Quiz 1 Ethical Hacking

What sort of crypto does TLS use?

Asymmetric and Symmetric Crypto

What does asymmetric crypto do?

• Sets up the session

• the handshake authenticates the server and agrees on a shared secret

What does symmetric crypto do?

• used for data actual transfer

• carries the data far faster for bulk traffic

What makes "https://utexas.edu” trustable?

• signed by CA, so your browser already trusts it

• The CA verifies who has cert controls of domain

• Browser checks for valid signature chain

• basically cert binds domain name to a public key

You SSH to a lab machine with an RSA key. How does the machine know it's really you?

• your public key is stored in ~/.ssh/authorized_keys on the server

• server sends a random challenge and client signs in with your private key

• server verifies the signature with the public key

What is a salt?

a random value added to your password before it is hashed and useful for when two people have the same exact passwords.

How do you increase computational complexity?

Increase work/cost factor so it causes more rounds and more memory

Identify the parts of this /etc/shadow password field. kali:$y$j9T$syJ4c33f2G3t4qhVR/geu.$0RGhUWfVibVtdPyTvmc5tLxC:19212:0:99999:7:::

$y$ - is the yescrpt

j9T - cost parameters

syJ4c33f2G3t4qhVR/geu - salt

$0RGhUWfVibVtdPyTvmc5tLxC: - hash

the numbers are trailing - which are shadow aging fields

Can you turn a hash / digest back into a password? If so, how?

No hashing works only one way.

your best bet is to guess.

Label each value — TCP port, IPv4 address, HTTP header, or Ethernet/MAC address:

443                   

192.168.1.10          

Host: utexas.edu      

00:1A:2B:3C:4D:5E     

443 - TCP Port

192.168.1.10 - IPv4 address

Host: utexas.edu - HTTP header

00:1A:2B:3C:4D:5E - MAC Address

Are these hosts on the same network? If yes, how do you know>

192.168.1.10/24   vs   192.168.1.200/24  

Yes, they are on the same network because same network address causing same LAN.

Are these hosts on the same network? If yes, how do you know>

192.168.1.10/24   vs   192.168.2.5/24    

No, they are not on the same network address.

How does ping work?

Ping sends ICMP echo requests and waits for replies and tests for reachability. Reachability + round trip time

How does traceroute work?

Traceroute sends packets with increasing TTL. Each router that drops TTL to 0 returns that the ICMP Time exceeded  which reveals the path hop by hop.

When you run  nmap 1.1.1.1, how does nmap know which ports are open?

Nmap knows which ports are open by probing and reading the response. SYN SYN/ACK means open. SYN -> RST is closed. No reply is filtered.

Without root results in a full TCP connect scan.

3 ways to establish persistence on a Linux machine

Cron job

New user account

Web shett

3 ways to escalate privelege from a user account to root account

sudo misconfig

kernel exploit

using weak credentials/permissions

2 ways an attacker can communicate with a backdoor

Bind shell & reverse shell

.  Can an SMS second-factor code be phished like a password?

Yes. The user types the code into a fake site and the attacker relays it to the real one in real time (SIM swapping is another risk).

Can a hardware security key (FIDO U2F / WebAuthn) be phished?

Security keys: no. The key signs a challenge tied to the site's origin, so a lookalike domain gets nothing usable, and there's no code for the user to hand over.

 

.  Who can write to this file? Who can read it?

-rw-r--r--  1 root www-data  891  May 20 2012  index.php

The owner is root, the group is www-data, and the mode is rw-r--r--.
- Write: only root (the owner).
- Read: everyone. That's root, members of www-data, and all other users.