Question 1

Cade ran a scan on a system and could not identify the operating system. There does seem to be a webserver running though. How can that fact help Cade figure out the rest of the system?
A) Telnet to the open port an grab a banner
B) Use a browser to view the web page
C) Use an FTP client to connect to port 80 and observe the error messages
D) View the source code of the index.html page

Accepted Answer

Banner grabbing is a basic activity on a pentest. Each protocol requires different commands, therefore
this is also a good way to verify services on the open ports.

Question 2

Cade ran a scan on a system and could not identify the operating system. There does seem to be a webserver running though. How can that fact help Cade figure out the rest of the system?
A) Telnet to the open port an grab a banner
B) Use a browser to view the web page
C) Use an FTP client to connect to port 80 and observe the error messages
D) View the source code of the index.html page

Accepted Answer

Banner grabbing is a basic activity on a pentest. Each protocol requires different commands, therefore this is also a good way to verify services on the open ports.

Question 3

Knowing ports is important for attackers, pentesters and analysts. On a windows system, what are the port numbers for the following protocols (in order)?
Kerberos, WINS, RPC, SMB Session, CIFS
A) 82, 42, 139, 135, 445
B) 88, 445, 42, 445, 139
C) 42, 88, 135, 139, 445
D) 88, 42, 135, 139, 445

Accepted Answer

Port numbers are considered pre-requisite assumptions for this class. The trick is not memorizing, it is about noticing them as they are mentioned while you study the material. Exposure to them alone should be enough to understand them in practice.

Question 4

During the network footprinting phase it is often helpful to get information from DNS that can reveal hosts, which in turn reveal network segments and traceroute can reveal even more. Obtaining records like CNAME, MX, and A are examples of this. Of the following answers, what is the best way to describe what the attacker is looking for?
A) Zone harvest
B) Zone Poison
C) Zone transfer
D) Zone estimate

Accepted Answer

Using tools like nslookup, dig, and host. Full transfers might be possible. They likely will not be however if the command only takes 5 seconds and could save hours it could be worth a try. BE aware that it is a TCP transfer and attempts to obtain zones all at once can be detected and logged. The alternative is to attempt to get the records in a way that looks like simple client requests, one at a time.

Question 5

Which of the following is an example of a UNC link?
A) \server\share
B) UNC : / / server.com / share
C) file:\unc.server.com\share
D) UNC shares can only be accessed via drive mapping, not addresses.

Accepted Answer

Universal Naming Convention is used in the Windows file sharing protocols to identify a resource on the network. For Linux systems, the slashes going in the wrong direction sometimes require escape slashes. The UNC would look like \\server\share.

Quiz 2: Information Gathering

Cade ran a scan on a system and could not identify the operating system. There does seem to be a webserver running though. How can that fact help Cade figure out the rest of the system?

Cade ran a scan on a system and could not identify the operating system. There does seem to be a webserver running though. How can that fact help Cade figure out the rest of the system?

Knowing ports is important for attackers, pentesters and analysts. On a windows system, what are the port numbers for the following protocols (in order) ? Kerberos, WINS, RPC, SMB Session, CIFS

Which of the following is an example of a UNC link?