Correct Answer:

C. Cross-Site Request Forgery (CSRF)

• Explanation: CSRF attacks occur when an attacker tricks a user into performing actions they did not intend to, such as making unauthorized transactions. This is done by exploiting the user’s authenticated session. In this scenario, Athena clicked on a link that likely contained a hidden request to her bank, which was executed because she was already logged into her bank account.

Incorrect Answers:

A. Webform input validation

• Explanation: This vulnerability involves improper validation of user input in web forms, which can lead to various attacks like SQL injection or XSS. However, it does not fit the scenario where a user is tricked into performing actions on their authenticated session.

B. Cross-Site Scripting (XSS)

• Explanation: XSS attacks involve injecting malicious scripts into web pages viewed by other users. While XSS can be used to steal session cookies or perform actions on behalf of the user, the scenario described does not involve script injection but rather an unauthorized action triggered by a link.

D. Clickjacking

• Explanation: Clickjacking involves tricking a user into clicking on something different from what they perceive, often by overlaying a transparent frame over a legitimate button. This does not match the scenario where a link leads to unauthorized actions being performed on the user’s behalf.

Cross-site request forgery, also known as CSRF is a type of malicious exploit that allows an attacker to trick users to perform actions that they do not intend to. Some examples are changing the email address and/or password, or making a funds transfer. Depending on the nature of the action, the attacker might be able to gain full control over the user’s account.

False positives are mislabeled security alerts. These alerts indicate that there is a threat when in reality no attack has taken place. For example, an alert was triggered indicating a brute force attack, but later on, found out that it was just the user who mistyped the password a lot of times.

Programming languages such as C#, Java, Python have built-in inbound checking.

The management demands metrics to get a clearer view of security. Metrics measures participation, effectiveness, and window of exposure. It provides information the organization can use to make plans and improve programs.

When the CAM table becomes full, the switch acts as a hub by broadcasting packets to all machines on the network. This gives an advantage to the attacker and can sniff all packets coming from the switch.

GINA stands for Graphical Identification and Authentication. Graphical Identification and Authentication (GINA) is a component of Windows 2000, Windows XP, and Windows Server 2003 that provides secure authentication and interactive logon services.

To open the Computer Management Console from the command line just type compmgmt.msc in your run box or at the command line.

Port 25 is SMTP or Simple Mail Transfer Protocol.

Yagi antennas can be used in the frequency range from about 3 – 3000 MHz, with the best operating range below about 1500 MHz.

Cross-site request forgery, also known as CSRF is a type of malicious exploit that allows an attacker to trick users to perform actions that they do not intend to. Some examples are changing the email address and/or password, or making a funds transfer. Depending on the nature of the action, the attacker might be able to gain full control over the user’s account.

The teardrop attack uses overlapping packet fragments to confuse a target system and cause the system to reboot or crash.

The command “nc -l -u -p55555 < /etc/passwd” will grab the passwd file once connected to UDP port 55555.

Passive reconnaissance is the process of gaining valuable information without alerting the potential victim. It is also an act of gathering information without engaging with the system or the individual. An example of passive reconnaissance is reviewing or checking the targeted company’s website.

Key escrow is a cryptographic key exchange process in which a key is held in escrow, or stored, by a third party. A key that is lost or compromised by its original user(s) may be used to decrypt encrypted material, allowing restoration of the original material to its unencrypted state.

An Internet covert channel is the digital equivalent of a briefcase with a secret compartment that a spy might use to slip sensitive documents past security guards into or out of a secure facility. An attacker can use Internet covert channels to transmit sensitive documents unobserved, bypassing network security measures.

To run the Metasploit, the user must first start postgresql server. The user may type “sudo service postgresql start” and enter his/her credentials when prompted.

Penetration testing is a methodological approach to security assessment that encompasses the security audit and vulnerability assessment and demonstrates if the vulnerabilities in the system can be successfully exploited by attackers.

Tcptrace is a tool for the analysis of TCP dump files. It can take as input the files produced by several popular packet-capture programs, including tcpdump/WinDump/Wireshark, snoop, EtherPeek, and Agilent NetMetrix.

DH Group 1: 768-bit group
DH Group 2: 1024-bit group
DH Group 5: 1536-bit group
DH Group 14: 2048-bit group
DH Group 15: 3072-bit group

High humidity in data servers causes corrosion while low humidity causes static electricity.

Python allows you to write programs that can automate tasks you usually do for hours.

Network TAPs are a purpose-built hardware device that sits in a network segment, between two appliances (router, switch or firewall), and allows you to access and monitor the network traffic.

A black-box tester is unaware of the internal structure of the application to be tested, while a white-box tester has access to the internal structure of the application. A gray-box tester partially knows the internal structure, which includes access to the documentation of internal data structures as well as the algorithms used.

Extensible Authentication Protocol (EAP) is an authentication protocol that was originally designed for Point-to-Point connections. It is used as an alternative to CHAP and PAP authentication protocols as it is more secure and supports different authentication mechanisms such as passwords, smart tokens, OTPs (one-time passwords), Secure ID cards, digital certificates, and public-key encryption mechanisms.

As an ethical hacker, it is important to maintain the confidentiality of sensitive data. Do not disclose any sensitive information obtained from your ethical hacking to other third parties unless authorized by the owner. A non-disclosure agreement (NDA) can be issued to gain the trust of your clients.

Ethical hacking is the practice of hacking without malicious intent. The goal of ethical hacking is to expose known security vulnerabilities of a certain system or network to help the owners address and fix these before being discovered by malicious hackers.

In ethical hacking, vulnerability scanning is used to identify the weaknesses in the computer systems and network that occur due to misconfigurations. Without this, it is not possible to determine the existing vulnerabilities within the targeted system or network that can be exploited by the hacker.

Rules of engagement (ROE)are the formal permissions to conduct a penetration test. They provide certain rights and restrictions to the test team for performing the test and help testers to overcome legal, federal, and policy-related restrictions to use different penetration testing tools and techniques.

Cryptcat enables users to communicate between two systems and encrypts the communication between them with twofish.

A Smurf attack occurs when the cybercriminal sends Internet Control Message Protocol (ICMP) broadcast packets to several hosts with a spoofed source Internet Protocol (IP) address that belongs to the targeted machine. The recipients of these spoofed packets will then respond, and the targeted host will be flooded with those responses. These responses will be sent to the victim’s machine since the IP address is spoofed by the cybercriminal. This causes significant traffic to the actual victim’s machine, which causes it to crash.

WebGoat is a deliberately insecure application that allows interested developers just like you to test vulnerabilities commonly found in Java-based applications that use common and popular open-source components.

Diffie-Hellman is for key exchange while RSA and AES is for encryption and decryption. SHA1 is for hashing.

The main purpose of containment is to contain the damage and prevent further damage from occurring (as noted in step number two, the earlier incidents are detected, the sooner they can be contained to minimize damage). It’s important to note that all of SANS’ recommended steps within the containment phase should be taken, especially to “prevent the destruction of any evidence that may be needed later for prosecution.” These steps include short-term containment, system back-up, and long-term containment.

A biometric system should be able to either accept or reject biometric data in real-time.

Test Automation is the best way to increase the effectiveness, efficiency, and coverage of security testing. An automated testing tool can playback pre-recorded and predefined actions, and compare the results to the expected behavior.

Steganography is simply the technique of hiding information from unwanted eyes. It is the practice of hiding information within an ordinary file or message to avoid suspicion. Hackers often use steganography to embed malicious code inside a WAV audio file.

Time synchronization is an important middleware service of distributed systems, amongst which Distributed Intrusion Detection System (DIDS) makes extensive use of time synchronization in particular.

Passive reconnaissance is the process of gaining valuable information without alerting the potential victim. An example of passive reconnaissance is reviewing or checking the targeted company’s website. Some good examples of passive reconnaissance are Shodan, Spyse, theHarvester, and Wireshark.

John the Ripper is often used in the enterprise to detect weak passwords that could put network security at risk, as well as other administrative purposes. The software can run a wide variety of password-cracking techniques against the various user accounts on each operating system and can be scripted to run locally or remotely.

The command “nmap -T4 -F” is used to scan faster than a normal scan because it uses the aggressive timing template and scans fewer ports.

Reconnaissance or footprinting is the preliminary phase or “information gathering” phase of ethical hacking. It is a crucial element of any successful cyberattack, as this is the phase in which the hacker collects all of the necessary information about the target before executing the attack.

The null session is one of the most debilitating vulnerabilities faced by Windows. Null sessions can be established through ports 135, 139, and 445.

Understanding DNS is critical to meeting the requirements of the CEH. When the serial number within the SOA record of the primary server is higher than the Serial number within the SOA record of the secondary DNS server, a zone transfer will take place.

After launching a successful STP manipulation attack, the next step should be creating a SPAN entry on the spoofed root bridge and redirecting the traffic to the cybercriminal’s computer.

The most common web application security weakness is the failure to properly validate input coming from the client or from the environment before using it. This weakness leads to almost all of the major vulnerabilities in web applications, such as cross-site scripting, SQL injection, interpreter injection, locale/Unicode attacks, file system attacks, and buffer overflows.

High humidity in data servers causes corrosion while low humidity causes static electricity.

Phases of Ethical Hacking
1. Reconnaissance
2. Scanning and Enumeration
3. Gaining Access
4. Maintaining Access
Clearing and Covering Tracks

In Adaptive chosen-plaintext attack, the cybercriminal has a complete access to the plaintext message including its encryption, and he/she can also modify the content of the message by making series of interactive queries, choosing subsequent plaintext blocks based on the information from the previous encryption queries and functions. To perform this attack, an attacker needs to interact with the encryption device.

The data obtained by a Heartbleed attack may include unencrypted exchanges between TLS parties likely to be confidential, including any form of post data in users’ requests. Moreover, the confidential data exposed could include authentication secrets such as session cookies and passwords, which might allow attackers to impersonate a user of the service. An attack may also reveal the private keys of compromised parties.

Vulnerability scanning is a method used in checking whether a system is exploitable or not by identifying its vulnerabilities. A vulnerability scanner consists of a scanning engine and a catalog. These tools generally target vulnerabilities that secure host configurations can fix easily, updated security patches, and a clean web document.

Ping is an example of active reconnaissance used to find out whether the destination host is reachable or not.

chntpw is a software utility for resetting or blanking local passwords used by Windows NT, 2000, XP, Vista, 7, 8, and 8.1. It edits the SAM database where Windows stores password hashes.

Avoid Using C and C++ Languages. C/C++ are high-level programming languages that are vulnerable to buffer overflow attacks. Use other programming languages such as Python, Java, and COBOL since these languages don’t allow direct memory access.

A blackbox testing is where the black-box tester is unaware of the internal structure of the application to be tested.

Active reconnaissance is the opposite of passive reconnaissance wherein the information is gathered by directly engaging with the potential target. This may be done via manual testing or automated scanning using tools such as Nmap, ping, traceroute, and netcat.

IPsec is a group of networking protocols used for setting up secure encrypted connections, such as VPNs, across publicly shared networks.

Ethical hackers use the same methods and techniques, including those that have the potential of exploiting vulnerabilities, to test and bypass a system’s defenses as their less-principled counterparts, but rather than taking advantage of any vulnerabilities found, they document them and provide actionable advice on how to fix them so the organization can improve its overall security.

In Linux, logs are stored in /var/log.

A broken authentication vulnerability allows hackers to compromise an account that can be used to take control of the system. This happens when certain applications related to authentication and session management are incorrectly implemented in the system. This will allow hackers to compromise account credentials, keys, and session tokens, leading to identity theft.

A Trojan is a type of malware in which it disguises itself as something that it isn’t. Trojans often masquerades as a legitimate application, file, or seemingly harmless program to trick its victims into installing it.

Trivial File Transfer Protocol (TFTP) runs on port 69. TFTP allows transferring of files without authentication.

DNS or domain name server is the phonebook of the internet. DNS enumeration provides usernames, computer names, and IP addresses of the target systems.

Common Criteria (often abbreviated as CC) is an international set of standardized guidelines and specifications that were developed to evaluate information security products. Specifically, Common Criteria ensures that certified products meet an agreed-upon security standard for government deployments.