Reconnaissance, exploitation, and privilege escalation concepts for hands on penetration testing, distinct from the CEH terminology deck.
37 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the primary goal of the reconnaissance phase in penetration testing?
- Gather information about the target system and network without triggering alerts or alarms.
- What does OSINT stand for?
- Open Source Intelligence.
- What tool is used for DNS enumeration and reverse lookups?
- nslookup, dig, or host.
- What is Nmap primarily used for?
- Network mapping and port scanning to discover hosts and services.
- What Nmap flag performs a SYN scan?
- -sS
- What does a TCP connect scan (-sT) do in Nmap?
- Completes the full three-way TCP handshake for each port to determine if it is open.
- What Nmap flag scans for open UDP ports?
- -sU
- What is a common vulnerability scanning tool in penetration testing?
- Nessus or OpenVAS.
- Define exploitation in penetration testing.
- The process of taking advantage of a vulnerability to gain unauthorized access or control.
- What is privilege escalation?
- The process of gaining higher-level permissions or access rights on a compromised system.
- What is the sudo command in Linux used for?
- Allow users to run commands with superuser or another user's privileges.
- What is a SUID bit on a binary?
- A permission bit that causes the binary to run with the owner's privileges regardless of who executes it.
- What tools are commonly used for password cracking?
- John the Ripper, Hashcat, or Hydra.
- What is a wordlist in password attacks?
- A file containing many common passwords or dictionary words used in dictionary or brute force attacks.
- What is SQL injection?
- Inserting malicious SQL code into input fields to manipulate database queries and bypass authentication.