Complete Ethical Hacking Exam 1

HTTP/HTTPS

Layer 7 — Application

DNS

Layer 7 — Application

SMTP

Layer 7 — Application

SSH

Layer 7 — Application

UTF-8

Layer 6 — Presentation

JPEG

Layer 6 — Presentation

Encryption

Layer 6 — Presentation

Session coordination

Layer 5 — Session

Checkpoints

Layer 5 — Session

Recovery

Layer 5 — Session

TCP

Layer 4 — Transport

UDP

Layer 4 — Transport

Port numbers

Layer 4 — Transport

IP

Layer 3 — Network

ICMP

Layer 3 — Network

Routers

Layer 3 — Network

Ethernet

Layer 2 — Data Link

Wi-Fi

Layer 2 — Data Link

MAC addresses

Layer 2 — Data Link

Switches

Layer 2 — Data Link

Cables

Layer 1 — Physical

Fiber

Layer 1 — Physical

Radio waves

Layer 1 — Physical

Hubs

Layer 1 — Physical

How do you know if a host is local?

If it's IP is in the same subnet as yours

What does /24 mean?

the first 24 bits identify the network

If your IP is 192.168.12.4, is 192.168.12.50/24 in the same network?

Yes

If your IP is 192.168.12.4, is 192.168.13.50/24 in the same network?

No

If your IP is 192.168.12.4, is 192.168.13.50/16 in the same network?

Yes

Ping

send a message from one computer to another to check whether it is reachable and active

Traceroute

A program that shows the route a packet takes across the Internet

What does - mean?

File

What permissions does the owner have? -rw-r--r-- 1 root www-data 891 index.php

read/write

What permissions does the group have? -rw-r--r-- 1 root www-data 891 index.php

read

Who is the owner? -rw-r--r-- 1 root www-data 891 index.php

root

Who has read permissions? -rw-r--r-- 1 root www-data 891 index.php

Group and everyone else

What is the file's size? -rw-r--r-- 1 root www-data 891 index.php

891 bytes

Network Address Translation (NAT)

Translates the private IP address to a public address for routing over the Internet

nmap

A network scanner that automates scanning ports to see what's open.

Wireshark

Application that captures and analyzes network packets

ICMP (Internet Control Message Protocol)

Internet Control Message Protocol. Used for diagnostics such as ping. Many DoS attacks use ICMP. It is common to block ICMP at firewalls and routers. If ping fails, but other connectivity to a server succeeds, it indicates that ICMP is blocked.

Spoofed source IP → reflected denial of service

Spoofed IP attacks from innocent third party.

Default credentials

Least glamorous and most effective initial access

TLS in an HTTPS connection uses: asymmetric / symmetric / both / neither?

Both

Asymmetric Cryptography

A form of cryptography that uses two separate, but mathematically related, keys for encryption and decryption; also called public key cryptography.

Symmetric Cryptography

Uses the same key for encryption and decryption.

What is symmetric encryption best at?

Encrypting lots of data quickly

What is asymmetric encryption best at?

Authentication and securely establishing shared keys

When you open https://utexas.edu, WHY do you trust the cert it sends?

Because your browser verified it through a trusted Certificate Authority (CA)

SSH with an RSA key: how does the server verify it's really you -- and how

does your client know it reached the real server, not a MITM?

The server has your public key and uses it to verify you. Your client knows it reached the real server because the server proves it owns its private host key and your client checks the server's public host key against the one saved in ~/.ssh/known_hosts.

Identify the first field: kali:$y$j9T$syJ4...$0RGh...:19212:0:99999:7:::

kali, the username

Identify the second field: kali:$y$j9T$syJ4...$0RGh...:19212:0:99999:7:::

Password hash: $y$ = yescrypt, j9T = parameters, syJ4... = salt, 0RGh... = hash

Identify the third field: kali:$y$j9T$syJ4...$0RGh...:19212:0:99999:7:::

19212, Last password change, in days since January 1, 1970

Identify the fourth field: kali:$y$j9T$syJ4...$0RGh...:19212:0:99999:7:::

Minimum days between password changes; 0 allows changes immediately

Identify the five field: kali:$y$j9T$syJ4...$0RGh...:19212:0:99999:7:::

999999: Maximum password age in days; a very large limit

Identify the sixth field: kali:$y$j9T$syJ4...$0RGh...:19212:0:99999:7:::

Warn the user 7 days before their password expires

Seventh field in /etc/shadow?

Inactivity period after password expiration before disabling the account; unset

Eighth field in /etc/shadow?

Account expiration date, in days.

Ninth field in /etc/shadow?

Reserved for future use

Turn a hash/digest back into a password: name the approaches.

Brute force, Dictionary, Rule based, rainbow tables

Turn a hash/digest back into a password: say what a per-user SALT defeats, and why.

A unique per-user salt is combined with the password before hashing. It defeats:

Reusable precomputed tables: attackers need separate computations for each salt.

Spotting identical passwords by identical hashes: different salts produce different hashes, even for the same password.

Testing one computed hash against many users: each user's salt requires a separate computation.

How does nmap 1.1.1.1 learn a port is open?

Defaults to SYN scanning if it has the required privileges; otherwise uses connect scanning.

How does nmap -sT 1.1.1.1 learn a port is open?

Asks the OS to complete the TCP handshake: SYN → SYN-ACK → ACK. A successful connection means the port is open.

How does nmap -sS 1.1.1.1 learn a port is open?

Sends SYN; receiving SYN-ACK means the port is open. Resets the connection without completing the handshake.

Why is a SYN (-sS) scan "stealthier" than a full connect (-sT)?

It never establishes a full connection, so it is less likely to appear in application connection logs.

What does nc -l -p 1337 -e /bin/bash do?

-l: listen for incoming connections.

-p 1337: listen on port 1337.

-e /bin/bash: run Bash when someone connects, connecting its input/output to the network.

This creates a bind shell.

If nc -l -p 1337 -e /bin/bash is on a host you want to compromise, what do you run as the attacker to use it?

nc 1337

DNS (Domain Name System)

The service that translates URLs to IP addresses.

TCP (Transmission Control Protocol)

Transmission Control Protocol - provides reliable, ordered, and error-checked delivery of a stream of packets on the internet.. Three way Handshake.

TCP Port Closed?

RST ACK — or silence, if filtered

Three Way Handshake

Source → Destination: SYN

Destination → Source: SYN ACK

Source → Destination: ACK

TCP connection identified by:

(Source IP, Source Port, Destination IP, Destination Port)

CVE (Common Vulnerabilities and Exposures)

A unique ID for one specific vulnerability.

CVSS — Common Vulnerability Scoring System

Impact (RCE? DoS? info leak?) + access (remote? auth required?) + more

· Combines into one number, e.g. 8.2 — never perfect, but triageable

CWE — Common Weakness Enumeration

A category, not an instance — e.g. CWE-862, Missing Authorization

vsftpd 2.3.4 backdoor

A username containing a smiley face trips the backdoor

Your resolver doesn't know the answer

for utexas.edu. Where does it look, in order?

Root → .edu TLD → utexas.edu authoritative server

What is /etc/shadow?

/etc/shadow is a Linux file that stores users’ password hashes and password-aging information.

Each entry includes:

• Username.

• Salted password hash, not the plaintext password.

• Last password-change date.

• Minimum and maximum password age.

• Expiration warnings and account-expiration settings.

Debian's OpenSSL bug

Commented out entropy pool - no real randomness

Hash tables

Hash tables contain a table with data and a mapping function which assigns each entry a corresponding hash. Use fast, PUBLIC, no-crypto hash

Uses of asymmetric cryptography?

Confidentiality — encrypt TO someone and Authentication / signing — prove something came FROM you

Diffie-Hellman

shared secret over a public channel

SSH known_hosts

File used to store public keys of a remote system(s) that a Linux workstation has previously connected to.

Certificate Pinning

hardcode the expected cert/key, skip the CA check entirely

Forward secrecy

Combine Diffie-Hellman WITH a long-term key (RSA cert, etc.) Payoff: even if the long-term key leaks or is cracked YEARS later ...a recorded old session still can't be decrypted

Given a snippet that builds a shell command from user input: what's the vulnerability, how is it exploited, and how do you fix it (properly)?

OS command injection, user input becomes part of a shell command, allowing it to be interpreted as instructions. Fix it by: avoiding the shell

"They wrapped the input in quotes." Is that fix adequate? Why / why not?

No, because the attacker can use input to break out of the quotes.

SQL injection: a login runs ...WHERE user='$u' AND pass='$p'. What input logs you in as admin with no password, and how do you fix it?

Username: admin' -- Password: anything (... WHERE user='admin' -- ' AND pass='anything')

Fix: use parameterized queries

return open('/data/' + user).read() -- what can an attacker read, and how?

The attacker can traverse out of the path with ../ and climb out of data to read any file the OS user can.

Command Injection

A web app builds a shell command by gluing together a fixed string and user input.

Fixes for Command Injection (in order of effectiveness):

Quoting, Escaping via Regex, Encoding, Parameterization

Quoting Flaws

Malicious input can still break out, using a quote character in input closes quote early

Escaping via regex Flaws

If you get the regex slightly wrong (like forgetting the /g) and only the first quote in the input gets escaped, a second quote can still break out.

Encoding Flaws

You can still use a file path to break out.

What is parameterization?

Stop building a STRING at all — pass arguments as separate, structured values. No shell parsing step left for an attacker to hijack.

SQL injection

Same build a string and give to interpreter. Able to escape.

Parameterized statements

Same idea as command injection's fix, from earlier — stop building a string at all:

String query = "SELECT id FROM table WHERE name = ?";

PreparedStatement pstmt = connection.prepareStatement(query);

pstmt.setString(1, name); pstmt.execute();

▸ The database engine keeps the query structure and the data cleanly separate

What is escape via regex?

Escape quote characters so they can't close the wrapper early:

$userName = $userName.sub(s/\"/\\\"/g) # replace " with \"

What is encoding?

Use a real, tested encoding function instead of a hand-rolled regex:

$userName = encode($userName)

Why does wrapping user input in quotes

fail to stop command injection?

Adding a quote closes the wrapper early