Promiscuous mode refers to the special mode of Ethernet hardware that allows a NIC to receive all traffic on the network, even if it is not addressed to this NIC. By default, a NIC ignores all traffic that is not addressed to it, which is done by comparing the destination address of the Ethernet packet with the hardware address (a.k.a. MAC) of the device. While this makes perfect sense for networking, non-promiscuous mode makes it difficult to use network monitoring and analysis software for diagnosing connectivity issues or traffic accounting.

You must report your client immediately if they are involved in any illegal activities.

Smart card = Something you have
PIN = Something you know

Immediately report the findings to the administrator to avoid future damages.

L0phtCrack is a Windows password recovery tool that can be used by cybercriminals with the dictionary, brute force, and hybrid password-cracking attacks. SMBRelay is a Server Message Block (SMB) server that is used to grab usernames and password hashes from inbound SMB traffic.

Phases of Ethical Hacking
1. Reconnaissance
2. Scanning and Enumeration
3. Gaining Access
4. Maintaining Access
5. Clearing and Covering Tracks

Aside from refraining from using public networks, encryption is the best bet for protecting the network from potential packet sniffers.

A security procedure is a set sequence of necessary activities that performs a specific security task or function. Procedures are normally designed as a series of steps to be followed as a consistent and repetitive approach or cycle to accomplish a result.

The LM hash is computed as follows.
1. The user’s password as an OEM string is converted to uppercase.
2. This password is either null-padded or truncated to 14 bytes.
3. The “fixed-length” password is split into two 7-byte halves.
4. These values are used to create two DES keys, one from each 7-byte half.
5. Each of these keys is used to DES-encrypt the constant ASCII string “KGS!@#$%”, resulting in two 8-byte ciphertext values.
6. These two ciphertext values are concatenated to form a 16-byte value, which is the LM hash. The hashes themself are sent in clear text over the network instead of sending the password in cleartext.

An active Intrusion Detection System (IDS) is also known as Intrusion Detection and Prevention System (IDPS). It is configured to automatically block suspected attacks without any intervention required by an operator.

Botnet refers to the group of hijacked or infected computers, servers, mobile devices, and IoT (Internet of Things) devices that are being controlled by a hacker. Botnets are used to carry out malicious activities such as account credential leakage, unauthorized access and clicking of ads, sending spam emails, and participating in DDoS (Distributed Denial of Service) attacks.

Correct Answer:

A. Wiretapping

Explanation:

Wiretapping is a well-established method used by law enforcement and intelligence agencies to intercept electronic communications. It involves monitoring a communication channel, such as a phone line or network cable, to capture the transmitted data (voice conversations, emails, etc.). This data can then be analyzed to gather information.

It has been used by government authorities as a method of information discovery. Wiretapping refers to the interception and monitoring of private communications, such as telephone conversations, without the consent of the parties involved. This technique has been historically used by law enforcement and intelligence agencies to gather information and evidence for investigations.

Incorrect Answers:

• B. Spoofing: Spoofing involves creating fake identities or data to deceive a system or user. While it can be used to gain unauthorized access to information, it’s not typically the primary method for government information discovery through network monitoring. Spoofing is a technique where the attacker impersonates another entity, such as a website or email address, to deceive the victim. While spoofing can be used for information gathering, it is not the same as wiretapping.
• C. SMB Signing: SMB signing is a security mechanism used in the Server Message Block (SMB) protocol to ensure data integrity during file sharing. It’s not directly related to information discovery by government authorities. signing is a security feature that provides authentication and integrity for SMB communications. It is not a method of information discovery used by government authorities.

Additional Notes:

• The legality of wiretapping can vary depending on the jurisdiction and the specific circumstances.
• There are strict regulations governing how and when government agencies can use wiretapping for information gathering.

By understanding these methods, ethical hackers can better identify potential vulnerabilities and develop security measures to protect sensitive information.

A signature-based IDS can only detect known attacks for which a signature has previously been created.

A dictionary attack is a brute-force technique where attackers run through common words and phrases, such as those from a dictionary, to guess passwords.

Pure, low-interaction, and high-interaction are types of honeypot deployments.

A passive IDS is a system that’s configured to only monitor and analyze network traffic activity and alert an operator to potential vulnerabilities and attacks. A passive IDS is not capable of performing any protective or corrective functions on its own.

Cross-site scripting, Broken Authentication, and Injection belong to the OWASP Top 10 Web Application Security Risks.

The code emulation method of malware detection scans a file’s behavior by emulating its execution in a virtual (emulated) environment.

Evil Twin is a wireless AP that pretends to be a legitimate AP by imitating another network name. It poses a clear and present danger to wireless users on private and public WLANs.

Scanning the broadcast address makes the scan target all IP addresses on that subnet at the same time.

Remote-Access Policy (RAP) contains a set of rules that define authorized connections. It defines who can have remote access, the access medium, and remote access security controls. This policy is essential in larger organizations since most employees are now working from home.

Blind FTP, also known as anonymous FTP, allows users to go directly to a specific directory as long as they use the correct path and file name.

According to ISO 27001, residual risk is “the risk remaining after risk treatment”.

PsExec or psexec.exe is a command-line utility built for Windows. It allows administrators to run programs on local and more commonly remote computers.

Denial of service, or DoS, is an attack on a computer or network which makes it inaccessible to the user. Some popular DoS attacks are SYN flood, ICMP flood, and smurf.

· DH Group 1: 768-bit group
· DH Group 2: 1024-bit group
· DH Group 5: 1536-bit group
· DH Group 14: 2048-bit group
· DH Group 15: 3072-bit group

Network Time Protocol (NTP) is a protocol used to synchronize computer clock times in a network.

A simple way of splitting packets is by fragmenting them, but an adversary can also simply craft packets with small payloads. A whisker is an evasion tool that crafts packets with small payloads referred to as session splicing.

The third phase of ethical hacking known as Gaining access. This is the phase where the actual ethical hacking takes place. The system weaknesses or vulnerabilities found in phases one and two were exploited by the hacker to obtain access to the system.

WPA2 is an updated version of WPA that uses AES encryption and long passwords to create a secured network. CCMP, also known as AES CCMP is the security standard used with WPA2 wireless networks. CCMP employs 128-bit keys and a 48-bit initialization vector that minimizes vulnerability to replay attacks.

Cross-site scripting, Broken Authentication, and Injection belong to the OWASP Top 10 Web Application Security Risks.

Snow.exe is a steganography tool that can be used to embed and mask secret data within simple text files. Since spaces and tabs are usually not visible in text viewers, where the file will likely open, messages can be effectively sneaked in without cluing in an unguarded observer.

Microsoft Baseline Security Analyzer (MBSA) is an easy-to-use tool designed for IT professionals and helps small and medium-sized businesses determine their security state per Microsoft security recommendations and offers specific remediation guidance. It is a standalone security and vulnerability scanner designed to provide a streamlined method for identifying common security misconfigurations and missing security updates.

A password policy encourages users to use strong passwords and update them properly to enhance a web server’s security.

Change Management Policy refers to a process of making changes to IT, software development, and security services or operations. This policy aims to increase the awareness and understanding of proposed changes across an organization and ensure these changes are conducted methodically to minimize any unfavorable impact on services and customers.

Password hashing is a password encryption method done before its storage so that the system password databases cannot easily be decrypted.

To open the Services Manager from command line just type services.msc in your run box or at the command line.

Sensitive data exposure happens when an application fails to secure the stored or in-transit sensitive information such as account credentials, credit card numbers, Social Security Numbers, financial and healthcare information, and other personally identifiable information (PII) against hackers.

Unicode attacks can be effective against applications that understand them. Unicode evasion is also referred to as UTF-8 evasion. Non-Unicode character encodings are known as overlong characters, and may be signs of an attempted attack.

Single sign-on (SSO) is an authentication method that allows users to securely authenticate with multiple applications and websites by using just one set of credentials.

To prevent smurf attacks, you can:
1. Disable IP-directed broadcasts on your router.
2. Reconfigure your operating system to disallow ICMP responses to IP broadcast requests.
3. Reconfigure the perimeter firewall to disallow pings originating from outside your network.

TCP XMAS scan is used to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with all possible flags set in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.

Active reconnaissance is the opposite of passive reconnaissance wherein the information is gathered by directly engaging with the potential target. This may be done via manual testing or automated scanning using tools such as Nmap, ping, traceroute, and netcat.

A zero-day attack (also referred to as Day Zero) is an attack that exploits a potentially serious software security weakness that the vendor or developer may be unaware of. The software developer must rush to resolve the weakness as soon as it is discovered in order to limit the threat to software users.

IP fragmentation occurs when packets are broken up into smaller pieces (fragments) so they can pass through a link at a smaller maximum transmission unit than the original or larger packet size. IP fragmentation can cause problems when fragments are affected by packet loss and cause excessive retransmissions. This can cause performance issues. To recover the loss of a fragment, protocols, like TCP, retransmit fragments in order to reassemble them. Fragmented traffic can also be crafted to evade intrusion detection systems and be used maliciously.

Correct Answer:

B. Port numbers of application layer and headers of the transport layer.

Explanation:

Firewalls are crucial security components that filter incoming and outgoing network traffic based on predefined security policies. To achieve this, they perform various inspections on data packets as they traverse the firewall. Here’s how the correct answer elements work in this process:

• Port Numbers (Application Layer): These are unique identifiers assigned to specific applications or services. By analyzing the port number within a packet’s header, the firewall can determine the type of traffic (e.g., web traffic on port 80, email on port 25). Firewalls can then use this information to allow or block traffic based on permitted application usage within an organization.
• Transport Layer Headers (Transport Layer): These headers reside within the transport layer (TCP or UDP) of the OSI (Open Systems Interconnection) model. They provide vital information for establishing and maintaining communication between devices, such as:
  • Source and destination port numbers (reinforcing the application identification)
  • Sequence numbers (ensuring data integrity)
  • Control flags (regulating data flow)

By examining both the port number and relevant transport layer header information, a firewall can make more informed decisions about allowing or blocking traffic.

Incorrect Answers:

• A. Headers of presentation layer and port numbers of the session layer:
  • The presentation layer deals with data formatting, not directly involved in firewall filtering.
  • Session layer manages connections but doesn’t typically define ports like the application layer.
• C. Port numbers of Transport layer and headers of the application layer: This reverses the correct association of port numbers and header information.
• D. Headers of presentation layer and port numbers of the session layer: This repeats the incorrect aspects of option A.

In conclusion, understanding how firewalls utilize port numbers and transport layer headers empowers ethical hackers to assess network security effectiveness and identify potential vulnerabilities.

The passive operating system fingerprinting is a feature built into both the pf and tcpdump tools.

Connection Establishment: SYN, SYN-ACK, ACK
Connection Termination: FIN, ACK-FIN, ACK

The Open Web Application Security Project or OWASP is a non-profit foundation dedicated to providing unbiased, practical, and cost-effective information about application security.
OWASP’s Top 10 Security Vulnerabilities provides a ranking of the top ten most critical web application security risks. It offers insights to developers and security professionals on the most prevalent vulnerabilities that are commonly found in web applications so they may incorporate the report’s findings and recommendations into their security practices.

A business impact analysis (BIA) predicts the consequences of disruption of a business function and process and gathers information needed to develop recovery strategies. Potential loss scenarios should be identified during a risk assessment.

Hash functions are not reversible.

A contract and non-disclosure agreement (NDA) is usually signed between the ethical hacker and the organization. This ensures the legality of what they are doing and that both parties are protected.

An omnidirectional antenna is a wireless transmitting/receiving antenna that radiates or intercepts radio-frequency (RF) electromagnetic fields equally well in all horizontal directions in a flat, two-dimensional (2D) geometric plane. Omnidirectional antennas are used in most consumer RF wireless devices, including cellular telephone sets and wireless routers.

ARP poisoning, also known as ARP flooding is a technique used to attack a local-area network (LAN). It allows an attacker to intercept data frames on a LAN, modify the traffic, or stop the traffic altogether. The attack can only be used on networks that make use of the Address Resolution Protocol (ARP) and not another method of address resolution.

Correct Answer:

C. ESP confidential

ESP (Encapsulating Security Payload) provides both authentication and encryption. In “confidential” mode, ESP encrypts the payload (data) while maintaining data integrity. This mode ensures confidentiality within the same LAN.

Explanation:

IPSec (Internet Protocol Security) offers two main encryption modes: Authentication Header (AH) and Encapsulating Security Payload (ESP). When prioritizing data confidentiality within a LAN, ESP confidential mode is the most suitable choice:

• AH (Authentication Header):
  • Provides data integrity by adding a digital signature to the packet header.
  • Doesn’t encrypt the data payload, making it unsuitable for confidentiality requirements.
• ESP (Encapsulating Security Payload):
  • Encrypts the entire data payload, ensuring confidentiality of the transmitted information.
  • Offers optional integrity checking through an additional header.

Mode Selection:

• AH Tunnel Mode: Primarily used for remote network connections, not ideal for securing data within the same LAN.
• AH Promiscuous Mode: A less common mode not typically used in standard IPSec implementations.
• ESP Transport Mode: Encrypts the data payload but leaves the header unencrypted. While it offers confidentiality, it might not be suitable if header information also needs protection.
• ESP Confidential Mode: Encrypts both the data payload and the header, providing the highest level of security and confidentiality for traffic within your LAN.

By choosing ESP confidential mode, you ensure that the data exchanged between devices on your LAN remains confidential, even if someone manages to capture the network traffic.

L0phtCrack 7 is a state-of-the-art tool for password auditing and recovery that serves to guide organizational policies and procedures. uses a variety of sources and methods to retrieve passwords from the operating system.

Cryptography plays a major role in ensuring data integrity. Commonly used methods to protect data integrity include hashing the data you receive and comparing it with the hash of the original message.

Address Resolution Protocol (ARP) is one protocol of the TCP/IP protocol suite that is used to resolve an IP address to its matching MAC address.

SSH-2 protocol supports Publickey, Host-based, and Password-based authentication types. SSH-1 supports a wider range of account authentication types, including RSA only, RhostsRSA, Rhosts (RSH-style), TIS, and Kerberos authentication types.

Tcp-over-DNS is a tool that can be utilized in evading firewall inspection.

Two-factor authentication (2FA) is a security process in which users provide two out of three different authentication factors to verify themselves. The three authentication factors are something you have (smartcard ID), something you know, and something you are (Fingerprint).

Denial of service, or DoS, is an attack on a computer or network which makes it inaccessible to the user. Some popular DoS attacks are SYN flood, ICMP flood, and smurf.

A wrapper is a tool used to combine a harmful executable file with a harmless executable file.

802.1X is a network authentication protocol that opens ports for network access when an organization authenticates a user’s identity and authorizes them for access to the network.