Reconnaissance, exploitation, and privilege escalation concepts for hands on penetration testing, distinct from the CEH terminology deck.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the primary goal of the reconnaissance phase in penetration testing?
Show answer
Gather information about the target system and network without triggering alerts or alarms.- What does OSINT stand for?
Show answer
Open Source Intelligence.- What tool is used for DNS enumeration and reverse lookups?
Show answer
nslookup, dig, or host.- What is Nmap primarily used for?
Show answer
Network mapping and port scanning to discover hosts and services.- What Nmap flag performs a SYN scan?
Show answer
-sS- What does a TCP connect scan (-sT) do in Nmap?
Show answer
Completes the full three-way TCP handshake for each port to determine if it is open.- What Nmap flag scans for open UDP ports?
Show answer
-sU- What is a common vulnerability scanning tool in penetration testing?
Show answer
Nessus or OpenVAS.- Define exploitation in penetration testing.
Show answer
The process of taking advantage of a vulnerability to gain unauthorized access or control.- What is the sudo command in Linux used for?
Show answer
Allow users to run commands with superuser or another user's privileges.- What is a SUID bit on a binary?
Show answer
A permission bit that causes the binary to run with the owner's privileges regardless of who executes it.- What tools are commonly used for password cracking?
Show answer
John the Ripper, Hashcat, or Hydra.- What is a wordlist in password attacks?
Show answer
A file containing many common passwords or dictionary words used in dictionary or brute force attacks.- What is a reverse shell?
Show answer
A shell connection initiated from the compromised target system back to the attacker's machine.- What is a bind shell?
Show answer
A shell that listens on a port on the target system, waiting for connections from the attacker.
FlashKeepers