Deck 5: Networks and Services

Question 1

What would the following command accomplish?
Windump -nes 0 -w C : \ dump.txt tcp[28]=0x72 or tcp[28]=0x73 or tcp[40]=0x72 or tcp[40]=0x73

A) Sniff all TCP traffic that has certain flag combinations
B) Sniff the file "dump.txt" if it is sent across the network
C) Sniff cheatcodes on nes (Nintendo Entertainment System) traffic
D) Sniff SMB challenges

Answer 1

Sniff SMB challenges

Question 2

To use a sniffer on a Windows machine you first need to install a promiscuous mode driver. What is this package called?

A) ethereal
B) promiscap
C) winpcap
D) libpcap

Answer 2

winpcap

Question 3

How many possible values can be generated in the sequence number field of a TCP header?

A) 2 Billion
B) 3.4 Million
C) 4.3 Billion
D) 16.7 Million

Answer 3

4.3 Billion

Question 4

Which of the following forms of attack depends on an already established connection between hosts?

A) Smurfing
B) Spoofing
C) Man in the Middle
D) Session hijacking

Question 5

One possible way to defeat a switch is to flood it with spoofed MAC addresses until it fails into "hub mode". Which of the following tools can accomplish this?

A) macof
B) dsniff
C) sniffof
D) sniffit

Question 6

Quincy runs the L0phcrack tool which has a feature that sniffs SMB passwords and stores them for offline cracking. He tries for hours and picks up nothing.
What could be the reason?

A) L0phtcrack does not do this, he needs to use 0phtcrack
B) He is sniffing on a segment that is using only IP Security Traffic in ESP mode
C) He is sniffing on a fiber optic network
D) His network interface is in promiscuous mode

Question 7

Which of the following tools allows for the easy capture and analysis of data that has been captured during a TCP connection?

A) TCPFlow
B) TShark
C) Mergecap
D) Text2pcap

Question 8

Bruno wishes to carry out a session hijack attack between hosts "Jaguar" and "Puma". They are in an established state. Puma has a receive window of 300 and Jaguar has a receive window of 350. Jaguar has just received byte 500 from Puma and Acknowledged.
What is the range of sequence numbers that Jaguar will now accept from Puma?

A) 501-851
B) 500-850
C) 350-500
D) 501-801

Question 9

Which of the following display filters will only show TCP traffic with the URG, PSH, and FIN flags set?

A) tcp.flags == 0x12
B) tcp.flags = = 0x29
C) proto.flags == UPF
D) tcp.flags == 29

Question 10

LaDanian is sniffing some traffic and notices a frame that is sent with the source MAC address of:
02:1D:45:68:AF:D4.
This is what he thinks is weird. Why?

A) The first bit of the first byte is not set, which indicates this frame is multicast
B) The first bit if the fist byte is set, which indicates this frame is multicast
C) The second bit of the first byte is set, which means this is a virtual machine interface
D) The second bit of the first byte is set, meaning the MAC address has been assigned locally

Question 11

ARP spoofing works in part because Ethernet hardware has no way of knowing if there is another NIC on the network with the same MAC address or not. True or False?

Question 12

Which of the following protocols are not vulnerable to sniffing due to clear text credentials being sent?

A) FTP
B) POP3
C) MAPI
D) IMAP

Question 13

Janet is reading about the "Pass-the-Hash" technique to access a Windows host. She thinks she can use Wireshark to sniff an SMB session between two hosts if she can capture the password hash and user name, and simply send them as credentials anytime she wants in a "Replay Attack".
What are other true statements about this attack? (Choose three)

A) This can also be done using a modified smbclient tool that does not hash an entered password, it will just directly send the hash that Janet captured
B) Janet can also use a tool such as smbrelay to become an SMB proxy and capture credentials that
Way
C) The traffic that Janet sniffed did not include a challenge, if it did the technique is still not impossible just involves more steps
D) Because Microsoft uses techniques such as SMB Signing, Kerberos Timestamps, and Challenges that are used to create unique MAC (Message Authentication Code)s. The Pass-the-hash technique is mostly a proof of concept that works in theory but not in practice.

Question 14

Which of the following attacks are not considered "Active Sniffing"?

A) ARP Poisoning
B) MAC Flooding
C) MAC Spoofing
D) SMAC Fueling

Question 15

Assuming your own address is 192.168.1.1, what display filter could be used to show all traffic other than web and mail.

A) host 192.168.1.1 and not (port 80 or port 25)
B) host 192.168.1.1 and not port 80 and not port 25
C) ip.addr 192.168.1.1 && ! tcp.port == 80 && ! tcp.port == 25
D) ip.addr 192.168.1.1 & ! tcp.port = 80 & ! tcp.port = 25

Question 16

Zachery sees a video on YouTube that describes a wireless hacking technique. He must capture a packet then inject it over and over again into the network stream. The target MAC of this frame will insure it goes to the correct WAP. The idea is to speed up the process of acquiring new initialization vectors for the purposes of cracking a WEP key.
What is this portion of the attack called?

A) Replay attack
B) Injection attack
C) Spoof Attack
D) WAP Attack

Question 17

During an attack you setup an access point with a stronger signal than those around you. You also set the SSIDs to be the same as the one you are targeting. You capture authentication frames. Which of the following is the best name for this attack?

A) Rogue WAP
B) Drive-by
C) WEP Attack
D) Denial of Service

Question 18

Arianna wants to implement 802.11b for a series of hotels that her employer won the contract on. Her boss says that one of the customers was concerned that if TCP error checking was part of the configuration, the network would be slower. Arianna pauses, and explains …. ?

A) TCP error checking effectively speeds up the network. Since there will be fewer retransmissions the speed will surpass the speed of the wired network.
B) The resulting speed will be about 6Mbps. Since the Ethernet in the hotel is 10Mbps, accounting for several users at the same time, a throttle speed makes sense.
C) Error checking is part of the TCP protocol already. Network speed measures bits, the overhead that gets delivered are bits too.
D) Her boss is correct, and the whole project should just get scraped. Let someone else deal with these difficult customers.

Question 19

Jack is worried about the FUD (Fear Uncertainty Doubt) he was heard about wireless networks. He also does not want to learn about WPA2 and how easy it is to implement. He sets forth a policy of no wireless networks allowed period.
What else should he do? (Choose two)

A) Train users in the new policy
B) Implement signal jamming technology
C) Survey the area using a tool such as WiSpy, create a baseline and investigate the rest.
D) Disable wireless protocols at the firewall
E) Set penalties for those who create WAPs without approval

Question 20

What is the highest possible speed of 802.11n?

A) 600Mbps
B) 54Mbps
C) 108Mbps
D) 11Mbps

Question 21

An SSID is: (Choose the best statement)

A) Secure Set Identifier Determination
B) Secure Service Identification Detection
C) A security vulnerability
D) A password

Question 22

Howard wants to control access to his wireless network. Which of the following would not be of assistance to him?

A) WEP
B) A Layer 2 Firewall
C) MAC address filtering
D) Proper placement of the antennas

Question 23

Keith is setting up a Wifi network and wants to use highly directional antennas that do not require precision. Which of the following would be best?

A) Yagi
B) Reflector
C) Onmidirectional
D) King / Hanneman

Question 24

Janet is trying to connect to a wireless network but cannot because no SSIDs are being broadcasted. What should she do?

A) Setup a sniffer to capture SSIDs in the area?
B) Try to connect using default SSIDs
C) It is impossible to connect to a wireless network without knowing the SSID
D) Since SSIDs are encrypted, she needs to use a cracking tool

Question 25

Dean is repurposing an old Dell Axim PDA (Personal Digital Assistant) as an easy to use walkabout tool for scanning Wifi networks in his area. This PDA is based on windows mobile and he has a compatible CF Card Wifi radio.
What software can he use on this device to meet his objective?

A) Ministumbler
B) Netstumbler
C) Kismet
D) Kismac

Question 26

Karen sets up a wireless network that is open and includes WEP. Which acronym accurately describes this configuration?

A) TCP / IP
B) OSA / AES
C) WPA / FSK
D) OSA / PSK

Question 27

WPA is vulnerable to brute force if the password is easy and short. What tool attempts this attack?

A) WEPCrack
B) coWPAtty
C) WPACrack
D) Airfart

Question 28

You have been asked to setup a wireless intrusion detection system. Which of the following products fills this function?

A) Airsnort
B) LIDZ
C) WIDS
D) WIPS

Question 29

You are a wireless hobbyist. A few years ago it was novel to find wireless networks, but these days it is commonplace. So you get more creative and try other any transportation mechanism possible to find accessible hosts.
What is this called?

A) Warxing
B) Bored
C) Flexible
D) Diligent

Question 30

Leo wants to secure his wireless network. He implements WAP2, installs directional antennas and implements rouge infrastructure testing. What else does he need to consider? (choose up to 4)

A) Denial of service attacks are always a threat but they are hard to prevent. A proper incident response plan must also be established
B) Associating with a WAP only secures the hosts. The users operating the hosts are a whole separate
Issue.
C) WEP provides similar functionality to a network switch. Sniffing is then improbable so that is one threat that is no longer an issue. Key distribution is the most important challenge at this point.
D) Interference with other items within the 2.4Ghz band might cause issues. It is important to select a channel within the range that is less populated.

Question 31

When testing a website you enter the following into a field on the login form:
<script>alert("oops")</script>
When you submit the form an alert box pops up as the next page loads. This is a demonstration of what type of attack?

A) CSS
B) XSS
C) Buffer Overflow
D) Code Injection

Question 32

Which of the following tools cannot be used to perform a dictionary guessing attack on a web application?

A) THC-Hydra
B) John the ripper
C) Brutus
D) Nikto

Question 33

What is CGI?

A) A set of specifications for creating web based applications
B) A way to create enhanced special effects for movies
C) A language used in the logic layer of a web application
D) A set of standards that goern the design of databases for web applications

Question 34

Which of the following URLs looks like a SQL injection attack?

A) http://www.example.dom/msadc/..%5c../..%5c../..%5c/..Á_../..Á_../..Á_../winnt/system32/cmd.exe
B)
Http://www.example.dom?search.pl?lname=doe%27%3bupdate%20usertable%20set%passwd%3d%27% P0wn3d--%00
C) http://www.example.dom?search.pl?lname=%3Cscript%3E%alert("P0wn3d")3C%2Fscript%3E
D) http://www.example.dom/scripts/..%2f..%2f../winnt/system32/cmd.exe?c+dir

Question 35

Which of the following tools are web vulnerability scanners/testers? (choose four)

A) Whisker
B) Burpsuite
C) N-Stealth
D) HTTrack
E) Nikto F. Kismet

Question 36

You just hired a new graphic artist to work on your web site. You are cheap, and don't want to spring for a programmer because web design is all the same anyway. The new guy you hired is an expert at photoshop but hates coding tell him "Look, this makes no sense. Just follow a few of these pointers and you will be fine."
In the interest of security, what is one of the things you will tell him?

A) Visitors enjoy it when one page of content is broken up into 5 pages. They get to click often and we get to show more advertisements. It is the best way to avoid making enimies
B) Never decorate text with the color blue or green as visitors will think these are links and spend all day trying to click them, they will get angry and DoS us.
C) Most application vulnerabilities stem from a lack of sanitizing input. They will be his fault, but no pressure.
D) Section 508 details all security best practices. It will get him up to speed

Question 37

An attacker is testing out the login page of a website. He notices that after 5 failed attempts he is redirected to a different page. He assumes this logs his IP address, and if this redirect continues, it could lead to being blocked.
How can he avoid this from happening?

A) He can turn on SSL support in his browser, that way the encrypted requests will be hidden from the
IDS
B) He can send his requests from random spoofed IPs so the server wouldn't think they are all coming from the same source
C) He can create a persistant cookie that tells the web server to ignore failed logins
D) If there is a hidden form field that stores the "retries" count, he can modify the source code to avoid the threshold

Question 38

Ned is testing a web application. He visits a page that seems to have some features that can be customized by the user, but not all of them. He uses a cookie viewer to take a look at how his settings are stored and notices the following name value pairs:
Colorscheme=ocean
Layout=newspaper
Admin=false
He changes the admin variable to true, and reloads the page. This time he can change more items on the page. What is the name of this attack?

A) Parameter manipulation
B) Cookie triangulation
C) Cookie hijacking
D) Cookie stealing

Question 39

You have successfully completed a buffer overflow attack against a IIS server. You have a shell. Now what you wonder. First, what permissions do you have at this point?

A) IUSR_[computer name]
B) Administrator
C) The user that installed IIS
D) The permission you have when launching the attack

Question 40

Dylan found a vulnerability on a web application that let him copy the sessionID out of a local cookie and place it into another cookie, therefore assuming the identity of the original user. The problem is that the server also associates the originating IP address. Dylan simply spoofs that address but he then finds he cannot establish an interactive session with the server. Why?

A) The attack should work as stated.
B) There is a NAT firewall preventing this activity
C) Dylan cannot spoof his address over HTTP
D) The server will send all replies back to the spoofed IP.

Question 41

Mike is trying to recover his password from a site. It asks for his email address. Just then, his cat walks across the keyboard and enters an extra character. He ends up entering into the form [e-mail]' and the return page shows an error was returned from the server.
What is the cause of this on the webserver?

A) User input is not sanitized
B) The email address is not valid
C) The Databse server on the backend of the site is down
D) The ISP is traffic shaping again and made a mistake

Question 42

You see an email in your box that looks suspicious. It has typos and seems to be preying on a current event that is volitile and has a large audience of passionate people that want to believe its message. Classic social engineering spam. It reads:
…
Stop them from setting up death panels!!!! Only when the government interfeeres does things go terribly wrong. Sign our petition to put an end to this madness and recover your constitutional rights! While you are there, join in the fight by purchasing a t-shirt for ony $29.95. With the slogan, Government is the only disease I have !! Wear it at the next town hall meeting to let them know you are paying attention. http://0x7F2D52DB/stophealthcare.ee
(The address is encrypted to protect your indentity. They are collecting enemy lists we are making sure
You are safe)
…
What is the real IP address of this site?

A) 127.45.83.218
B) 127.45.82.219
C) 127.44.83.219
D) 127.44.83.218

Question 43

You have a website that is not meant for everyone, only a particular audience. You do not want certain directories to be crawled by a spider. How can you limit (in theory at least) what search engines will index?

A) .htaccess file
B) robots.txt file
C) set permissions on the directories to deny spiders read access
D) Require a login page

Question 44

Janet wants a no cost solution to blocking certain applications from lauching pop-up windows while she is surfing the web. She had tried everything her old Windows XP computer can run. Alternative browsers, freeware spyware scanner, nothing helps.

A) She needs to understand that these pop ups are pat of using the internet and that it is impolaite to block them because the sites she is visiting for free depend on them for revenue.
B) SP2 upgrade with the windows firewall enabled
C) She needs to use Linux instead
D) She needs to modify the hosts file daily to point all addresses that generate the pop-ups to 0.0.0.0 to keep them from resolving.

Question 45

You notice the following in your log files. What attack is being attempted?
GET /scripts/root.exe?/c+dir
GET /MSADC/root.exe?/c+dir
GET /c/winnt/system32/cmd.exe?/c+dir
GET /d/winnt/system32/cmd.exe?/c+dir
GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
GET/msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir
GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir
GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir

A) XSS
B) directory traversal
C) showcode.asp
D) Nimda

Question 46

Jacob finds the following packet dump in his log file
05/20-17.06.45.061034 192.160.13.4.3465 -> 172.16.1.101:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seq. 0XA1D954BD Ack. 0x0 Win. 0x400
05/20-17.06.58.685879 192.160.13.4.3466 -> 172.16.1.102:80 TCP TTL.44 TOS.0x10 ID.242
***A**** Seg. 0XB7C5627D Ack. 0x0 Win. 0x400
What is likely happening?

A) ACK Scan to port 80
B) Snort alerts noticing strange events
C) Sequence numbers are random, indicating custom packets
D) TTL of 44 is too low, this is a firewalk scan

Question 47

What does the following IPTables commands accomplish?
Iptables -A FORWARD -j ACCEPT -p UDP --dport 53
Iptables -A FORWARD -j ACCEPT -p TCP --dport 80

A) Allow web requests to be routed
B) Accept only packet that are destined for port 53 and port 80
C) Append the FORWARD table with a jump (-j) rule that send this traffic to the IDS
D) Nothing, since -p is the option for port number and that is not how these commands were written

Question 48

You wish to capture a set of data for about 10 minutes from a host that you only have command line access to. You use TCPDump for the capture, but find it is hard to work with. You aren't so much interested in the data within the packets but statistics about how much data and of what type is being sent.
Which of the following tools can be used along with your sniffer to collect this data?

A) IDS Wakeup
B) TCP Slice
C) Win Dump
D) WinpCap

Question 49

What is the most accurate statement below regarding the following snort rule:
Alert tcp any any -> any 111 (content:"|00 01 86 A5|"; \ msg: "mountd access";)

A) An alert is generated when a packet originates from anywhere and destined for any IP and port 111
B) An alert is generated when a packet orginates from port 111 and destined for any IP and port
C) An alert is generated when the string 00 01 6 A5 is seen in the payload
D) An alert is generated when the command mountd access is seen in a packet that is destined for port
111

Question 50

Using Hping, you wish to enumerate the rules of a firewall. You direct the traffic to a confirmed host and set the TTL value to one hop past the firewall, also incrementing the destination port by one with each packet. Return ICMP type 11 messages will tell you want the firewall allowed to pass.
What is this technique called?

A) Firewall footprinting
B) Firewalking
C) Firewall enumeration
D) Bounce scanning

Question 51

During a traceroute, you notice that the last two hops reveal the same IP address. What is a possible explanation?

A) Application proxy is in use
B) A stateful inspection firewall
C) A load balancer or cluster
D) A honeypot is returning deliberately confusing results

Question 52

Curtis works for a small company. His boss isn't too interested in security issues as he isn't certain the risk is high enough. Still, Curtis wants to implement something that can collect data about just how often they are attacked, and from this, perhaps create a business case for why security must be taken seriously. He needs to know even when a simple scan is taking place.
That tool can he use?

A) GFI Guard
B) NMap
C) Genius
D) Snort

Question 53

Steve is suspicious that someone in his company is attempting to access folders that are unrelated to their job or projects. His first step is to create groups and solidify permissions to prevent this sort of access. He then creates a folder project called "New Netbook OS Project - Do Not Leak to Media" and places fictitious documents inside of it. He then monitors the gadget sites for information and when he sees something, checks what employee accessed that file.
What has Steve done?

A) Created a "Honeypot"
B) Setup a network "Tar Pit"
C) Configured a "Black Hole Trap"
D) Created a "Honey Token"

Question 54

Which of the following tools can be used to collect webpages for offline browsing?

A) url snarf
B) mget
C) wget
D) black spider

Question 55

NIDS operate at layer 2. Raw traffic is observed by the hardware and the packets are provided to analysys software. It can be possible to confuse the detection engine of the NIDS by modifying the packets in stream. Which of the following tools accomplishes this?

A) Fragroute
B) tcpfrag
C) rcpdump
D) fragtraf

Question 56

When evaluating possible NIDS, you are concerned that an attacker might detect the present of
Your monitoring agent. Which if the following techniques can be used to hide the NIDS? (Choose two)

A) NIDS will not respond to scans by default, detection is not possible
B) Set the IP address of the tap to be the same as the gateway
C) Have two NICS, and make sure the tap is not bound to the IP stack
D) Use a receive only cable on the tap

Question 57

Jeremy knows that the network has been breached and several important files have been modified. After analyzing the access and firewall logs, he can't come to any sort of conclusion about exactly what happened. In the future, he wants to make sure he can detect when certain files change, then maybe use honey tokens to catch the intruders.
Of the following will accomplish this task?

A) Kismet
B) Strataguard
C) Snortsam
D) Tripwire

Question 58

ARP spoofing can be used to perform "Man in the Middle" attacks and should be monitored against. Which of the following techniques can be used to defend against this?

A) Use Arpwall to block ARP spoofing attacks
B) VLANs
C) Static ARP configurations
D) Detection of large amounts of ARP traffic

Question 59

Which of the following snort rules looks for FTP login attempts?

A) Alert tcp any any -> any any 21 (content:"user root"; msg:"FTP Login attempt";)
B) Alert ftp -> any port 21 (content:"user login";)
C) -A INPUT -j LOG -dport 21 -p TCP
D) Tcp.port == 21 && host eq any

Question 60

Marco is noticing several xmas scans on his network. What can he use to prevent this?

A) Implement an IDS to block this flag combination
B) Use port sentry to detect and block port scans
C) Use an IPS to react to the scan by blocking traffic from that source address
D) xmas scans are an outdated technique that won't work anyway. He shouldn't worry about it

Question 61

Using netcat, cryptcat, or ncat to transfer files across a network is a common practice for a pentester because any port that will pass through the filters between the target and tiger box can be used. Which of the following commands will transfer a binary file on a commonly unfiltered web port?

A) nc -l -u -p 8080 > /home/tiger/foo.txt
B) nc -l -u -p 8080 < /home/tiger/foo.txt
C) nc -l 8080 -u -p < /home/tiger/foo.txt
D) nc -l 1080 -u -p < /home/tiger/foo.txt

Question 62

Baxter has been told he must install a new IDS. State requlations require it to have a "Time Based Induction Machine" in the detection engine. What type of IDS is Baxter going to use?

A) Pattern Matching
B) A flux capacitor
C) Real Time Anomaly Detection
D) Statistical Based Analyzer

Question 63

Cisco devices use a protocol called CDP (Cisco Discovery Protocol) that allows routers to share information about each other. These messages can sometimes be sniffed. What is the destination MAC address for a CDP message?

A) 00-00-00-00-00-00
B) FF-FF-FF-FF-FF-FFF
C) 01-00-0C-CC-CC-CC
D) 01-46-02-7B-45-AD

Question 64

When logging into an IRC server, what two commands must be passed by the IRC client?

A) USER, NICK
B) PING, USER
C) USER, JOIN
D) QUERY, JOIN