Examius
🌍 Ethical Hacking · flashcards
Ethical Hacking System Hacking Flashcards
50 question-and-answer cards covering System Hacking as it is examined in Ethical Hacking. 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the System Hacking deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
What is a backdoor?
A covert method of bypassing normal authentication to gain remote access to a system, planted so the attacker can return later even if the original vulnerability is patched.
How does a backdoor differ from a rootkit?
A backdoor provides a persistent hidden access channel into the system; a rootkit's primary purpose is to hide activity/presence and maintain privilege. They are often combined (a rootkit conceals a backdoor).
Contrast a bind shell with a reverse shell.
A bind shell opens a listening port on the victim that the attacker connects to (blocked by inbound firewalls/NAT). A reverse shell has the victim connect outbound to the attacker's listener, bypassing inbound filtering and NAT.
What is a Trojan horse?
Malware disguised as legitimate or desirable software that, once run by the user, executes hidden malicious functions such as installing a backdoor, stealing data, or damaging the system.
How does a Trojan differ from a virus and a worm?
A Trojan relies on the user to run it and does not self-replicate. A virus attaches to a host file and spreads when that file runs. A worm self-replicates and spreads across networks autonomously without a host file or user action.
List common categories of Trojans by function.
Remote Access Trojans (RATs), backdoor Trojans, banking/credential-stealing Trojans, downloader/dropper Trojans, keyloggers, botnet Trojans, ransomware Trojans, and DDoS Trojans.
What is a wrapper (binder) in the context of Trojans?
A tool that combines a Trojan payload with a legitimate executable into a single file, so running the seemingly benign program also silently installs the Trojan.
What is a RAT (Remote Access Trojan)?
A Trojan that gives an attacker full remote control over the infected machine — file access, keylogging, webcam/mic capture, command execution — typically through a covert command-and-control channel.
Why is clearing logs a key step after a system compromise?
It removes forensic evidence of the intrusion (logins, commands, file changes), helping the attacker evade detection and hindering incident response and attribution — part of the 'covering tracks' phase.
Which Windows event logs does an attacker typically target when covering tracks?
The Security, System, and Application event logs (viewed via Event Viewer, stored as .evtx files), often cleared with tools like wevtutil, clearev (Meterpreter), or PowerShell.
On a Linux system, which log files and artifacts are commonly cleared or manipulated to hide activity?
/var/log/auth.log (or secure), /var/log/syslog, /var/log/wtmp, /var/log/btmp, /var/log/lastlog, and the shell history file (~/.bash_history).
Why is selectively editing logs stealthier than deleting them entirely, and what defends against both?
Wholesale deletion or an empty/gapped log is itself a red flag, whereas removing only incriminating entries is less obvious. Remote/centralized log forwarding (SIEM/syslog server) and append-only/immutable logs defend against local tampering.
What is steganography?
The practice of hiding a secret message inside a non-secret carrier (image, audio, video, text) so that the very existence of the communication is concealed.
How does steganography fundamentally differ from cryptography?
Cryptography hides the meaning of a message (it is visibly encrypted); steganography hides the existence of the message (the carrier looks ordinary). They are often combined for defense in depth.
Describe the LSB (Least Significant Bit) steganography technique.
Secret data bits are embedded into the least significant bit of each pixel's color value (or audio sample). Because changing the LSB alters the value by at most 1, the visual/audible difference is imperceptible.
Define the terms cover, payload/embedded message, and stego-object in steganography.
Cover (carrier) = the original innocent file; payload/embedded message = the secret data to hide; stego-object = the resulting file containing the hidden data after embedding.
What is steganalysis?
The countermeasure to steganography: the science of detecting, and ideally extracting or destroying, hidden data within carrier files, often via statistical analysis of anomalies (e.g., LSB distribution).
State the steganographic capacity of LSB embedding for an image with $P$ pixels using $c$ color channels and 1 bit per channel.
$$C = \frac{P \times c}{8} \ \text{bytes}$$ For example, a $1000 \times 1000$ RGB image holds about $\frac{10^{6} \times 3}{8} = 375{,}000$ bytes.
What are anti-forensics techniques?
Methods used to obstruct, mislead, or defeat digital forensic investigation — by destroying, hiding, altering, or fabricating evidence, or by attacking the forensic tools/process themselves.
List the major categories of anti-forensics techniques.
Data destruction (wiping), data hiding (steganography, hidden partitions, ADS), encryption, trail obfuscation (log/timestamp manipulation), artifact wiping (secure deletion of specific traces), and attacks against forensic tools.
What is timestomping?
An anti-forensics technique that alters a file's MACE timestamps (Modified, Accessed, Created, Entry-modified) to hide when it was actually created or changed and break investigators' timelines.
What are NTFS Alternate Data Streams (ADS) and how are they abused?
ADS let an NTFS file carry additional hidden data streams besides its main content. Attackers hide malware or data in a stream (e.g., file.txt:hidden.exe) that does not appear in normal directory listings or affect the visible file size.
Why does simply deleting a file not remove its data, and what technique reliably destroys it?
Deletion only unlinks the directory entry and marks the space free; the raw data remains until overwritten and is recoverable via forensics. Secure wiping (overwriting with random/zero patterns, possibly multiple passes) or full-disk encryption is needed to truly destroy it.
How does full-disk encryption serve as an anti-forensics measure?
Without the key, the entire disk appears as unreadable ciphertext, so investigators cannot access files, metadata, or slack space. It shifts the challenge from data recovery to key recovery.
What this deck covers
The System Hacking deck follows the Ethical Hacking System Hacking syllabus — 3 chapters and 9 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 16.7 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 197 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
System Hacking flashcards FAQ
How many System Hacking flashcards are in this Ethical Hacking deck?
50 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these Ethical Hacking flashcards free?
Yes. The preview here is free to read with no signup, and the full 50-card deck is free inside the Examius app.
What do the System Hacking cards cover?
They follow the Ethical Hacking System Hacking syllabus — 3 chapters and 9 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.