDL

Question 35

Crontab formating start at minute progresses to

Answer 35

hour, day of the month, month, day of the week

Question 36

A fraggle atttack is like a

Answer 36

DoS

Question 37

RPC is the underlying mechanism for

Answer 37

DCOM

Question 38

Black/Whiote Box analysis Brakeman and Wapiti

Answer 38

White / Black

Question 39

EPSS score meaning

Answer 39

Low score least likely to be exploited

Question 40

CVSS score meanign

Answer 40

Highest score most dangerous

Question 41

LDAP injection you would use which tool

Answer 41

Burp Suite

Question 42

Parameterized queries have what characters

Answer 42

%s