Cybersecurity Offensive Security and Penetration Testing Flashcards

24 sample cards from the Offensive Security and Penetration Testing deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is a rootkit and how does it relate to persistence and anti-forensics?

   A rootkit is malware that hides its presence (files, processes, network connections) at the user or kernel level while maintaining privileged, persistent access. It both sustains access and serves anti-forensics by concealing the attacker's activity from defenders and tools.

2. What does 'covering tracks' involve in a penetration test?

   Removing or altering evidence of the intrusion: clearing/editing logs, deleting command history, removing uploaded tools, resetting timestamps, and disabling auditing. In ethical testing this is documented (not truly destructive) to show how an attacker would evade detection; testers preserve integrity per the RoE.

3. What is timestomping in anti-forensics?

   Altering a file's MACE timestamps (Modified, Accessed, Created/Changed, Entry-modified) so malicious files blend in with legitimate ones and evade timeline analysis by forensic investigators. Meterpreter's timestomp command performs this.

4. How can an attacker clear or evade logs on Linux and Windows?

   Linux: clearing/truncating /var/log files, wiping ~/.bash_history, or setting HISTFILE unset. Windows: wevtutil cl to clear event logs, or disabling audit policies. Attackers may also stop logging services or manipulate log forwarding to hide activity.

5. What are the essential sections of a penetration test report?

   Executive Summary (business-level risk for management), Scope/Methodology, Findings with risk ratings, technical details/evidence (PoC, screenshots), impact and likelihood analysis, and prioritized Remediation recommendations. An appendix lists tools, raw data, and references.

6. Why does a pentest report contain both an executive summary and a technical section?

   The executive summary conveys business risk and overall posture in non-technical language for leadership/decision-makers, while the technical section gives engineers reproducible detail (steps, evidence, remediation) to fix the issues. Different audiences need different depth.

7. How is risk severity typically derived in a pentest finding?

   By combining the likelihood (ease of exploitation) with the impact (business/technical consequence): $\text{Risk} = \text{Likelihood} \times \text{Impact}$. Frameworks like CVSS provide a standardized numeric score (0.0–10.0) mapping to Low/Medium/High/Critical ratings.

8. What is CVSS and what score range does it use?

   The Common Vulnerability Scoring System is a standardized method for rating vulnerability severity on a scale of $0.0$ to $10.0$. It combines Base, Temporal, and Environmental metric groups; typical severity bands: None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0.

9. What is Kali Linux and who maintains it?

   A Debian-based Linux distribution maintained by Offensive Security, purpose-built for penetration testing and security auditing. It ships with hundreds of pre-installed tools for reconnaissance, scanning, exploitation, forensics, and reporting.

10. Match these Kali tools to their category: Nmap, Burp Suite, Aircrack-ng, John the Ripper, Wireshark.

    Nmap: network scanning/enumeration. Burp Suite: web application testing. Aircrack-ng: wireless/Wi-Fi cracking. John the Ripper: password/hash cracking. Wireshark: packet capture and traffic analysis.

11. What is the Aircrack-ng suite used for?

    Assessing Wi-Fi security: capturing wireless packets (airodump-ng), injecting/deauthenticating (aireplay-ng), and cracking WEP/WPA/WPA2 keys (aircrack-ng) from captured handshakes. It is the standard Kali toolkit for wireless penetration testing.

12. What is Wireshark and how does it differ from tcpdump?

    Both are packet analyzers. Wireshark is a GUI tool with deep protocol dissection, powerful display filters, and visualization, ideal for detailed analysis. tcpdump is a lightweight command-line capture tool ideal for quick captures on servers/headless systems; its output can be opened later in Wireshark.

13. What is Netcat and why is it called the 'Swiss Army knife' of networking?

    Netcat (nc) reads/writes data across TCP/UDP connections. It is used for banner grabbing, port scanning, file transfer, creating bind/reverse shells, and as a listener. Its versatility across many networking tasks earns the 'Swiss Army knife' nickname.

14. What is the role of a payload versus an exploit in an attack chain?

    The exploit is the technique/code that takes advantage of a vulnerability to gain execution or access. The payload is the code that runs on the target after the exploit succeeds, delivering the attacker's intended action (e.g., a reverse shell, adding a user, or Meterpreter).

15. What is a 'listener' (handler) in the context of reverse shells?

    A process on the attacker's machine that waits for the target's outbound connection from a reverse shell/payload. In Metasploit it is the multi/handler module (matching payload, LHOST, LPORT); with Netcat it is nc -lvnp <port>.

16. What is the difference between authenticated and unauthenticated scanning/enumeration?

    Unauthenticated (uncredentialed) scanning probes systems from an outsider's view with no login, seeing only externally exposed info. Authenticated (credentialed) scanning uses valid credentials to inspect a host internally (patch levels, config, installed software), yielding deeper, more accurate results with fewer false positives.

17. What is a null session and why is it a security risk?

    An anonymous, unauthenticated SMB/IPC$ connection to a Windows host (no username or password). If allowed, it lets an attacker enumerate users, groups, shares, and password policy without credentials, providing valuable reconnaissance for follow-on attacks.

18. What is the difference between an SUID binary risk on Linux and normal file execution?

    An SUID (Set User ID) binary runs with the file owner's privileges rather than the executing user's. If a poorly written or misconfigured SUID-root binary can be abused, a low-privilege user gains root-level execution, making SUID a key privilege-escalation vector (found via find / -perm -4000).

19. Why is scope creep dangerous during a penetration test?

    Scope creep is the uncontrolled expansion of testing beyond the agreed RoE. It risks testing unauthorized (possibly illegal) systems, causing outages on untested-for assets, exceeding legal authorization, and creating liability. Any scope change must be re-approved in writing by the client.

20. What is the difference between a false positive and a false negative in vulnerability scanning?

    A false positive is a reported vulnerability that does not actually exist (wastes remediation effort and erodes trust). A false negative is a real vulnerability the scanner missed (dangerous, leaving exposure unaddressed). Manual validation during a pentest reduces both.

21. What is proxychains and how does it aid pivoting?

    A Kali tool that forces any TCP connection from a program through a chain of proxies (e.g., a SOCKS proxy opened via an SSH tunnel or Meterpreter). It lets attacker tools like Nmap reach internal hosts through a compromised pivot host that has access to an otherwise unreachable network.

22. What is the purpose of an SSH tunnel in pivoting (local, remote, dynamic forwarding)?

    Local forwarding (-L) maps a local port to a remote host/port through the SSH server. Remote forwarding (-R) exposes a local service on the SSH server side. Dynamic forwarding (-D) creates a SOCKS proxy for tunneling arbitrary traffic. All let a tester route traffic through a compromised host to reach internal networks.

23. What is the difference between a web shell and a reverse shell for persistence?

    A web shell is a malicious script (e.g., PHP/ASP) uploaded to a web server that lets the attacker run commands via HTTP requests to a URL, blending with normal web traffic. A reverse shell is an outbound interactive connection from the host to the attacker's listener; it typically must be re-established after reboot unless paired with a persistence mechanism.

24. What role does Nessus/OpenVAS play compared to Nmap?

    Nessus and OpenVAS are dedicated vulnerability scanners that test hosts against large databases of known vulnerabilities and misconfigurations, producing risk-rated findings. Nmap primarily maps hosts/ports/services (with limited NSE vuln checks). Scanners give depth of vulnerability detection; Nmap gives fast, flexible discovery.

What this deck covers

Offensive Security and Penetration Testing flashcards FAQ