Question 1

What would the following command accomplish?
Windump -nes 0 -w C : \ dump.txt tcp[28]=0x72 or tcp[28]=0x73 or tcp[40]=0x72 or tcp[40]=0x73
A) Sniff all TCP traffic that has certain flag combinations
B) Sniff the file "dump.txt" if it is sent across the network
C) Sniff cheatcodes on nes (Nintendo Entertainment System) traffic
D) Sniff SMB challenges

Accepted Answer

The filter "tcp[28]=0x72" says "look for the value hex 72 at byte 28". This is where the SMB challenge is. Obviously there is a lot more than can be explained here. But this is a well known filter string when using a simple command line sniffer like windump or tcpdump to grab credentials.

Question 2

To use a sniffer on a Windows machine you first need to install a promiscuous mode driver. What is this package called?
A) ethereal
B) promiscap
C) winpcap
D) libpcap

Accepted Answer

Promiscuous mode drivers allow received packets to be available to the sniffer application which operates at Layer 7, rather than be discarded at Layer 2 if the destination hardware address did not match. The package libpcap is used for Linux.

Question 3

How many possible values can be generated in the sequence number field of a TCP header?
A) 2 Billion
B) 3.4 Million
C) 4.3 Billion
D) 16.7 Million

Accepted Answer

The sequence number field is 32 bits in length. 2^32 would give rounded up 4.3 billion decimal values.

Question 4

Which of the following forms of attack depends on an already established connection between hosts?
A) Smurfing
B) Spoofing
C) Man in the Middle
D) Session hijacking

Accepted Answer

The order of steps in a session hijack attacks are; tracking the Connection, desynchronizing the connection, and injecting the packets.

Question 5

One possible way to defeat a switch is to flood it with spoofed MAC addresses until it fails into "hub mode". Which of the following tools can accomplish this?
A) macof
B) dsniff
C) sniffof
D) sniffit

Accepted Answer

The CAM table (Content Addressable Memory) stores the MAC addresses that a switch learns about in memory. If that limited space is full and it cannot learn new addresses, every frame becomes "unknown unicast". This would cause the switch to forward all frames out every interface.

Question 6

Quincy runs the L0phcrack tool which has a feature that sniffs SMB passwords and stores them for offline cracking. He tries for hours and picks up nothing.
What could be the reason?
A) L0phtcrack does not do this, he needs to use 0phtcrack
B) He is sniffing on a segment that is using only IP Security Traffic in ESP mode
C) He is sniffing on a fiber optic network
D) His network interface is in promiscuous mode

Accepted Answer

IPSEC in ESP (Encapsulated Security Protocol) mode is an encryption tunnel.

Question 7

Which of the following tools allows for the easy capture and analysis of data that has been captured during a TCP connection?
A) TCPFlow
B) TShark
C) Mergecap
D) Text2pcap

Accepted Answer

All of the other tools are command line utilities that come with Wireshark. TShark is the command line sniffer, Mergecap and Editcap both allow combining or slicing of existing capture files, and text2pcap takes an existing hex dump and turns it into a capture file.

Question 8

Bruno wishes to carry out a session hijack attack between hosts "Jaguar" and "Puma". They are in an established state. Puma has a receive window of 300 and Jaguar has a receive window of 350. Jaguar has just received byte 500 from Puma and Acknowledged.
What is the range of sequence numbers that Jaguar will now accept from Puma?
A) 501-851
B) 500-850
C) 350-500
D) 501-801

Accepted Answer

If byte 500 was just received, (it was the last byte in the previous packet) then the next byte 501 will be acknowledged for. Since the receive window is 350, 501+350=851, the range of sequence numbers that will be accepted before the next acknowledgement

Question 9

Which of the following display filters will only show TCP traffic with the URG, PSH, and FIN flags set?
A) tcp.flags == 0x12
B) tcp.flags = = 0x29
C) proto.flags == UPF
D) tcp.flags == 29

Accepted Answer

The flag field is 8 bits (two unused bits, then UAPRSN) In binary the UPF flags would look like: 00101001 which is hex 29.

Question 10

LaDanian is sniffing some traffic and notices a frame that is sent with the source MAC address of:
02:1D:45:68:AF:D4.
This is what he thinks is weird. Why?
A) The first bit of the first byte is not set, which indicates this frame is multicast
B) The first bit if the fist byte is set, which indicates this frame is multicast
C) The second bit of the first byte is set, which means this is a virtual machine interface
D) The second bit of the first byte is set, meaning the MAC address has been assigned locally

Accepted Answer

The first two bits of the first byte in the MAC address have special meaning: Ther first bit indicates wether the frame is unicast (0) or multicast (1). The second bit indicates wether the address is burned in
(0) or has been set by a local administrator.

Question 11

ARP spoofing works in part because Ethernet hardware has no way of knowing if there is another NIC on the network with the same MAC address or not. True or False?

Accepted Answer

Ethernet is a "logical bus" architecture. Whether or not a switch is involved, Ethernet is designed to work as if every NIC sees every frame and simply checks to see if the destination hardware address is a match to its own.

Question 12

Which of the following protocols are not vulnerable to sniffing due to clear text credentials being sent?
A) FTP
B) POP3
C) MAPI
D) IMAP

Accepted Answer

Using tools like "sniffpass" or "dnsiff" many cleartext protocols are vulnerable. MAPI (Messaging Application Programming Interface) is a Microsoft protocol that Outlook uses to communicate with Exchange and protects the credentials.

Question 13

Janet is reading about the "Pass-the-Hash" technique to access a Windows host. She thinks she can use Wireshark to sniff an SMB session between two hosts if she can capture the password hash and user name, and simply send them as credentials anytime she wants in a "Replay Attack".
What are other true statements about this attack? (Choose three)
A) This can also be done using a modified smbclient tool that does not hash an entered password, it will just directly send the hash that Janet captured
B) Janet can also use a tool such as smbrelay to become an SMB proxy and capture credentials that
Way
C) The traffic that Janet sniffed did not include a challenge, if it did the technique is still not impossible just involves more steps
D) Because Microsoft uses techniques such as SMB Signing, Kerberos Timestamps, and Challenges that are used to create unique MAC (Message Authentication Code)s. The Pass-the-hash technique is mostly a proof of concept that works in theory but not in practice.

Accepted Answer

Core Security offers the "Pass-the-Hash" toolkit for the more advanced situations. There are also metasploit modules now available for this.

Question 14

Which of the following attacks are not considered "Active Sniffing"?
A) ARP Poisoning
B) MAC Flooding
C) MAC Spoofing
D) SMAC Fueling

Accepted Answer

No such thing. SMAC is a tool for MAC Spoofing though.

Question 15

Assuming your own address is 192.168.1.1, what display filter could be used to show all traffic other than web and mail.
A) host 192.168.1.1 and not (port 80 or port 25)
B) host 192.168.1.1 and not port 80 and not port 25
C) ip.addr 192.168.1.1 && ! tcp.port == 80 && ! tcp.port == 25
D) ip.addr 192.168.1.1 & ! tcp.port = 80 & ! tcp.port = 25

Accepted Answer

The examples that begin with "host" are capture filters and are equivalent. The other capture filter is not incorrect syntax. On the test, do not debug, take what you see literally.

Question 16

Zachery sees a video on YouTube that describes a wireless hacking technique. He must capture a packet then inject it over and over again into the network stream. The target MAC of this frame will insure it goes to the correct WAP. The idea is to speed up the process of acquiring new initialization vectors for the purposes of cracking a WEP key.
What is this portion of the attack called?
A) Replay attack
B) Injection attack
C) Spoof Attack
D) WAP Attack

Accepted Answer

Captured packets can be resent over and over again to a host. If they illicit a response there are several things that can be learned. In the case of WiFi traffic, new IVs need to be collected.

Question 17

During an attack you setup an access point with a stronger signal than those around you. You also set the SSIDs to be the same as the one you are targeting. You capture authentication frames. Which of the following is the best name for this attack?
A) Rogue WAP
B) Drive-by
C) WEP Attack
D) Denial of Service

Accepted Answer

Rouge infrastructure along with spoofing is a real problem in WiFi.

Question 18

Arianna wants to implement 802.11b for a series of hotels that her employer won the contract on. Her boss says that one of the customers was concerned that if TCP error checking was part of the configuration, the network would be slower. Arianna pauses, and explains …. ?
A) TCP error checking effectively speeds up the network. Since there will be fewer retransmissions the speed will surpass the speed of the wired network.
B) The resulting speed will be about 6Mbps. Since the Ethernet in the hotel is 10Mbps, accounting for several users at the same time, a throttle speed makes sense.
C) Error checking is part of the TCP protocol already. Network speed measures bits, the overhead that gets delivered are bits too.
D) Her boss is correct, and the whole project should just get scraped. Let someone else deal with these difficult customers.

Accepted Answer

Users perceive network slowdowns but in reality the bit rate remains the same.

Question 19

Jack is worried about the FUD (Fear Uncertainty Doubt) he was heard about wireless networks. He also does not want to learn about WPA2 and how easy it is to implement. He sets forth a policy of no wireless networks allowed period.
What else should he do? (Choose two)
A) Train users in the new policy
B) Implement signal jamming technology
C) Survey the area using a tool such as WiSpy, create a baseline and investigate the rest.
D) Disable wireless protocols at the firewall
E) Set penalties for those who create WAPs without approval

Accepted Answer

The role of the security professional is as an advisor, not to set consequences. Firewalls typically handle layer 3 -7 and WiFi is not part of the equation. Signal jammers exist and are not that expensive, but they may have additional undesirable effects. The best approach is to train users and survey the area.

Question 20

What is the highest possible speed of 802.11n?
A) 600Mbps
B) 54Mbps
C) 108Mbps
D) 11Mbps

Accepted Answer

The current proposal of 802.11n supports speeds up to 600Mbps.

Quiz 5: Networks and Services

What would the following command accomplish? Windump -nes 0 -w C : \ dump.txt tcp[28]=0x72 or tcp[28]=0x73 or tcp[40]=0x72 or tcp[40]=0x73

To use a sniffer on a Windows machine you first need to install a promiscuous mode driver. What is this package called?

How many possible values can be generated in the sequence number field of a TCP header?

Which of the following forms of attack depends on an already established connection between hosts?

One possible way to defeat a switch is to flood it with spoofed MAC addresses until it fails into "hub mode". Which of the following tools can accomplish this?

Quincy runs the L0phcrack tool which has a feature that sniffs SMB passwords and stores them for offline cracking. He tries for hours and picks up nothing. What could be the reason?

Which of the following tools allows for the easy capture and analysis of data that has been captured during a TCP connection?

Which of the following display filters will only show TCP traffic with the URG, PSH, and FIN flags set?

LaDanian is sniffing some traffic and notices a frame that is sent with the source MAC address of: 02:1D:45:68:AF:D4. This is what he thinks is weird. Why?

ARP spoofing works in part because Ethernet hardware has no way of knowing if there is another NIC on the network with the same MAC address or not. True or False?

Which of the following protocols are not vulnerable to sniffing due to clear text credentials being sent?

Which of the following attacks are not considered "Active Sniffing"?

Assuming your own address is 192.168.1.1, what display filter could be used to show all traffic other than web and mail.

During an attack you setup an access point with a stronger signal than those around you. You also set the SSIDs to be the same as the one you are targeting. You capture authentication frames. Which of the following is the best name for this attack?

Arianna wants to implement 802.11b for a series of hotels that her employer won the contract on. Her boss says that one of the customers was concerned that if TCP error checking was part of the configuration, the network would be slower. Arianna pauses, and explains …. ?

Jack is worried about the FUD (Fear Uncertainty Doubt) he was heard about wireless networks. He also does not want to learn about WPA2 and how easy it is to implement. He sets forth a policy of no wireless networks allowed period. What else should he do? (Choose two)

What is the highest possible speed of 802.11n?