Network Based Vulnerabilities

Question 1

NETBIOS Name Service

Answer 1

• part of NetBIOS over TCP protocol, similar to DNS to translate human readable names to IP addresses using 16 character ASCII name

Question 2

Link Local Multicast Name Resolution

Answer 2

• LLMNR, based on DNS packet format allowing both IPv4 and IPv6 hosts to perform name resolution for hosts on the same network

Question 3

Server Message Block SMB

Answer 3

• TCP ports 139 and 445

* EternalBlue exploits and WannaCry ransomware utilized flaws in SMB protocol

Question 4

SNMP

Answer 4

• SNMPv1 has port security and includes authentication using a shared community string sent in cleartext to public

Question 5

SMTP

Answer 5

• direct exploits of protocol, using open relays, using local relays, phishing attacks, SPAM

Question 6

FTP

Answer 6

• insecure protocol that sends data and authentication in cleartext over the network

Question 7

DNS Poisoning

Answer 7

1. Inject fake DNS record
2. visitor requests DNS for bank
3. visitor gets IP address for fake bank server instead

Question 8

DNS Cache Poisoning

Answer 8

• like DNS poisoning but the poisoning can occur in the DNS cache of the local computer or server

Question 9

Pass the Hash

Answer 9

• attack against NT LAN Manager NTLM authentication system, steals hashed user credential and reuses it in the windows auth system to create a new authenticated session

Question 10

Man in the Middle

Answer 10

• ARP spoofing
• reply
• relay
• SSl stripping
• downgrade

Question 11

ARP Spoofing (Man in the Middle)

Answer 11

• attacker sends falsified ARP messages over the LAN

* results in attackers MAC being associated with the IP of a valid computer

Question 12

Replay (Man in the Middle)

Answer 12

• attack occurs when valid data is captured by an attacker and is repeated or delayed

Question 13

Relay (Man in the Middle)

Answer 13

• occurs when the attacker is able to become the MITM and acts as a middle man in communincations session

Question 14

SSL Stripping (Man in the Middle)

Answer 14

• websites encryption is tricked into presenting the user with and HTTP connection instead of HTTPS

Question 15

Downgrade (Man in the Middle)

Answer 15

• attempts to have client or server adandon a higher security mode to use a lower security mode
• TLS 1.2 is more secure than SSL 2.0

Question 16

Denial of Service

Answer 16

• stress test in pentesting, denies resources or service to authorized user by exhausing resources

Question 17

NAC Bypass

Answer 17

• NAC can prevent you from gaining access to the network, can be bypassed by spoofing MAC and address of a VOIP device

Question 18

VLAN Hopping

Answer 18

• attack host on different VLAN to gain access
• switch spoofing - attempt to auto negotiate with a targeted switch by setting your device to act as a switch, switch gets copies of all VLAN traffic and separates based on tags