D488
Study online at https://quizlet.com/_fh280u
199. SCAP Languages: · Open Vulnerability and Assessment Language (OVAL) - Helps describe three main aspects of
an evaluated system including 1) system information, 2) machine state and, 3) reporting. Using OVAL provides a
consistent and interoperable way to collect and assess information regardless of the security tools being used.
· Asset Reporting Format (ARF) - Helps to correlate reporting formats to asset information independently from any specific
application or vendor product for consistency and interoperability.
· Extensible Configuration Checklist Description Format (XCCDF) - Written in XML, provides a consistent and standardized way
to define benchmark information as well as configuration and security checks to be performed during an assessment.
200. Common Vulnerability Scoring System (CVSS): · Low: 0.1 - 3.9 · Medium: 4.0 - 6.9
· High: 7.0 - 8.9
· Critical: 9.0 - 10.0
201. SCAP Scanner: Can compare a target computer/software configuration and patch level against pre-determined
settings contained within a SCAP content baseline.
202. Endpoint Preventative Controls: · Antivirus - Provides an effective means to detect previously identified
malware and additional functionality that can be tuned to aid in the detection of malicious activity
· Immutable Systems - A system that is "unchangeable." This can be implemented in many different ways but ultimately
involves the creation of an unchangeable core designed to be useable but not reconfigurable in a typical manner. Some
practical examples of this include simple software mechanisms designed to "freeze" the state of an operating system to a
configuration defined by the administrator. These utilities will often allow for changes to be made by the operator during a
session but will erase all changes after a session ends.
· Hardening - Designed to offer preventive capabilities by removing the elements that are often exploited by an adversary.
· Sandbox Detonation - Allows for a file, executable, or website to be accessed in a fenced-in, or otherwise protected, location
in order to observe and analyze behavior and determine if (or what) malicious activity occurs.
203. Application Controls: · Allow List vs. Block List - Describe the capability to define either what can run vs. what
cannot run on a system.
· Licensing - Identifying authorized software use includes the need for licensing compliance.
· Time of check vs. time of use (TOCTOU) - These issues are associated with programming that follows a sequence of events and
makes assumptions about the state of the steps. For example, an application may be designed to process data in a strict order
of 10 steps but, when the application runs in a multi-threaded environment, steps 1-5 and 6-10 are performed simultaneously,
resulting in unintended consequences.
204. Deadlocking: A side effect of the locks and mutexes where a lock takes effect but the process it is waiting for is
terminated, crashes, or does not finish and for this reason.
205. Cipher Suite Composition: · Key Exchange
· Digital Signature
· Encryption
, D488
Study online at https://quizlet.com/_fh280u
· Hashing
206. Common Application Frameworks: · Apache Struts - A popular framework used to develop Java web
applications
· Hibernate - A Java framework used to simplify the interaction between an application and its database.
· Microsoft .NET - An application programming framework for .NET languages focused on Microsoft Windows operating
systems
· Ruby on Rails - A popular web application framework that superseded the Ruby Merb framework.
· Ramaze - A simple web application framework for the Ruby programming language. · Django - A web application framework
for the Python programming language.
· Twisted - A programming framework for Python designed to simplify the implementation of network communications.
· web.py - A lightweight framework for developing Python web applications
208. JSON/Representational State Transfer (REST): A data exchange based on web technologies; an architectural
style.
209. Simple Object Access Protocol (SOAP): A protocol designed to facilitate communications over HTTP using XML.
The structure of the XML used by a SOAP interface is defined in a Web Services Description Language (WSDL)
document.
Often exploited to perform SQL injection, content discovery, authentication bypass, and other types of attacks.
210. Bytecode: Represents an intermediary state of source code created by a high-level language (when it is
complied) and designed to be processed by an interpreter on the target system.
211. Machine Code: The lowest-level representation of source code and is understood by devices.
212. Null Byte: URL encoded character %00 which essentially tells the application to stop reading and proceed.
213. XML External Entity (XXE) Injection: This attack causes the application to process the element named "lolz"
which references lol9 which in turn references 10 lol8 strings, each of which reference 10 lol7 strings, etc. Ultimately,
this block of code will generate a billion "lols" and consume 3 gigabytes of memory. <!ENTITY lol1
"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
214. Command Injection: Take advantage of web applications that bypass operating system APIs and instead spawn
command shells to complete actions because doing so can be less complicated to complete. The concatenate characters
(&&) can be used to append a command to the actions intended to be completed by the web application.
215. Process Injection: Well defined within the MITRE ATT&CK Framework as attack ID T1055 and describes an
attack whereby an adversary can inject code into an existing process to evade detection and potentially gain access
privileges equivalent to the exploited process.
216. Double Tagging: Involves the adversary exploiting the way in which VLAN are implemented by most switches,
namely that the concept of VLANs is implemented via the use of tags in Ethernet frames. The adversary takes
, D488
Study online at https://quizlet.com/_fh280u
advantage of the default configuration of the native VLAN (which is typically VLAN ID 1) by manipulating tags. To
defend against a native VLAN attack, the default VLAN ID should be changed (and the value must be the same for all
connected switches), and no user devices should be added to the native VLAN.
217. tcpdump Boolean Operators: · and (&&)
· or (||)
· not (!)
218. Windows Event Log Categories: · Application - Events generated by applications and services, such as when a
service cannot start
· Security - Audit events, such as a failed logon or access to a file being denied
· System - Events generated by the operating system and its services, such as storage volume health checks
· Setup - Events generated during the installation of Windows
· Forwarded Events - Events that are sent to the local log from other hosts 219. Incident Response Lifecycle: · Preparation -
Make the system resilient to attack in the first place. This includes hardening systems, writing policies and procedures, and
setting up confidential lines of communication. It also implies the creation of incident response resources and procedures.
· Detection and Analysis - Determine whether an incident has taken place and assess how severe it might be (triage), followed
by notification of the incident to stakeholders.
· Containment - Limit the scope and magnitude of the incident. The principal aim of incident response is to secure data while
limiting the immediate impact on customers and business partners.
· Eradication and Recovery - Once the incident is contained, the cause can be removed, and the system brought back to a
secure state. The response process may have to iterate through multiple phases of detection, containment, and eradication to
effect a complete resolution.
· Post-Incident Activity - Analyze the incident and responses to identify whether procedures or systems could be improved. It is
imperative to document the incident. This phase is very commonly referred to as lessons learned. The outputs from this phase
feed back into a new preparation phase in the cycle.
220. Phases of a Forensic Investigation: · Identification · Collection
· Analysis
· Reporting/Presentation
221. Data Acquisition: The process of obtaining a forensically clean copy of data from a device held as evidence.
222. Forensic Image vs. Forensic Clone: Forensic Image - Typically used for analysis purposes.
Forensic Clone - Used as a working copy that is not typically preserved.
223. Order of Volatility: · CPU registers and cache memory (including cache on disk controllers, GPUs, and so on)
· Contents of system memory (RAM), including: o Routing table, ARP cache, process table, kernel statistics o Temporary file
systems/swap space/virtual memory
, D488
Study online at https://quizlet.com/_fh280u
· Data on persistent mass storage devices (HDDs, SSDs, and flash memory devices)—including file system and free space
· Remote logging and monitoring data
· Archival media
224. Forensics Tools: · EnCase Forensic - A digital forensics case management product created by Guidance Software. In
addition to the core forensics suite, there are separate products for eDiscovery and Endpoint Investigator
· Forensic Toolkit - A commercial digital forensics investigation management and utilities suite, published by AccessData.
· The Sleuth Kit - An open source collection of command line and programming libraries for disk imaging and file analysis.
· Autopsy - A graphical frontend for these tools and also provides a case management/workflow tool.
225. File Carving Tools: · Foremost - This is a Linux-based forensic data recovery utility that uses file carving techniques to
extract deleted or corrupted data from a disk partition. It is able to recover data that has no underlying file system. Foremost is
a command-line utility that was originally created to be used by law enforcement but is open source and can be applied to any
forensic investigation.
· Strings - A command line utility used to extract text strings used within a binary file that would otherwise be difficult to
identify using manual methods. Identifying the test strings used in a binary file can reveal important attributes regarding the
internal structure of the program, including code comments, variable names, libraries, and other pertinent information. The
strings utility can also be used to collect information from memory, in Linux issuing the command sudo strings /dev/mem will
show string values currently present in system memory.
226. Popular Analysis Tools: · ExifTool - A utility designed to read and write file metadata for many file formats. o aircrack-
ng - Used to crack passwords contained within packet captures (obtained using airodump-ng)
o airodump-ng - Lists all networks in-range, the number of clients connected to the network (including MAC addresses of
clients), access point information, data volumes, encryption and authentication methods, and ESSID of the network. o airmon-
ng - Allows a support network adapter into monitor mode, which allows the card to inspect wireless traffic for all networks in-
range, without linking or authenticating to any access point
o airbase-ng - Used to mimic an access point such as is required when creating an evil twin
o aireplay-ng - Used to introduce packets into a wireless network, such as is needed to perform a deauthentication attack
· Volatility - A command line tool used to perform memory analysis. volatility can be used to explore the contents of a memory
dump
227. Statically Linked Library: Required libraries are identified at compile time and included with the file executable binary.
228. Dynamically Linked Library: One that an application relies upon and calls for when it is run. While use of dynamically
linked libraries can result in smaller executables and better mechanisms to maintain fully updated dependencies, the
application is vulnerable to attack by loading malicious libraries designed to mimic legitimate ones needed by the application
229. Hashing Utilities: · sha256sum - A linux command line utility designed to generate SHA-2 hashes with a digest length of
256 bits.
Study online at https://quizlet.com/_fh280u
199. SCAP Languages: · Open Vulnerability and Assessment Language (OVAL) - Helps describe three main aspects of
an evaluated system including 1) system information, 2) machine state and, 3) reporting. Using OVAL provides a
consistent and interoperable way to collect and assess information regardless of the security tools being used.
· Asset Reporting Format (ARF) - Helps to correlate reporting formats to asset information independently from any specific
application or vendor product for consistency and interoperability.
· Extensible Configuration Checklist Description Format (XCCDF) - Written in XML, provides a consistent and standardized way
to define benchmark information as well as configuration and security checks to be performed during an assessment.
200. Common Vulnerability Scoring System (CVSS): · Low: 0.1 - 3.9 · Medium: 4.0 - 6.9
· High: 7.0 - 8.9
· Critical: 9.0 - 10.0
201. SCAP Scanner: Can compare a target computer/software configuration and patch level against pre-determined
settings contained within a SCAP content baseline.
202. Endpoint Preventative Controls: · Antivirus - Provides an effective means to detect previously identified
malware and additional functionality that can be tuned to aid in the detection of malicious activity
· Immutable Systems - A system that is "unchangeable." This can be implemented in many different ways but ultimately
involves the creation of an unchangeable core designed to be useable but not reconfigurable in a typical manner. Some
practical examples of this include simple software mechanisms designed to "freeze" the state of an operating system to a
configuration defined by the administrator. These utilities will often allow for changes to be made by the operator during a
session but will erase all changes after a session ends.
· Hardening - Designed to offer preventive capabilities by removing the elements that are often exploited by an adversary.
· Sandbox Detonation - Allows for a file, executable, or website to be accessed in a fenced-in, or otherwise protected, location
in order to observe and analyze behavior and determine if (or what) malicious activity occurs.
203. Application Controls: · Allow List vs. Block List - Describe the capability to define either what can run vs. what
cannot run on a system.
· Licensing - Identifying authorized software use includes the need for licensing compliance.
· Time of check vs. time of use (TOCTOU) - These issues are associated with programming that follows a sequence of events and
makes assumptions about the state of the steps. For example, an application may be designed to process data in a strict order
of 10 steps but, when the application runs in a multi-threaded environment, steps 1-5 and 6-10 are performed simultaneously,
resulting in unintended consequences.
204. Deadlocking: A side effect of the locks and mutexes where a lock takes effect but the process it is waiting for is
terminated, crashes, or does not finish and for this reason.
205. Cipher Suite Composition: · Key Exchange
· Digital Signature
· Encryption
, D488
Study online at https://quizlet.com/_fh280u
· Hashing
206. Common Application Frameworks: · Apache Struts - A popular framework used to develop Java web
applications
· Hibernate - A Java framework used to simplify the interaction between an application and its database.
· Microsoft .NET - An application programming framework for .NET languages focused on Microsoft Windows operating
systems
· Ruby on Rails - A popular web application framework that superseded the Ruby Merb framework.
· Ramaze - A simple web application framework for the Ruby programming language. · Django - A web application framework
for the Python programming language.
· Twisted - A programming framework for Python designed to simplify the implementation of network communications.
· web.py - A lightweight framework for developing Python web applications
208. JSON/Representational State Transfer (REST): A data exchange based on web technologies; an architectural
style.
209. Simple Object Access Protocol (SOAP): A protocol designed to facilitate communications over HTTP using XML.
The structure of the XML used by a SOAP interface is defined in a Web Services Description Language (WSDL)
document.
Often exploited to perform SQL injection, content discovery, authentication bypass, and other types of attacks.
210. Bytecode: Represents an intermediary state of source code created by a high-level language (when it is
complied) and designed to be processed by an interpreter on the target system.
211. Machine Code: The lowest-level representation of source code and is understood by devices.
212. Null Byte: URL encoded character %00 which essentially tells the application to stop reading and proceed.
213. XML External Entity (XXE) Injection: This attack causes the application to process the element named "lolz"
which references lol9 which in turn references 10 lol8 strings, each of which reference 10 lol7 strings, etc. Ultimately,
this block of code will generate a billion "lols" and consume 3 gigabytes of memory. <!ENTITY lol1
"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
214. Command Injection: Take advantage of web applications that bypass operating system APIs and instead spawn
command shells to complete actions because doing so can be less complicated to complete. The concatenate characters
(&&) can be used to append a command to the actions intended to be completed by the web application.
215. Process Injection: Well defined within the MITRE ATT&CK Framework as attack ID T1055 and describes an
attack whereby an adversary can inject code into an existing process to evade detection and potentially gain access
privileges equivalent to the exploited process.
216. Double Tagging: Involves the adversary exploiting the way in which VLAN are implemented by most switches,
namely that the concept of VLANs is implemented via the use of tags in Ethernet frames. The adversary takes
, D488
Study online at https://quizlet.com/_fh280u
advantage of the default configuration of the native VLAN (which is typically VLAN ID 1) by manipulating tags. To
defend against a native VLAN attack, the default VLAN ID should be changed (and the value must be the same for all
connected switches), and no user devices should be added to the native VLAN.
217. tcpdump Boolean Operators: · and (&&)
· or (||)
· not (!)
218. Windows Event Log Categories: · Application - Events generated by applications and services, such as when a
service cannot start
· Security - Audit events, such as a failed logon or access to a file being denied
· System - Events generated by the operating system and its services, such as storage volume health checks
· Setup - Events generated during the installation of Windows
· Forwarded Events - Events that are sent to the local log from other hosts 219. Incident Response Lifecycle: · Preparation -
Make the system resilient to attack in the first place. This includes hardening systems, writing policies and procedures, and
setting up confidential lines of communication. It also implies the creation of incident response resources and procedures.
· Detection and Analysis - Determine whether an incident has taken place and assess how severe it might be (triage), followed
by notification of the incident to stakeholders.
· Containment - Limit the scope and magnitude of the incident. The principal aim of incident response is to secure data while
limiting the immediate impact on customers and business partners.
· Eradication and Recovery - Once the incident is contained, the cause can be removed, and the system brought back to a
secure state. The response process may have to iterate through multiple phases of detection, containment, and eradication to
effect a complete resolution.
· Post-Incident Activity - Analyze the incident and responses to identify whether procedures or systems could be improved. It is
imperative to document the incident. This phase is very commonly referred to as lessons learned. The outputs from this phase
feed back into a new preparation phase in the cycle.
220. Phases of a Forensic Investigation: · Identification · Collection
· Analysis
· Reporting/Presentation
221. Data Acquisition: The process of obtaining a forensically clean copy of data from a device held as evidence.
222. Forensic Image vs. Forensic Clone: Forensic Image - Typically used for analysis purposes.
Forensic Clone - Used as a working copy that is not typically preserved.
223. Order of Volatility: · CPU registers and cache memory (including cache on disk controllers, GPUs, and so on)
· Contents of system memory (RAM), including: o Routing table, ARP cache, process table, kernel statistics o Temporary file
systems/swap space/virtual memory
, D488
Study online at https://quizlet.com/_fh280u
· Data on persistent mass storage devices (HDDs, SSDs, and flash memory devices)—including file system and free space
· Remote logging and monitoring data
· Archival media
224. Forensics Tools: · EnCase Forensic - A digital forensics case management product created by Guidance Software. In
addition to the core forensics suite, there are separate products for eDiscovery and Endpoint Investigator
· Forensic Toolkit - A commercial digital forensics investigation management and utilities suite, published by AccessData.
· The Sleuth Kit - An open source collection of command line and programming libraries for disk imaging and file analysis.
· Autopsy - A graphical frontend for these tools and also provides a case management/workflow tool.
225. File Carving Tools: · Foremost - This is a Linux-based forensic data recovery utility that uses file carving techniques to
extract deleted or corrupted data from a disk partition. It is able to recover data that has no underlying file system. Foremost is
a command-line utility that was originally created to be used by law enforcement but is open source and can be applied to any
forensic investigation.
· Strings - A command line utility used to extract text strings used within a binary file that would otherwise be difficult to
identify using manual methods. Identifying the test strings used in a binary file can reveal important attributes regarding the
internal structure of the program, including code comments, variable names, libraries, and other pertinent information. The
strings utility can also be used to collect information from memory, in Linux issuing the command sudo strings /dev/mem will
show string values currently present in system memory.
226. Popular Analysis Tools: · ExifTool - A utility designed to read and write file metadata for many file formats. o aircrack-
ng - Used to crack passwords contained within packet captures (obtained using airodump-ng)
o airodump-ng - Lists all networks in-range, the number of clients connected to the network (including MAC addresses of
clients), access point information, data volumes, encryption and authentication methods, and ESSID of the network. o airmon-
ng - Allows a support network adapter into monitor mode, which allows the card to inspect wireless traffic for all networks in-
range, without linking or authenticating to any access point
o airbase-ng - Used to mimic an access point such as is required when creating an evil twin
o aireplay-ng - Used to introduce packets into a wireless network, such as is needed to perform a deauthentication attack
· Volatility - A command line tool used to perform memory analysis. volatility can be used to explore the contents of a memory
dump
227. Statically Linked Library: Required libraries are identified at compile time and included with the file executable binary.
228. Dynamically Linked Library: One that an application relies upon and calls for when it is run. While use of dynamically
linked libraries can result in smaller executables and better mechanisms to maintain fully updated dependencies, the
application is vulnerable to attack by loading malicious libraries designed to mimic legitimate ones needed by the application
229. Hashing Utilities: · sha256sum - A linux command line utility designed to generate SHA-2 hashes with a digest length of
256 bits.
