CH3 Pentest+ quiz flashcards

strings

Command-line tool that extracts readable text strings from files; useful for quickly analyzing binary executables.

Eclipse

An integrated development environment (IDE) used for developing and editing code; it is not the quick tool for extracting strings from a binary.

Netcat

A network utility often called a pentester's Swiss Army knife; it can make network connections and can be used for port scanning but is not primarily a binary-analysis tool.

TCP Connect Scan (-sT)

Nmap scan that establishes a full TCP connection; commonly used when scanning from an unprivileged user account.

Nmap -sV

Nmap option that performs service and version detection on discovered services.

Nmap -sU

Nmap option that performs a UDP scan.

Nmap -oA

Nmap option that saves scan results in all major output formats.

Nmap -oX

Nmap option that saves scan results in XML format.

Nmap -oG

Nmap option that produces grepable output.

Nmap -oS

Nmap Script Kiddie output format; primarily for fun and unlikely to be useful during a real penetration test.

Nmap -T0

Nmap paranoid timing template; the slowest scan timing and can take an extremely long time on large networks.

Nmap -T1

Nmap sneaky timing template; very slow scanning.

Nmap -T2

Nmap polite timing template; slower scanning intended to reduce network impact.

Nmap -T3

Nmap normal timing template and the default timing setting.

Nmap -T4

Nmap aggressive timing template that performs scans faster.

Nmap -T5

Nmap insane timing template; the fastest and most aggressive timing setting.

TCP Port 139

Port commonly associated with NetBIOS Session Service and Windows networking.

TCP Port 445

Port commonly associated with SMB and Windows file and printer sharing.

TCP Port 3389

Port commonly used by Remote Desktop Protocol (RDP) and is a strong indicator of a Windows system.

TCP Port 443

Standard port for HTTPS; not specific to Windows.

Windows

Operating system most likely indicated by a combination of ports such as 139, 445, and 3389.

Port Scan

Scan used to identify accessible ports, services, and port states on a system.

Port State

Nmap's description of a port's condition, such as open, closed, or filtered.

Vulnerability Scan

A scan designed to identify security vulnerabilities; a basic port scan does not automatically provide a list of vulnerable services.

Expired Certificate

An expired SSL/TLS certificate can indicate that a service or system is not being properly maintained or managed.

Poor Maintenance

An indicator that administrators may be inattentive or careless, potentially leading to other security weaknesses.

Telnet

A network utility that can manually connect to TCP ports and can be used for basic port scanning or service testing.

ExifTool

A tool used primarily to read and manipulate file metadata; it is not a port-scanning tool.

Hping

A packet-generation and network-testing tool that can be used for port scanning and network probing.

HTTP

Unencrypted web protocol commonly associated with TCP port 80.

HTTPS

Secure web protocol commonly associated with TCP port 443.

TCP Port 8080

Common alternate port for HTTP web services.

TCP Port 8443

Common alternate port for HTTPS web services.

Web Browser

Best tool for manually validating web services running on ports such as 8080 and 8443.

Alternate Service Port

A nonstandard port used to host a service instead of its commonly associated port.

Unprivileged User Account

User account without elevated privileges; may require a TCP Connect scan instead of scans requiring raw packet access.

Nmap Timing Template

An Nmap setting controlled by -T that determines how quickly a scan is performed.

Nmap Default Timing

The default Nmap timing template is -T3, also called Normal.

Binary Executable

A compiled program file containing machine code that can be analyzed with tools such as strings to extract readable information.

Information Gathering

The process of collecting useful information about a target during a penetration test.

Enumeration

The process of actively identifying systems, services, ports, accounts, and other useful information about a target.