Cybersecurity Offensive Security and Penetration Testing Syllabus

In an Nmap SYN scan, how are open, closed, and filtered ports distinguished?

Open: target replies with SYN/ACK. Closed: target replies with RST. Filtered: no response or an ICMP unreachable error (a firewall is dropping/blocking the probe), so Nmap cannot determine state.

What does the Nmap flag -sV do, and how does it differ from -O?

-sV performs service/version detection by probing open ports and matching responses to a signature database. -O performs OS detection using TCP/IP stack fingerprinting. -sV tells you what service+version runs; -O tells you the likely operating system.

What is a UDP scan (-sU) and why is it slower and less reliable than TCP scanning?

-sU probes UDP ports. UDP is connectionless with no handshake: open ports often send no reply, so Nmap infers 'open|filtered' from silence and relies on ICMP port-unreachable (rate-limited by hosts) to detect closed ports. This forces retransmissions and timeouts, making it slow and ambiguous.

What is the Nmap Scripting Engine (NSE)?

A Lua-based framework of scripts that extend Nmap for advanced tasks: vulnerability detection, brute forcing, service enumeration, and exploitation. Scripts are grouped by categories (e.g., safe, default, vuln, exploit) and invoked with --script.

Define port enumeration versus service enumeration.

Port enumeration determines which ports are open/closed/filtered on a host. Service enumeration goes deeper: it identifies the specific application, version, and configuration behind each open port (e.g., not just port 445 open, but 'SMB, Samba 4.x, null sessions allowed').

List the default ports for HTTP, HTTPS, SSH, FTP, SMB, RDP, and DNS.

HTTP 80, HTTPS 443, SSH 22, FTP 21, SMB 445, RDP 3389, DNS 53 (TCP/UDP). Knowing default ports speeds identification of exposed services during enumeration.

What is enum4linux used for?

It enumerates information from Windows/Samba SMB systems: user lists, group memberships, shares, password policies, and OS details, often via null (unauthenticated) sessions. It is a wrapper around Samba tools (smbclient, rpcclient, net, nmblookup).

What is banner grabbing?

Connecting to an open service to read the identifying text (banner) it returns, revealing the software name, version, and sometimes OS. This helps map versions to known vulnerabilities. Tools: netcat, telnet, Nmap -sV, and curl -I for HTTP headers.

Differentiate active and passive OS/service fingerprinting.

Active fingerprinting sends crafted probes and analyzes responses (e.g., Nmap -O), which is accurate but detectable. Passive fingerprinting (e.g., p0f) observes existing traffic without sending probes, staying stealthy but generally less precise.

Why is version fingerprinting critical before exploitation?

Exploits are usually version-specific; using the wrong exploit can fail or crash the service. Accurate version identification lets the tester select a matching, reliable exploit and map the service to CVEs, reducing wasted attempts and detection risk.

What is Metasploit and what are its core components?

An exploitation framework for developing, testing, and executing exploits. Core components: exploits (attack code), payloads (code run on target after exploitation), auxiliary modules (scanners/fuzzers), encoders (obfuscate payloads), nops, and post modules (post-exploitation). msfconsole is the primary interface.

In Metasploit, what is the difference between a staged and a stageless (non-staged) payload?

A staged payload (e.g., windows/meterpreter/reverse_tcp) sends a small stager that downloads the larger payload in stages, keeping the initial exploit small. A stageless payload (e.g., windows/meterpreter_reverse_tcp) delivers the full payload at once, more reliable over unstable connections but larger.

What is Meterpreter?

An advanced, in-memory Metasploit payload that provides a feature-rich, stealthy command shell running entirely in RAM (no disk footprint). It supports encrypted comms and post-exploitation features: file transfer, privilege escalation, keylogging, pivoting, and hash dumping.

Compare a bind shell with a reverse shell.

A bind shell opens a listening port on the target that the attacker connects to; it fails if a firewall blocks inbound connections. A reverse shell makes the target connect out to the attacker's listener; it usually bypasses inbound firewall rules because outbound traffic is more often permitted.

What is msfvenom used for?

The Metasploit standalone tool for generating and encoding custom payloads (e.g., standalone executables, scripts, shellcode) in many formats and architectures, for use outside msfconsole, e.g., embedding a reverse shell into a deliverable file.

Contrast a brute-force attack with a dictionary attack.

A brute-force attack tries every possible character combination systematically (guaranteed to succeed eventually but slow). A dictionary attack tries entries from a curated wordlist of likely passwords, which is much faster and often successful because users pick common/predictable passwords.

What is a password salt and how does it defeat rainbow tables?

A salt is a unique random value added to each password before hashing. It ensures identical passwords produce different hashes, so precomputed hash lookup tables (rainbow tables) become useless and each password must be attacked individually.

Differentiate an online password attack from an offline password attack.

Online attacks guess credentials against a live service (e.g., SSH/HTTP login), which is slow, noisy, and subject to lockouts/rate limiting. Offline attacks crack captured password hashes locally at high speed with no lockout, limited only by the attacker's compute power.

Which tools are used for online brute forcing versus offline hash cracking?

Online: Hydra, Medusa, Patator (brute-force live services). Offline: John the Ripper and Hashcat (crack captured hashes, with Hashcat leveraging GPU acceleration for high speeds).

What is a pass-the-hash attack?

An attack where the adversary authenticates using a captured NTLM password hash directly, without cracking it to plaintext. Because Windows NTLM auth uses the hash itself, possessing it grants access as that user, enabling lateral movement.

According to the OWASP Top 10, what is a SQL injection and how is it prevented?

SQL injection occurs when untrusted input is concatenated into a SQL query, letting an attacker alter query logic to read/modify data or bypass auth. Prevention: parameterized queries/prepared statements, input validation, least-privilege DB accounts, and ORMs that separate code from data.

Compare stored (persistent) XSS with reflected XSS.

Stored XSS saves the malicious script on the server (e.g., in a comment/DB) so it executes for every user who views it. Reflected XSS embeds the script in a crafted request/link that is echoed back in the immediate response, affecting only the victim who follows the link.

What is CSRF and what is the difference between it and XSS?

CSRF (Cross-Site Request Forgery) tricks an authenticated user's browser into sending an unwanted state-changing request using their session. XSS runs attacker script in the victim's browser to steal data/session. Key difference: CSRF abuses trust the site has in the user's browser; XSS abuses trust the user has in the site. CSRF is mitigated with anti-CSRF tokens and SameSite cookies.

What is directory traversal (path traversal)?

An attack using sequences like ../ to access files outside the intended web directory (e.g., /etc/passwd), exploiting insufficient input sanitization of file paths. It can expose configuration files, source code, and credentials.

Which tools are commonly used for web application exploitation in Kali?

Burp Suite (intercepting proxy, scanner, repeater/intruder), OWASP ZAP (open-source proxy/scanner), sqlmap (automated SQL injection), Nikto (web server scanner), and Gobuster/dirb (directory and file brute forcing).

What is privilege escalation, and how do vertical and horizontal escalation differ?

Privilege escalation is gaining higher access than initially obtained. Vertical (privilege elevation) moves to a higher privilege level (user to root/SYSTEM/admin). Horizontal moves to another account at the same privilege level to access that user's resources.

Give three common Linux privilege-escalation vectors.

Misconfigured SUID/SGID binaries, overly permissive sudo rules (sudo -l), writable cron jobs or PATH, kernel exploits for an outdated kernel, and weak file permissions on sensitive files. Tools like LinPEAS/linenum automate the enumeration.

What are common Windows privilege-escalation techniques?

Unquoted service paths, weak service/file permissions (writable service binaries), AlwaysInstallElevated policy, DLL hijacking, stored credentials, token impersonation (e.g., Potato attacks), and unpatched kernel vulnerabilities. WinPEAS automates discovery.

Define lateral movement in the post-exploitation phase.

The techniques an attacker uses to move from an initially compromised host to other systems within the network, expanding access toward high-value targets. It typically relies on harvested credentials, hashes, or trust relationships (e.g., RDP, SMB, WMI, PsExec).

What is pivoting, and how does it relate to a compromised host?

Pivoting is using a compromised machine as a relay to reach networks/hosts the attacker cannot access directly (e.g., an internal subnet). The foothold acts as a router/proxy, forwarding traffic (via SSH tunnels, Meterpreter routes/portfwd, or proxychains) into the otherwise unreachable segment.

What is persistence, and why do attackers establish it?

Persistence is a mechanism that maintains access to a compromised system across reboots, logouts, or credential changes, so the attacker does not need to re-exploit. It ensures continued control if the initial vector is patched or the connection drops.

Name common persistence mechanisms on Windows and Linux.

Windows: Run/RunOnce registry keys, scheduled tasks, new services, WMI event subscriptions, startup folder, and creating rogue accounts. Linux: cron jobs, systemd services, .bashrc/profile modifications, SSH authorized_keys, and rc.local. Backdoors and web shells also provide persistence.

What is a rootkit and how does it relate to persistence and anti-forensics?

A rootkit is malware that hides its presence (files, processes, network connections) at the user or kernel level while maintaining privileged, persistent access. It both sustains access and serves anti-forensics by concealing the attacker's activity from defenders and tools.

What does 'covering tracks' involve in a penetration test?

Removing or altering evidence of the intrusion: clearing/editing logs, deleting command history, removing uploaded tools, resetting timestamps, and disabling auditing. In ethical testing this is documented (not truly destructive) to show how an attacker would evade detection; testers preserve integrity per the RoE.

What is timestomping in anti-forensics?

Altering a file's MACE timestamps (Modified, Accessed, Created/Changed, Entry-modified) so malicious files blend in with legitimate ones and evade timeline analysis by forensic investigators. Meterpreter's timestomp command performs this.

How can an attacker clear or evade logs on Linux and Windows?

Linux: clearing/truncating /var/log files, wiping ~/.bash_history, or setting HISTFILE unset. Windows: wevtutil cl to clear event logs, or disabling audit policies. Attackers may also stop logging services or manipulate log forwarding to hide activity.

What are the essential sections of a penetration test report?

Executive Summary (business-level risk for management), Scope/Methodology, Findings with risk ratings, technical details/evidence (PoC, screenshots), impact and likelihood analysis, and prioritized Remediation recommendations. An appendix lists tools, raw data, and references.

Why does a pentest report contain both an executive summary and a technical section?

The executive summary conveys business risk and overall posture in non-technical language for leadership/decision-makers, while the technical section gives engineers reproducible detail (steps, evidence, remediation) to fix the issues. Different audiences need different depth.

How is risk severity typically derived in a pentest finding?

By combining the likelihood (ease of exploitation) with the impact (business/technical consequence): $\text{Risk} = \text{Likelihood} \times \text{Impact}$. Frameworks like CVSS provide a standardized numeric score (0.0–10.0) mapping to Low/Medium/High/Critical ratings.

What is CVSS and what score range does it use?

The Common Vulnerability Scoring System is a standardized method for rating vulnerability severity on a scale of $0.0$ to $10.0$. It combines Base, Temporal, and Environmental metric groups; typical severity bands: None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0.

What is Kali Linux and who maintains it?

A Debian-based Linux distribution maintained by Offensive Security, purpose-built for penetration testing and security auditing. It ships with hundreds of pre-installed tools for reconnaissance, scanning, exploitation, forensics, and reporting.

Match these Kali tools to their category: Nmap, Burp Suite, Aircrack-ng, John the Ripper, Wireshark.

Nmap: network scanning/enumeration. Burp Suite: web application testing. Aircrack-ng: wireless/Wi-Fi cracking. John the Ripper: password/hash cracking. Wireshark: packet capture and traffic analysis.

What is the Aircrack-ng suite used for?

Assessing Wi-Fi security: capturing wireless packets (airodump-ng), injecting/deauthenticating (aireplay-ng), and cracking WEP/WPA/WPA2 keys (aircrack-ng) from captured handshakes. It is the standard Kali toolkit for wireless penetration testing.

What is Wireshark and how does it differ from tcpdump?

Both are packet analyzers. Wireshark is a GUI tool with deep protocol dissection, powerful display filters, and visualization, ideal for detailed analysis. tcpdump is a lightweight command-line capture tool ideal for quick captures on servers/headless systems; its output can be opened later in Wireshark.

What is Netcat and why is it called the 'Swiss Army knife' of networking?

Netcat (nc) reads/writes data across TCP/UDP connections. It is used for banner grabbing, port scanning, file transfer, creating bind/reverse shells, and as a listener. Its versatility across many networking tasks earns the 'Swiss Army knife' nickname.

What is the role of a payload versus an exploit in an attack chain?

The exploit is the technique/code that takes advantage of a vulnerability to gain execution or access. The payload is the code that runs on the target after the exploit succeeds, delivering the attacker's intended action (e.g., a reverse shell, adding a user, or Meterpreter).

What is a 'listener' (handler) in the context of reverse shells?

A process on the attacker's machine that waits for the target's outbound connection from a reverse shell/payload. In Metasploit it is the multi/handler module (matching payload, LHOST, LPORT); with Netcat it is nc -lvnp <port>.

What is the difference between authenticated and unauthenticated scanning/enumeration?

Unauthenticated (uncredentialed) scanning probes systems from an outsider's view with no login, seeing only externally exposed info. Authenticated (credentialed) scanning uses valid credentials to inspect a host internally (patch levels, config, installed software), yielding deeper, more accurate results with fewer false positives.

What is a null session and why is it a security risk?

An anonymous, unauthenticated SMB/IPC$ connection to a Windows host (no username or password). If allowed, it lets an attacker enumerate users, groups, shares, and password policy without credentials, providing valuable reconnaissance for follow-on attacks.

What is the difference between an SUID binary risk on Linux and normal file execution?

An SUID (Set User ID) binary runs with the file owner's privileges rather than the executing user's. If a poorly written or misconfigured SUID-root binary can be abused, a low-privilege user gains root-level execution, making SUID a key privilege-escalation vector (found via find / -perm -4000).

Why is scope creep dangerous during a penetration test?

Scope creep is the uncontrolled expansion of testing beyond the agreed RoE. It risks testing unauthorized (possibly illegal) systems, causing outages on untested-for assets, exceeding legal authorization, and creating liability. Any scope change must be re-approved in writing by the client.

What is the difference between a false positive and a false negative in vulnerability scanning?

A false positive is a reported vulnerability that does not actually exist (wastes remediation effort and erodes trust). A false negative is a real vulnerability the scanner missed (dangerous, leaving exposure unaddressed). Manual validation during a pentest reduces both.

What is proxychains and how does it aid pivoting?

A Kali tool that forces any TCP connection from a program through a chain of proxies (e.g., a SOCKS proxy opened via an SSH tunnel or Meterpreter). It lets attacker tools like Nmap reach internal hosts through a compromised pivot host that has access to an otherwise unreachable network.

What is the purpose of an SSH tunnel in pivoting (local, remote, dynamic forwarding)?

Local forwarding (-L) maps a local port to a remote host/port through the SSH server. Remote forwarding (-R) exposes a local service on the SSH server side. Dynamic forwarding (-D) creates a SOCKS proxy for tunneling arbitrary traffic. All let a tester route traffic through a compromised host to reach internal networks.

What is the difference between a web shell and a reverse shell for persistence?

A web shell is a malicious script (e.g., PHP/ASP) uploaded to a web server that lets the attacker run commands via HTTP requests to a URL, blending with normal web traffic. A reverse shell is an outbound interactive connection from the host to the attacker's listener; it typically must be re-established after reboot unless paired with a persistence mechanism.

What role does Nessus/OpenVAS play compared to Nmap?

Nessus and OpenVAS are dedicated vulnerability scanners that test hosts against large databases of known vulnerabilities and misconfigurations, producing risk-rated findings. Nmap primarily maps hosts/ports/services (with limited NSE vuln checks). Scanners give depth of vulnerability detection; Nmap gives fast, flexible discovery.