Post Exam Material Flashcards by Jason Keyt

Is ScoutSuite open-scource?

Yes

How well did you know this?

Not at all

Perfectly

ScoutSuite can

assess the security posture and perform security assessment on multiple cloud environments

How well did you know this?

Not at all

Perfectly

Is ScoutSuite agentless?

Yes - it doesn’t require install or making changes to the cloud environment

How well did you know this?

Not at all

Perfectly

What format are Scoutsuite reports in?

HTML

How well did you know this?

Not at all

Perfectly

ScoutSuite can be used to check your cloud setup to make sure that it is

following best practices and any compliance standards

How well did you know this?

Not at all

Perfectly

Use cases for ScoutSuite are:

cloud security security auditing, performing compliance checks, intergration into CI/CD

How well did you know this?

Not at all

Perfectly

In Pivot lateral movement the initial compromised system is called the

foothold

How well did you know this?

Not at all

Perfectly

What is local port forwarding used for in a pivot?

to redirect traffic from a local system to remote system

How well did you know this?

Not at all

Perfectly

What is remote port forwarding used for in a pivot?

enables a remote system to connect to a local service on the user’s machine

How well did you know this?

Not at all

Perfectly

What is dynamic port forwarding in a pivot?

it creates a dynamic tunnel that acts as a SOCKS proxy server

How well did you know this?

Not at all

Perfectly

What is VPN pivoting?

A VPN is set up on a compromised machine. Allows the bypassing of IDS and firewalls

How well did you know this?

Not at all

Perfectly

What is proxy pivoting?

Traffic routed through a proxy server.

How well did you know this?

Not at all

Perfectly

Proxy pivoting can capture?

credentials and cookies

How well did you know this?

Not at all

Perfectly

What is the proxychains tool?

allows users route their internet traffic through multiple proxies to obfuscate their activities

How well did you know this?

Not at all

Perfectly

sshuttle is refered to as the

poorman’s VPN

How well did you know this?

Not at all

Perfectly

sshuttle tool is used for

lateral movement

How well did you know this?

Not at all

Perfectly

sshuttle will not work on

Windows systems natively

How well did you know this?

Not at all

Perfectly

The general syntax used for sshuttle

sshuttle -r user@remote-server 0.0.0.0/0 (-r = remote server, zeros IP address=route all traffic through)

How well did you know this?

Not at all

Perfectly

Does sshuttle support DNS fordwarding?

Yes (–dns in the CLI)

How well did you know this?

Not at all

Perfectly

sqlmap will automate

SQL injections with web pages and APIs

How well did you know this?

Not at all

Perfectly

Karma attack is a variant of the

evil twin wireless attack

How well did you know this?

Not at all

Perfectly

Command to scan a network for ports, etc using metasploit is:

db_nmap [-xX]

How well did you know this?

Not at all

Perfectly

msfvenon option for different encoding

-e (helps to evade detection)

How well did you know this?

Not at all

Perfectly

Hydra option to stop when a password is found

-f

How well did you know this?

Not at all

Perfectly

Wfuzz tool is for

web attacks

Wfuzz is used for

brute-forcing directories and files, API requests,

Which language is WPscan based on?

Ruby

Kerberoasting is an attack that

tries to get the password hash of an active directory account that has a service principle name(SPN) associated with it

SPN (service principle name) is an attribute (in AD) that associates an account with

a service on the network

How is an SPN used?

in Kerberos authentication for clients to obtain a ticket to access a service

In Kerberos anyone can request a ticket from the service being used that contains what?

password hash

Rubeus is a tool that can request what?

Kerberos service ticket

BeEF is to

exploit a web browser

Step one in BeEF is to

hook the target's browser

BeEF will execute what on the victums browser in hooking?

Java Script

BeEF tool can be used for:

Social Engeening attacks

Pass the Hash attack allows you to log into a system without knowing the

plain text password

Mimikatz can be used for what type of attack

pass the hash

Mimikatz can be used for

Credential dumping, Pass-the-Hash (PtH), Pass-the-Ticket (PtT), Over-Pass-the-Hash, Kerberos Ticket Extraction & Manipulation, Golden Ticket Attack, Silver Ticket Attack, SAM / LSA Secrets Dumping

Extracts plaintext passwords, NTLM hashes, and Kerberos tickets from memory (LSASS process).

Credential Dumping

Allows authentication using NTLM hash instead of plaintext password.

Pass-the-Hash (PtH)

Reuses Kerberos tickets (TGT/TGS) to impersonate users on the network.

Pass-the-Ticket (PtT)

Combines PtH and PtT by using an NTLM hash to request a Kerberos ticke

Over-Pass-the-Hash

Extracts, exports, and injects Kerberos tickets for lateral movement.

Kerberos Ticket Extraction & Manipulation

Creates forged Kerberos tickets using a domain’s KRBTGT account hash, granting domain admin access.

Golden Ticket Attack

Creates forged service tickets (TGS) for specific services within a domain.

Silver Ticket Attack

Airodump-ng is a

wireless packet capture and monitoring tool

aireplay-ng does what in the wireless attack?

deauthentication

aircrack-ng with a wordlist is used to

crack the password

Kismet tool is for

wireless attack

Is Kismet open source

Yes

What does Kismet do?

Sniffer, wardriver for capturing activity over Wi-Fi or Bluetooth

Does Kismet do active or passive scanning?

Passive

What do you use to analyse Kismet files

sqllite3

Prowler tool is for

Cloud-based attack

Prowler is used to assess

the cloud security posture of AWS environments

SpiderFoot is an open-source reconnaissance (OSINT) tool used to automate information gathering about a target — such as a

domain, IP address, email, username, subnet, or organization.

recon-ng is an open-source, modular

web reconnaissance framework (written in Python)

Power Tools is a collection of

Powershell scripts used for tasks like port scans and ping sweeps

Powersploit is a

post exploitation framework using script

Nishang is a set of offensive security powershell scripts

that can be used by red teams

theHarvester is used to gather open source intelligence (OSINT)

on a company or domain

Pin cylinder locks are the more common locks. They use a series of pins that

need to be aligned

Pin cylinder locks can be picked by the following techniques

single pin picking or raking

Disc detainer locks are higher security than

pin cylinder locks

Lever locks are more commonly used in

safes and older doors

Are wafer locks the simplest to pick

Yes

Warded locks are highly vulnerable to

skeleton keys

Auto jiggles are designed to bypass

wafer locks

Bump keys are modified keys that can open

pin tumbler locks

Enumeration activities: To find out the current username use

whoami command or printing out via username% variable with echo

Enumeration activities: View user privileges

whoami/priv

Enumeration activities: View local users

net user command

Nikto is a tool used to scan

web servers for potential security issues

Is Nikto good for preliminary assessments

Yes

Nitko scans can check for:

vulnerabilities and configuration errors

BloodHound collects and visualizes relationships within

Active Directory

SDP can be used for

network service discovery

Tools to scan certificate transparency logs (CT)

CTFR (command line tool) and crt.sh,

Hunter.io specializes in finding and verifying

professional email addresses

Is Hunter.io a web based or CLI tool?

Web based

CREST (Council of Registered Ethical Security Testers) is an international, not-for-profit organization that represents the cybersecurity industry, particularly focusing on

ethical penetration testing and cybersecurity testing services.

Censys.io is like

Shodan

Censys.io more advanced than

Shodan

Post Exam Material Flashcards

(84 cards)