A bollard is a sturdy, short, vertical post.

DH Group 1: 768-bit group
DH Group 2: 1024-bit group
DH Group 5: 1536-bit group
DH Group 14: 2048-bit group
DH Group 15: 3072-bit group

TCP traffic begins with a three-way handshake. In this TCP handshake process, a client needs to initiate the conversation by requesting a communication session with the Server.
SYN — Used to initiate and establish a connection. It also helps you to synchronize sequence numbers between devices.
ACK — Helps to confirm to the other side that it has received the SYN.
SYN-ACK — SYN message from local device and ACK of the earlier packet.
FIN — Used to terminate a connection.

Challenge-response authentication can defend against session replay attacks, in which an attacker listens to previous messages and resends them later to get the same credentials as the original message. Challenge-response systems defend against replay attacks because each challenge and response is unique.

Ettercap is a comprehensive suite for man-in-the-middle attacks. It features sniffing of live connections, content filtering on the fly, and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

Ping of Death is a type of Denial of Service (DoS) attack in which an attacker attempts to crash, destabilize, or freeze the targeted computer or service by sending malformed or oversized packets using a simple ping command.

The OSSTMM recognizes three types of compliance:
A. Legislative. Compliance with legislation is in accordance to the region where the legislation can be enforced. The strength and commitment to the legislation comes from previously successful legal arguments and appropriately set and just enforcement measures. Examples are Sarbanes-Oxley, HIPAA, and the various Data Protection and Privacy legislation.
B. Contractual. Compliance to contractual requirements are in accordance to the industry or within the group that requires the contract and may take action to enforce compliance. An example is the payment card industry data security standard (PCI DSS) promoted and required by VISA and MasterCard.
C. Standards based. Compliance to standards is in accordance with the business or organization where the compliance to standards is enforced as policy. Examples are the OSSTMM, ISO 27001/5, and ITIL.

Cross-site scripting or XSS flaws occur whenever an application allows users to add custom code that includes data from untrusted sources without proper validation. Hackers inject malicious scripts into a victim’s system by hiding them within legitimate requests.

-sS is a command line switch used for finding out the most commonly used TCP port using TCP SYN scan or stealth scan.

According to ISO 27001, residual risk is “the risk remaining after risk treatment”.

The NetStumbler application is a Windows-based tool generally used to discover WLAN networks running on 802.11 a/b/g standards. It helps detect other networks that may cause interference to your network, and is generally used for war driving purposes by attackers. It can also find out poor coverage areas in the WLAN network, and helps the administrator set up the network the way it is intended to be.

Cross-site scripting or XSS flaws occur whenever an application allows users to add custom code that includes data from untrusted sources without proper validation. Hackers inject malicious scripts into a victim’s system by hiding them within legitimate requests. Hackers can also bypass authentication mechanisms, gain privileges, and then inject malicious scripts into specific web pages. These malicious scripts can hijack user sessions, deface websites, or redirect the user to malicious sites.

Ransomware is a form of malware that restricts the user from accessing their infected computer system or files and then asks for a ransom payment to regain user access. The main goal of a ransomware attack is to extort money from its victims.

L0phtcrack and John the Ripper are two well know password-cracking programs. While netcat is considered the Swiss-army knife of hacking tools, it is not used for password cracking.

Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer.

According to ISO 27001, residual risk is “the risk remaining after risk treatment”.

Cryptcat is a tool used for moving data off the victim’s system across the normal open ports without any of the security devices detecting it.

Cookies can store passwords and form content a user has previously entered, such as a credit card number or an address. Cookies can be stolen using a technique called cross-site scripting. This occurs when an attacker takes advantage of a website that allows its users to post unfiltered HTML and JavaScript content.

Using port security on switches will only allow the first MAC address that is connected to the switch to use that port, thus preventing ARP spoofing. ARPwatch monitors strange ARP activity that can help identify ARP spoofing. On a very small network, static ARP entries are a possibility. However, on a large network, this is not an realistic option.

Secure Hash Algorithm 1 or SHA-1 is a cryptographic hash function that produces a 160-bit (20-byte) hash value.

Tcpdump is a command line utility that allows user to capture and analyze network traffic going through the user’s system. It is often used to help troubleshoot network issues, as well as a security tool. It can also be launched in the background or as a scheduled job using tools like cron.

“set type=ns” specifies a DNS name server for the named zone.

WHOIS is a query and response protocol that is widely used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block or an autonomous system, but is also used for a wider range of other information.

IP fragmentation occurs when packets are broken up into smaller pieces (fragments) so they can pass through a link at a smaller maximum transmission unit than the original or larger packet size. IP fragmentation can cause problems when fragments are affected by packet loss and cause excessive retransmissions. This can cause performance issues. To recover the loss of a fragment, protocols, like TCP, retransmit fragments in order to reassemble them. Fragmented traffic can also be crafted to evade intrusion detection systems and be used maliciously.

The iris, or the colored part of the eye, consists of thick, thread-like muscles. By measuring the unique folds of these muscles, biometric authentication tools can confirm identity with incredible accuracy. Iris scan is also used for liveness detection such as requiring the user to blink for the scan.

TCP traffic begins with a three-way handshake. In this TCP handshake process, a client needs to initiate the conversation by requesting a communication session with the Server.
SYN — Used to initiate and establish a connection. It also helps you to synchronize sequence numbers between devices.
ACK — Helps to confirm to the other side that it has received the SYN.
SYN-ACK — SYN message from local device and ACK of the earlier packet.
FIN — Used to terminate a connection.

‘R U Dead Yet?’ or R.U.D.Y. is a denial-of-service attack tool that aims to keep a web server tied up by submitting form data at an absurdly slow pace. A R.U.D.Y. exploit is categorized as a low-and-slow attack, since it focuses on creating a few drawn-out requests rather than overwhelming a server with a high volume of quick requests. A successful R.U.D.Y. attack will result in the victim’s origin server becoming unavailable to legitimate traffic.

A SOAP client formulates a request for a service. This involves creating a conforming XML document, either explicitly or using Oracle SOAP client API. A SOAP client sends the XML document to a SOAP server. This SOAP request is posted using HTTP or HTTPS to a SOAP Request Handler running as a servlet on a Web server.

Kismet is a wireless network detector, packet sniffer, and intrusion detection system (IDS) that works with any wireless card supporting raw monitoring (rfmon) mode. It can sniff 802.11a, 802.11b, 802.11g, and 802.11n traffic and works on Linux, Mac OSX, and Windows 10 under the WSL framework.

A Trojan is a type of malware in which it disguises itself as something that it isn’t. Trojans often masquerades as a legitimate application, file, or seemingly harmless program to trick its victims into installing it.

Event Viewer is a component of Microsoft’s Windows NT operating system that lets administrators and users view the event logs on a local or remote machine.

Cross-site scripting or XSS flaws occur whenever an application allows users to add custom code that includes data from untrusted sources without proper validation. Hackers inject malicious scripts into a victim’s system by hiding them within legitimate requests. Hackers can also bypass authentication mechanisms, gain privileges, and then inject malicious scripts into specific web pages. These malicious scripts can hijack user sessions, deface websites, or redirect the user to malicious sites.

By attaching itself to the master boot record in a hard drive and changing the machines boot sequence/options Windows 7 boot record never has the opportunity to determine something is wrong.

Minimizing cross-site scripting flaws includes escaping suspicious HTTP requests, validating or sanitizing user-generated content, and enabling content security policy (CSP) as an added layer of in-depth defense in mitigating XSS.

Metasploit framework is a very powerful tool which can be used by cybercriminals as well as ethical hackers to probe systematic vulnerabilities on networks and servers. Because it’s an open-source framework, it can be easily customized and used with most operating systems.

A facial recognition scan measures the geometry of the face, including the distance between the eyes, the distance from the chin to the forehead, and multiple other points on a person’s face.

Everyone including the CEO down to the new hires must comply with security policies. If the executive management does not comply with the security policies and the consequences of non-compliance with the policy are not enforced, then mistrust and apathy toward compliance with the policy can affect your organization.

Data Retention Policy is an organization’s established protocol for retaining information for operational or regulatory compliance needs.

All loggers will work as long as he has physical access to the computers.

The passive operating system fingerprinting is a feature built into both the pf and tcpdump tools.

A “PASS” command is not required for either client or server connection to be registered, but it must precede the server message or the latter of the NICK/USER combination.

TCP traffic begins with a three-way handshake. In this TCP handshake process, a client needs to initiate the conversation by requesting a communication session with the Server.
SYN — Used to initiate and establish a connection. It also helps you to synchronize sequence numbers between devices.
ACK — Helps to confirm to the other side that it has received the SYN.
SYN-ACK — SYN message from local device and ACK of the earlier packet.
FIN — Used to terminate a connection.

Nessus performs vulnerability, configuration, and compliance assessments. It supports various technologies such as operating systems, network devices, hypervisors, databases, tablets/phones, web servers, and critical infrastructure.

A SOAP client formulates a request for a service. This involves creating a conforming XML document, either explicitly or using Oracle SOAP client API. A SOAP client sends the XML document to a SOAP server. This SOAP request is posted using HTTP or HTTPS to a SOAP Request Handler running as a servlet on a Web server.

Computer viruses can spread across the network only with the help of human intervention while worms do it independently.

Programming languages such as C#, Java, Python have built-in inbound checking.

Integrity checking is the process of comparing the current state of stored data and/or programs to a previously recorded state in order to detect any changes.

A wireless intrusion prevention system (WIPS) operates at the Layer 2 (data link layer) level of the Open Systems Interconnection model. WIPS can detect the presence of rogue or misconfigured devices and can prevent them from operating on wireless enterprise networks by scanning the network’s RFs for denial of service and other forms of attack.

A multipartite virus is a fast-moving virus that uses file infectors or boot infectors to attack the boot sector and executable files simultaneously. Most viruses either affect the boot sector, the system or the program files. The multipartite virus can affect both the boot sector and the program files at the same time, thus causing more damage than any other kind of virus.

An information security policy (ISP) is a set of rules, policies , and procedures designed to ensure all users and networks within an organization meet minimum IT security and data protection security requirements.

Microsoft encapsulates NetBIOS information within TCP/IP using port 135 to port 139.

Bluedriving is a bluetooth wardriving utility. It can capture bluetooth devices, lookup their services, get GPS information and present everything in a nice web page.

Tailgating is a social engineering attack by cybercriminals in which they trick employees into helping them gain unauthorized access to the company premises.

Cross-site scripting or XSS flaws occur whenever an application allows users to add custom code that includes data from untrusted sources without proper validation. Hackers inject malicious scripts into a victim’s system by hiding them within legitimate requests.

Connection Establishment: SYN, SYN-ACK, ACK
Connection Termination: FIN, ACK-FIN, ACK

ike-scan is a command-line tool that uses the IKE protocol to discover, fingerprint, and test IPsec VPN servers. It scans IP addresses for VPN servers by sending a specially crafted IKE packet to each host within a network.

Address Resolution Protocol (ARP) is one protocol of the TCP/IP protocol suite that is used to resolve an IP address to its matching MAC address.

Honeypots are a type of deception technology that allows you to understand cybercriminals’ behavior patterns. Security teams can use honeypots to investigate cybersecurity breaches to collect intel on how cybercriminals operate. They also reduce the risk of false positives, when compared to traditional cybersecurity measures, because they are unlikely to attract legitimate activity.

Shellshock, also known as Bashdoor, is a family of security bugs in the widely used Unix Bash shell.

A hybrid attack is a type of password attack that uses a combination of brute force and dictionary attacks such that it adds simple numbers or symbols to the passwords from a world list as it attempts to crack a password.

Encapsulating Security Payload (ESP) provides confidentiality (in addition to authentication, integrity, and anti-replay protection) for the IP payload.

The best defense against any malware attack is having backup files.

Incident management is the process of managing IT service disruptions and restoring services within agreed service level agreements (SLAs).

Stateless firewalls watch network traffic and restrict or block packets based on source and destination addresses or other static values. They’re not ‘aware’ of traffic patterns or data flows.

A security audit is a systematic evaluation of the security of a company’s information system by measuring how well it conforms to a set of established criteria.