Incident management is a set of defined processes to identify, analyze, prioritize, and resolve security incidents to restore and prevent further damage in service operations.

A collision attack is an attempt to find two input strings of a hash function that produce the same hash result.

Wireshark filter “tcp.port == 21” will show traffic from ports 21 which is used for FTP.

A rainbow table attack is a hacking method that involves the use of a rainbow hash table. This table contains the values used to encrypt the passwords before adding them to the database.

Different types of keylogger planted into the environment would retrieve the
passwords for Angel.

The Phases of hacking are: Phase 1-Reconnaissance Phase 2-Scanning Phase 3-Gaining Access Phase 4-Maintaining Access Phase 5-Covering Tracks

Cross-site request forgery, also known as CSRF is a type of malicious exploit that allows an attacker to trick users to perform actions that they do not intend to. Some examples are changing the email address and/or password, or making a funds transfer. Depending on the nature of the action, the attacker might be able to gain full control over the user’s account.

Nessus performs vulnerability, configuration, and compliance assessments. It supports various technologies such as operating systems, network devices, hypervisors, databases, tablets/phones, web servers, and critical infrastructure

The command “nmap -T4 -F” is used to scan faster than a normal scan because it uses the aggressive timing template and scans fewer ports

Vulnerability scanning is a method used to check whether a system is exploitable by identifying its vulnerabilities. A vulnerability scanner consists of a scanning engine and a catalog. These tools generally target vulnerabilities that secure host configurations can fix easily, updated security patches, and a clean Web document.

The OSSTMM recognizes three types of compliance:
1. Legislative. Compliance with legislation is in accordance to the region where the legislation can be enforced. The strength and commitment to the legislation comes from previously successful legal arguments and appropriately set and just enforcement measures. Examples are Sarbanes-Oxley, HIPAA, and the various Data Protection and Privacy legislation.
2. Contractual. Compliance to contractual requirements are in accordance to the industry or within the group that requires the contract and may take action to enforce compliance. An example is the payment card industry data security standard (PCI DSS) promoted and required by VISA and MasterCard.
3. Standards based. Compliance to standards is in accordance with the business or organization where the compliance to standards is enforced as policy. Examples are the OSSTMM, ISO 27001/5, and ITIL.

The requested scan type requires root privileges.

Active sniffing involves sending out multiple network probes to identify access points. The following are examples of different active sniffing techniques:
MAC flooding
DNS poisoning
RP poisoning
DHCP attacks
Switch port stealing
Spoofing attack

Zone transfer is the process of copying the contents of the zone file on a primary DNS server to a secondary DNS server. Using zone transfer provides fault tolerance by synchronizing the zone file in a primary DNS server with the zone file in a secondary DNS server.

Retinal scans capture capillaries deep within the eye by using unique near-infrared cameras.

To open the Computer Management Console from command line just type compmgmt.msc in your run box or at the command line.

Blackberry users have been warned that the security of Blackberry wireless e-mail devices is at risk due to a hacking tool, BBProxy.

Active reconnaissance is the opposite of passive reconnaissance wherein the information is gathered by directly engaging with the potential target. This may be done via manual testing or automated scanning using tools such as Nmap, ping, traceroute, and netcat.

Union-based, Error-based, and Blind are all types of SQL injection attacks.

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface to finding and exploiting security vulnerabilities.

DH Group 1: 768-bit group
DH Group 2: 1024-bit group
DH Group 5: 1536-bit group
DH Group 14: 2048-bit group
DH Group 15: 3072-bit group

In a brute force attack, cybercriminals try every combination of characters until the password is broken. Even though all passwords will be found, this attack is very time consuming.

A SOAP client formulates a request for a service. This involves creating a conforming XML document, either explicitly or using Oracle SOAP client API. A SOAP client sends the XML document to a SOAP server. This SOAP request is posted using HTTP or HTTPS to a SOAP Request Handler running as a servlet on a Web server.

It is a best practice that any Personally Identifiable Information (PII) must be encrypted

False positives are mislabeled security alerts. These alerts indicate that there is a threat when in reality no attack has taken place. For example, an alert was triggered indicating a brute force attack, but later on, found out that it was just the user who mistyped the password a lot of times.

The Phases of hacking are: Phase 1-Reconnaissance Phase 2-Scanning Phase 3-Gaining Access Phase 4-Maintaining Access Phase 5-Covering Tracks

Botnet refers to the group of hijacked or infected computers, servers, mobile devices, and IoT (Internet of Things) devices that are being controlled by a hacker. Botnets are used to carry out malicious activities such as account credential leakage, unauthorized access and clicking of ads, sending spam emails, and participating in DDoS (Distributed Denial of Service) attacks.

Email spoofing is a technique used in spam and phishing attacks to trick users into thinking a message came from a person or entity they either know or can trust. In spoofing attacks, the sender forges email headers so that client software displays the fraudulent sender address, which most users take at face value.

The ping command sends an ICMP echo request to a device on the network, and the device immediately responds with an ICMP echo reply. If there was no response after the ping, the ICMP may be disabled on the target server.

In Linux, to start a process in the background you will use &.

Schtasks allows an administrator to create, delete, query, change, run, and end scheduled tasks on a local or remote system

WHOIS is a query and response protocol that is widely used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block or an autonomous system, but is also used for a wider range of other information.

Nmap is a powerful active reconnaissance tool. This tool can be used to gather lots of information about the target. Let’s see how we can use Nmap in our favor.

Dual-homed or dual-homing refers to an Ethernet device that has more than one network interface used for redundancy purposes. In firewall technology, it is one of the firewall architectures used for implementing preventive security.

The goal of white hat hacking is to check for security vulnerabilities of a certain system or network to help the owners address and fix these before being discovered by malicious hackers.

A SYN flood occurs when a cybercriminal sends a connection request to the targeted server but fails to complete the connection through what is known as a three-way handshake. The incomplete handshake leaves the connected port unavailable for further requests. The cybercriminal will continue sending a connection request until all the ports are saturated, making the legitimate users unable to connect.

An effective disaster data recovery strategy should consist of producing backup tapes and housing them in an offsite storage facility. This way the data isn’t compromised if a natural disaster affects the business’ office. It is highly recommended that the backup tapes be handled properly and stored in a secure, climate-controlled facility. This provides peace of mind and gives the business almost immediate stability after a disaster.

A stateful firewall is a network firewall that monitors the operating state and characteristics of network connections traversing it. The firewall is configured to distinguish legitimate packets for different types of connections. Only packets matching a known active connection (session) are allowed to pass the firewall.

Cyber terrorists are hackers who are influenced by certain religious or political beliefs. They work to cause fear and disruption of systems and networks.

The OSI layer 2 is where packet sniffers collect their data.

A threat is any entity or malicious act with the potential to adversely damage organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

Active reconnaissance is the opposite of passive reconnaissance wherein the information is gathered by directly engaging with the potential target. This may be done via manual testing or automated scanning using tools such as Nmap, ping, traceroute, and netcat.

RSA is based on the practical difficulty of factoring the product of two large prime numbers, the factoring problem.

Tailgaiting is an act where the unauthorized person was able to enter the premises without the authorized person’s knowledge. To avoid Tailgating, employees should be wary of their surroundings.

OS fingerprinting is the process a hacker goes through to determine the type of operating system being used on a targeted computer. This is beneficial because it gives the hacker useful information about any security vulnerabilities of the operating system that can be exploited to launch an attack.

False negative happens when no alarm was raised even though an attack has taken place.

The rubber hose attack is extracting secrets from people by use of torture or coercion.

Fingerprint is considered as “something you are”,
PIN is considered as “something you know”,
Smart Card is considered as “something you have”

Health Insurance Portability and Accountability Act (HIPAA) is a 1996 legislation in the United States that protects patients’ health information from being disclosed without their consent or knowledge. It regulates the use and disclosure of Protected Health Information (PHI) held by “covered entities” (generally, health care clearinghouses, employer-sponsored health plans, health insurers, and medical service providers that engage in certain transactions.)

A digital certificate contains, among other things, the sender’s public key, and can be used to identify the sender.

Suicide hackers are those who hack for some purpose and even don’t bother to suffer long-term jail due to their activities.

If you want to store the packages in binary mode for later analysis use “./snort –l ./log -b”.

Cross-site scripting or XSS flaws occur whenever an application allows users to add custom code that includes data from untrusted sources without proper validation. Hackers inject malicious scripts into a victim’s system by hiding them within legitimate requests. Hackers can also bypass authentication mechanisms, gain privileges, and then inject malicious scripts into specific web pages. These malicious scripts can hijack user sessions, deface websites, or redirect the user to malicious sites.

A boot sector virus is a computer virus that infects a storage device’s master boot record (MBR). The virus moves the boot sector to another location on the hard drive.

Banner grabbing is a technique used by hackers and security teams to gain information about a computer system on a network and services running on its open ports. A banner is a text displayed by a host server containing details like software type and version running in a system or server. The welcome screens divulge software version numbers and other system information on network hosts, giving cybercriminals a leg up on attacking the network.

Height and weight are not ideal choices for biometric controls. Even though these provide some information about the user, they lack distinctiveness and permanence to sufficiently differentiate the user from each other.

The net use command is a Command Prompt command that’s used to connect to, remove, and configure connections to shared resources, like mapped drives and network printers.

The correct syntax for Aleaj to perform an ICMP scan on a remote computer using hping2 is:

C. hping2 -1 host.domain.com

Here’s the breakdown of the options:

• A. hping2 host.domain.com: This is the basic syntax for hping2, but it defaults to TCP mode. It wouldn’t perform an ICMP scan.
• B. hping2 –set-ICMP host.domain.com: While hping2 supports setting various options, “–set-ICMP” is not a valid flag for defining the ICMP mode.
• C. hping2 -1 host.domain.com: This is the correct syntax. The -1 flag in hping2 is specifically used to switch hping2 to ICMP mode. This makes it suitable for sending ICMP echo requests (pings) to the target host.
• D. hping2 -i host.domain.com: While this syntax can also be used for ICMP scans in some versions of hping2, -1 is the more widely recognized and documented flag specifically designed for ICMP mode.

Additional Notes:

• It’s important to use hping2 responsibly and ethically, avoiding scans against targets without permission.

By using hping2 -1 host.domain.com, Aleaj can effectively perform an ICMP scan on the remote computer. This will send ICMP echo requests and wait for responses, helping her determine if the host is reachable and alive.

A black-box tester is unaware of the internal structure of the application to be tested, while a white-box tester has access to the internal structure of the application. A gray-box tester partially knows the internal structure, which includes access to the documentation of internal data structures as well as the algorithms used.

In a brute force attack, cybercriminals try every combination of characters until the password is broken. Even though all passwords will be found, this attack is very time-consuming.

Cybercriminals use TCP XMAS scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with all possible flags set in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.