Drag and Drop Matching Questions

DNS interrogation: Extracting DNS records to discover network information

DNS interrogation is a critical footprinting technique involving the querying of Domain Name System servers to extract various records. This process reveals crucial network infrastructure details, such as IP addresses (A records), mail servers (MX records), and authoritative name servers (NS records). Attackers use this information to map out an organization's network topology and identify potential targets for further exploitation.

WHOIS lookup: Querying domain registration databases for contact and ownership details

A WHOIS lookup involves querying publicly accessible databases that store registration information for domain names and IP addresses. This reconnaissance method provides valuable details including the domain registrar, registrant contact information, administrative and technical contacts, and domain expiration dates. Such data can help an attacker identify key personnel or gain insight into an organization's digital assets and their ownership.

Google hacking: Using advanced search operators to find sensitive information

Google hacking, also known as Google Dorking, leverages advanced search operators and specific keywords within search engines to uncover sensitive, publicly exposed information. Attackers use queries like `filetype:pdf confidential` or `intitle:index.of parent directory` to find login portals, configuration files, directory listings, or other data inadvertently left accessible on the web. This technique exploits misconfigurations rather than direct system vulnerabilities.

Social engineering: Manipulating people to divulge confidential information

Social engineering is a non-technical footprinting technique that relies on psychological manipulation to trick individuals into divulging confidential information or performing actions they wouldn't normally do. Attackers exploit human vulnerabilities such as trust, fear, or curiosity through methods like phishing, pretexting, or baiting. The goal is to obtain credentials, access codes, or internal network details without directly interacting with technical systems.

Phishing: A broad term for social engineering attacks that use fraudulent emails or websites to trick individuals into revealing sensitive information.

Phishing is a widespread social engineering technique where attackers impersonate legitimate entities to deceive individuals. This typically involves sending fraudulent emails or directing victims to fake websites designed to harvest sensitive credentials, financial data, or other personal information. Its broad scope means it often targets a large, undifferentiated audience, hoping a percentage will fall victim to the deceptive lures.

Spear Phishing: A targeted form of phishing directed at a specific individual or organization.

Spear phishing represents a more sophisticated and highly targeted form of phishing, specifically aimed at a particular individual or organization. Attackers meticulously research their targets to craft personalized and convincing messages, often leveraging publicly available information or prior data breaches. The goal is to exploit trust and relevance, making the fraudulent communication appear legitimate and compelling to the intended victim, thereby increasing the likelihood of success.

Whaling: A type of spear phishing that targets high-profile individuals like executives.

Whaling is a specialized subset of spear phishing that exclusively targets high-value individuals within an organization, such as CEOs, CFOs, or other senior executives. These attacks are meticulously crafted, often impersonating legal counsel, government agencies, or other high-authority figures to induce the target to authorize large financial transfers or divulge critical corporate secrets. The substantial potential impact of compromising such a high-profile individual makes whaling a particularly lucrative and dangerous threat.

Nmap: Network port scanning and service detection

Nmap (Network Mapper) is a powerful open-source utility for network discovery and security auditing. It uses raw IP packets to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, and what type of packet filters/firewalls are in use. Its primary function is to map out network topology and identify open ports and active services.

Nessus: Vulnerability scanning and risk assessment

Nessus, developed by Tenable, is a widely recognized proprietary vulnerability scanner. It actively probes target systems for known vulnerabilities, misconfigurations, default credentials, and patch deficiencies across various operating systems, applications, and network devices. The tool then provides detailed reports, often including risk ratings and remediation suggestions, to help organizations prioritize and address identified security weaknesses effectively.

Metasploit: Penetration testing exploitation framework

The Metasploit Framework is an open-source penetration testing platform that provides a comprehensive collection of exploits, payloads, and post-exploitation modules. It is designed to assist security professionals in identifying, exploiting, and validating vulnerabilities in systems and applications. This framework allows for the development, testing, and execution of exploit code against remote targets, simulating real-world attack scenarios to assess an organization's security posture.

Evil Twin: A rogue access point that mimics a legitimate one to capture credentials

An Evil Twin attack involves a malicious actor setting up a fraudulent access point (AP) that precisely mimics the SSID and other characteristics of a legitimate, trusted Wi-Fi network. This deception lures unsuspecting users to connect to the fake AP, allowing the attacker to intercept their network traffic, capture login credentials, and potentially inject malicious content. The primary goal is data interception through impersonation, not merely unauthorized network access.

Rogue AP: An unauthorized access point installed on a network without permission

A Rogue AP is an unauthorized wireless access point or router physically connected to a legitimate wired network without the administrator's knowledge or permission. This device creates an unmanaged wireless backdoor, bypassing existing security controls and potentially exposing internal network resources to external attackers. Its installation often stems from employees seeking convenience or from malicious actors aiming to establish persistent access.

War Driving: Driving around to detect wireless networks and gather information

War Driving is a reconnaissance technique where an individual physically travels through an area, typically in a vehicle, using a wireless-enabled device to discover and map Wi-Fi networks. The objective is to identify active wireless access points, gather information such as SSIDs, MAC addresses, and security configurations (e.g., WEP, WPA2), and sometimes pinpoint their physical locations. This activity helps attackers identify potential targets for further exploitation.

Reconnaissance: Passive information gathering

Reconnaissance, specifically passive information gathering, involves collecting data about a target without directly engaging their systems or networks. This often utilizes Open Source Intelligence (OSINT) techniques, such as querying public databases, social media, or search engines, to map out the target's infrastructure, personnel, and potential vulnerabilities from a distance. The goal is to build a comprehensive profile without triggering any alerts.

Scanning: Active probing for vulnerabilities

Scanning represents the active phase where an attacker directly interacts with the target network to identify live hosts, open ports, and running services. Tools like Nmap are employed for port scanning, while vulnerability scanners such as Nessus or OpenVAS are used to detect known security weaknesses and misconfigurations on identified systems. This phase provides a detailed technical blueprint for subsequent exploitation attempts.

Gaining Access: Exploiting vulnerabilities to gain entry

Gaining Access is the critical phase where identified vulnerabilities are actively exploited to breach the target's security perimeter. This involves leveraging specific exploits against discovered weaknesses, such as unpatched software, misconfigured services, or weak credentials, to establish an initial foothold. The objective is to execute malicious code, obtain a shell, or achieve unauthorized control over a system or network resource.

Maintaining Access: Ensuring persistent access

Maintaining Access focuses on establishing persistent control over compromised systems to ensure future re-entry, even if initial vulnerabilities are patched. This often involves deploying backdoors, rootkits, or creating new user accounts with elevated privileges, along with modifying system configurations or scheduling tasks. The aim is to retain a covert presence and continue operations without needing to re-exploit the original vulnerability.

Nmap: Network discovery and security scanning

Nmap, or Network Mapper, is an indispensable open-source utility for network discovery and security auditing. It excels at identifying active hosts on a network, determining open ports, detecting services running on those ports along with their versions, and even fingerprinting the operating system of target devices. This comprehensive scanning capability provides a foundational understanding of a network's attack surface, crucial for penetration testers and system administrators alike.

Wireshark: Network packet capture and analysis

Wireshark is a powerful and widely used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It provides deep inspection of hundreds of protocols, enabling detailed analysis of individual packets, reconstruction of data streams, and identification of network anomalies or security threats. Its primary purpose is passive monitoring and forensic analysis of network communications, not active interaction with targets.

Metasploit: Exploit development and execution framework

Metasploit is a sophisticated open-source penetration testing framework designed for developing, testing, and executing exploit code against remote target machines. It provides a vast collection of exploits, payloads, encoders, and post-exploitation modules, enabling security professionals to simulate real-world attacks. Its core function is to identify and leverage vulnerabilities to gain unauthorized access and maintain persistence on compromised systems.

Burp Suite: Web application security testing

Burp Suite is an integrated platform of tools specifically engineered for performing comprehensive security testing of web applications. It encompasses a proxy for intercepting and modifying HTTP/S traffic, an automated vulnerability scanner, an intruder for brute-forcing and fuzzing, and a repeater for manual request manipulation. This suite empowers ethical hackers to identify and exploit a wide range of web-based vulnerabilities, from SQL injection to cross-site scripting.

AES: Symmetric encryption

AES (Advanced Encryption Standard) is a highly efficient symmetric block cipher, meaning it utilizes the exact same secret key for both encrypting plaintext into ciphertext and decrypting ciphertext back into plaintext. This shared secret key must be securely exchanged between communicating parties prior to any data transmission, making key distribution a critical aspect of its implementation.

RSA: Asymmetric encryption

RSA is a foundational asymmetric encryption algorithm, also known as a public-key cryptosystem, which relies on a mathematically linked pair of keys: a public key for encryption and a private key for decryption. This architecture allows anyone to encrypt data using the widely distributed public key, but only the holder of the corresponding private key can successfully decrypt it, enabling secure communication without prior shared secrets.

3DES: Symmetric encryption

Triple DES (3DES) is a symmetric block cipher that applies the original DES algorithm three times to each data block, typically using two or three distinct keys to enhance security over single DES. As a symmetric algorithm, it requires the sender and receiver to possess the identical secret key for both encryption and decryption operations, making secure key exchange paramount for its secure deployment.

ECC: Asymmetric encryption

Elliptic Curve Cryptography (ECC) is an advanced asymmetric encryption algorithm that leverages the mathematical properties of elliptic curves over finite fields to create public and private key pairs. ECC offers comparable security strength to RSA with significantly smaller key sizes, leading to more efficient computations, reduced bandwidth usage, and faster performance, particularly beneficial for mobile and resource-constrained environments.