Ethical Hacking System Hacking Syllabus

System Hacking syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for System Hacking in Ethical Hacking, not a summary of it.

1. 1

   Gaining Access

   3 topics

   • Password Cracking Techniques
   • Exploiting Vulnerabilities
   • Privilege Escalation
2. 2

   Maintaining Access

   3 topics

   • Rootkits
   • Backdoors
   • Trojan Horses
3. 3

   Covering Tracks

   3 topics

   • Clearing Logs
   • Steganography
   • Anti-forensics Techniques

System Hacking flashcards for Ethical Hacking

24 of 50 cards from the System Hacking deck — real questions with worked answers.

1. What is password cracking in the context of system hacking?

   The process of recovering or guessing passwords from stored or transmitted data — typically by comparing hashes of candidate passwords against a captured password hash until a match is found, granting unauthorized access.

2. Name and define the four main categories of password attacks.

   1) Non-electronic (social engineering, shoulder surfing, dumpster diving); 2) Active online (guessing against a live system); 3) Passive online (sniffing, MITM, replay); 4) Offline (dictionary, brute-force, rainbow-table attacks against a captured hash file).

3. Compare a dictionary attack with a brute-force attack.

   A dictionary attack tries a precompiled list of likely words/passwords (fast but misses non-words). A brute-force attack systematically tries every possible character combination (guaranteed to succeed eventually but exponentially slow).

4. What is a rainbow table and what problem does it solve?

   A precomputed table of plaintext-to-hash chains that trades storage for speed, letting an attacker reverse a hash to its plaintext far faster than brute force. It is defeated by salting.

5. How does a password salt defeat rainbow-table attacks?

   A salt is a unique random value appended to each password before hashing, so identical passwords produce different hashes. This makes precomputed tables useless because a separate table would be needed for every possible salt.

6. For an alphabet of size $N$ and password length $L$, what is the size of the brute-force keyspace?

   $$K = N^{L}$$ The number of possible passwords grows exponentially with length $L$.

7. Give the formula for the average time to brute-force a password given keyspace $K$ and guess rate $R$ (guesses per second).

   On average an attacker tries half the keyspace, so $$t_{avg} = \frac{N^{L}}{2R}$$

8. What is a hybrid password attack?

   An attack that starts from dictionary words and applies systematic mutations (appending digits, symbols, case changes, leetspeak) — bridging pure dictionary and brute-force attacks.

9. What is password spraying and how does it evade lockouts?

   Trying a few common passwords (e.g., 'Password123') across many accounts rather than many passwords against one account. By keeping attempts-per-account low, it stays under account-lockout thresholds.

10. Distinguish LM hashes from NTLM hashes in Windows.

    LM (LAN Manager) is weak: it uppercases the password, splits it into two 7-character halves hashed independently with DES, so it is easily cracked. NTLM uses the MD4 hash of the full Unicode password and is case-sensitive and much stronger (though still unsalted).

11. What is a pass-the-hash (PtH) attack?

    An attack where the attacker authenticates to a remote service using a captured NTLM hash directly, without ever cracking it to plaintext, because NTLM authentication uses the hash itself.

12. What does 'exploiting a vulnerability' mean in system hacking?

    Using a piece of code, data, or a technique (an exploit) that takes advantage of a security flaw (bug, misconfiguration, or design weakness) to cause unintended behavior — typically to gain access, execute code, or escalate privileges.

13. Define the terms vulnerability, exploit, and payload.

    Vulnerability = the weakness/flaw. Exploit = the technique or code that leverages the weakness. Payload = the code that runs after successful exploitation (e.g., a reverse shell or Meterpreter).

14. What is a zero-day vulnerability?

    A vulnerability that is unknown to the vendor (or has no available patch), giving defenders zero days to fix it before it can be exploited in the wild.

15. How does a buffer overflow exploit typically achieve code execution?

    By writing more data into a buffer than it can hold, overwriting adjacent memory including the saved return address on the stack, redirecting execution to attacker-controlled shellcode.

16. What is the difference between a stack-based and a heap-based buffer overflow?

    Stack-based overflows overwrite local variables and the return address on the call stack. Heap-based overflows corrupt dynamically allocated memory and its management metadata to hijack control flow.

17. What common measures mitigate buffer-overflow exploitation?

    Non-executable stack/DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), stack canaries, and bounds-checking / safe functions.

18. What is the CVSS score and its numeric range?

    The Common Vulnerability Scoring System rates a vulnerability's severity on a scale from $0.0$ to $10.0$, where higher values indicate greater severity (0.0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical).

19. Define privilege escalation and its two main types.

    Privilege escalation is gaining rights beyond those originally granted. Vertical (privilege elevation) = moving from a low-privilege account to a higher one (e.g., user to root/admin). Horizontal = accessing another user's resources at the same privilege level.

20. Give three common Linux privilege-escalation vectors.

    Misconfigured SUID/SGID binaries, exploitable sudo rules (or NOPASSWD misconfig), writable cron jobs/PATH, and kernel vulnerabilities.

21. What is a SUID bit and why is it relevant to privilege escalation on Linux?

    The SUID (Set User ID) permission bit makes an executable run with the file owner's privileges (often root) rather than the caller's. A vulnerable or misconfigured SUID-root binary can be abused to execute commands as root.

22. Name two common Windows privilege-escalation techniques.

    Abusing unquoted service paths, weak service permissions (modifiable binaries), DLL hijacking, always-install-elevated policy, and token impersonation (e.g., SeImpersonatePrivilege / Potato attacks).

23. What is a rootkit?

    Stealthy malware designed to gain and maintain privileged (root/administrator) access while hiding its own presence — and often other malware — from the operating system, users, and security tools.

24. List the major types of rootkits by the layer at which they operate.

    User-mode (application), Kernel-mode (ring 0, hooks OS structures), Bootloader/bootkit (infects MBR/VBR/boot process), Hypervisor/virtualized (runs beneath the OS), Firmware/hardware (BIOS/UEFI, device firmware), and Library-level rootkits.

See more System Hacking flashcards →

Planning System Hacking for Ethical Hacking

System Hacking (Ethical Hacking) FAQ