CySA+ CS0-004 - Quick Drill: Ports, Nmap, CVSS, Regex, Event IDs, Acronyms

Memorization drills that support the CompTIA CS0-004 V4 exam objectives (v2.0)

Port 20/21

FTP (data/control)

Port 22

SSH (also SFTP, SCP)

Port 23

Telnet (cleartext)

Port 25

SMTP

Port 53

DNS (UDP/TCP)

Port 67/68

DHCP (server/client)

Port 69

TFTP

Port 80

HTTP

Port 88

Kerberos

Port 110

POP3

Port 123

NTP

Port 135

Microsoft RPC

Ports 137-139

NetBIOS

Port 143

IMAP

Port 161/162

SNMP / SNMP traps

Port 389

LDAP

Port 443

HTTPS

Port 445

SMB

Port 514

Syslog (UDP)

Port 636

LDAPS

Port 993

IMAPS

Port 995

POP3S

Port 1433

Microsoft SQL Server

Port 3306

MySQL

Port 3389

RDP

Port 5432

PostgreSQL

Ports 5985/5986

WinRM (HTTP/HTTPS)

nmap -sS

TCP SYN ("half-open") scan; needs privileges

nmap -sT

TCP connect scan (full handshake)

nmap -sU

UDP scan

nmap -sV

Detect service versions

nmap -O

OS detection

nmap -A

Aggressive: OS detection, version, scripts, traceroute

nmap -p-

Scan all 65535 ports

nmap -Pn

Skip host discovery (treat host as up)

nmap -sn

Ping sweep / host discovery only, no port scan

nmap -sC

Run default NSE scripts

nmap -oA

Output in all formats (normal, XML, grepable)

nmap -T4

Faster timing template

Nmap port state: filtered

A firewall or filter is blocking probes, so state cannot be determined

CVSS Attack Vector (AV) values

Network, Adjacent, Local, Physical

CVSS Attack Complexity (AC)

Low or High

CVSS Privileges Required (PR)

None, Low, High

CVSS User Interaction (UI)

None or Required

CVSS Scope (S)

Unchanged or Changed

CVSS impact metrics

Confidentiality, Integrity, Availability (None/Low/High)

CVSS vector AV:N/AC:L/PR:N/UI:N: how easy to exploit?

Very easy: remotely over the network, low complexity, no privileges, no user interaction

Regex: ^ and $

Start of line and end of line anchors

Regex: .

Any single character

Regex: * , + , ?

Zero or more, one or more, zero or one of the previous item

Regex: \d , \w , \s

Digit, word character, whitespace

Regex: [abc] and [^abc]

Any one of a, b, c / any character except a, b, c

Regex: {n,m}

Between n and m repetitions

Regex: |

Alternation (OR)

Windows Event ID 4624

Successful logon

Windows Event ID 4625

Failed logon

Windows Event ID 4688

New process created

Windows Event ID 4672

Special privileges assigned to a new logon

Windows Event ID 4720

User account created

Windows Event ID 4698

Scheduled task created

Windows Event ID 7045

New service installed

Windows Event ID 1102

Audit log cleared (often an attacker covering tracks)

Sysmon Event ID 1

Process creation (with command line and hashes)

Sysmon Event ID 3

Network connection

Sysmon Event ID 11

File created

SPF, DKIM, DMARC

Email authentication: SPF lists allowed sending servers, DKIM signs messages, DMARC sets policy and reporting using both

DLP

Data Loss Prevention: detects and blocks sensitive data leaving the organization

CASB

Cloud Access Security Broker: enforces security policy between users and cloud services

IDS vs. IPS

IDS detects and alerts. IPS sits inline and can block

UTM

Unified Threat Management: multiple security functions in one appliance

PKI

Public Key Infrastructure: certificates, CAs, and keys for trust

PII

Personally Identifiable Information

OWASP

Open Web Application Security Project

OSSTMM

Open Source Security Testing Methodology Manual

SDN

Software-Defined Networking: separates control plane from data plane

ASN

Autonomous System Number (the CS0-004 list spells it Anonymous System Number)

GDB

GNU Debugger

MOU

Memorandum of Understanding