SecurityNews

    OpenVAS, short for Open Vulnerability Assessment System, is an open-source network security scanner used for vulnerability assessment and management. It was first released in 2005 as a fork of the popular Nessus scanner and has since become one of the most widely used vulnerability scanners among security professionals and network administrators. OpenVAS works by conducting comprehensive vulnerability scans of network devices, servers, and web applications. It uses a large database of vulnerability tests and checks for known vulnerabilities, misconfigurations, and security weaknesses. Here are some of the key features of OpenVAS: Comprehensive Scanning: OpenVAS is capable of conducting thorough scans of a wide range of network devices and applications, including servers, workstations, web applications, and databases. Extensive Vulnerability Database: OpenVAS has a vast database of vulnerability tests that can detect known vulnerabilities, misconfigurations, and security we...

        Red teaming is a comprehensive and systematic approach to testing the security of an organization's systems, networks, and physical facilities. It is a proactive approach that helps organizations identify and mitigate potential security risks by simulating real-world attack scenarios. The objective of red teaming is to identify vulnerabilities, weaknesses, and gaps in an organization's security posture and to help the organization improve its security defenses. Red teaming typically involves a team of experienced security professionals who are given the task of testing an organization's security. These professionals use a variety of techniques, tools, and methodologies to simulate different types of attacks, including social engineering, physical security breaches, network and application attacks, and other methods commonly used by hackers and other threat actors. The goal of a red team is to replicate the tactics, techniques, and procedures of...

    SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities in web applications. It is written in Python and is available on Linux, Windows, and macOS. SQLMap is a powerful tool that can be used by security professionals, penetration testers, and ethical hackers to identify and exploit SQL injection vulnerabilities in web applications. SQL injection is a type of security vulnerability that allows an attacker to manipulate a web application's SQL database by injecting malicious SQL statements into an entry field, such as a search field or a login form. This can lead to data theft, data manipulation, and even complete control of the web application and its underlying database. SQLMap works by sending various SQL injection techniques to the targeted web application to identify vulnerabilities. It supports a wide range of database management systems such as MySQL, Oracle, Postg...

        A password spraying attack is a type of brute-force attack where an attacker tries a single password against multiple usernames. The goal of a password spraying attack is to gain access to a target's account by guessing the correct password. Unlike traditional brute-force attacks that try multiple passwords against a single username, password spraying attacks try a single password against multiple usernames. Password spraying attacks are effective because many users tend to use weak passwords or reuse the same password across multiple accounts. Attackers can use tools to automate the process of trying a single password against multiple usernames, making it a relatively easy and low-risk attack to carry out. To execute a password spraying attack, an attacker first gathers a list of usernames, typically by scanning social media profiles, company directories, or other public sources. Once the attacker has a list of usernames, they will use a tool t...

    Lateral movement is a technique used by cyber attackers to move laterally within a network, after gaining initial access. This technique allows attackers to traverse through the network and gain access to sensitive data, systems, and resources. Lateral movement is a critical component of a successful cyber attack, and it is becoming increasingly popular among attackers. Lateral movement is possible due to the interconnected nature of modern networks. Once an attacker gains access to a single device or system, they can use that access to pivot to other systems within the network. Attackers often use tools like remote desktop protocol (RDP), PowerShell, and command-line tools to move laterally. They may also exploit vulnerabilities in software or operating systems to escalate their privileges and gain greater access to the network. Lateral movement can take various forms, depending on the attacker's objectives and the network's topology. Some common techniques...

During an internal network audit, you are asked to see if there is any RPC server running on the network and if found, enumerate the associate RPC services. Which port would you scan to determine the RPC server and which command will you use to enumerate the RPC services? Port 111, rpcinfo Port 111, rpcenum Port 145, rpcinfo Port 145, rpcenum

James is an attacker who wants to attack XYZ Inc. He has performed reconnaissance over all the publicly available resources of the company and identified the official company website http://xyz.com. He scanned all the pages of the company website to find for any potential vulnerabilities to exploit. Finally, in the user account login page of the company’s website, he found a user login form which consists of several fields that accepts user inputs like username and password. He also found than any non-validated query that is requested can be directly communicated to the active directory and enable unauthorized users to obtain direct access to the databases. Since James knew an employee named Jason from XYZ Inc., he enters a valid username “jason” and injects “jason)(&))” in the username field. In the password field, James enters “blah” and clicks Submit button. Since the complete URL string entered by James becomes “(& (USER=jason)(&))(PASS=blah)),” only the first filte...

Henderson has completed the pen testing tasks. He is now compiling the final report for the client. Henderson needs to include the result of scanning that revealed a SQL injection vulnerability and different SQL queries that he used to bypass web application authentication. In which section of the pen testing report, should Henderson include this information? General opinion section Methodology section Comprehensive technical report section Executive summary section

Arrange the WEP cracking process in the correct order: I. aireplay-ng -1 0 -e SECRET_SSID -a 1e:64:51:3b:ff:3e -h a7:71:fe:8e:d8:25 eth1 II.aircrack-ng -s capture.ivs III. airmon-ng start eth1 IV. airodump-ng --ivs --write capture eth1 V. aireplay-ng -3 -b 1e:64:51:3b:ff:3e -h a7:71:fe:8e:d8:25 eth1 A. IV-->I-->V-->III-->II B. III-->IV-->V-->II-->I C. III-->IV-->I-->V-->II D. IV-->I-->V-->III-->II

An organization recently faced a cyberattack where an attacker captured legitimate user credentials and gained access to the critical information systems. He also led other malicious hackers in gaining access to the information systems. To defend and prevent such attacks in future, the organization has decided to route all the incoming and outgoing network traffic through a centralized access proxy apart from validating user credentials. Which of the following defensive mechanisms the organization is trying to strengthen? Authentication Serialization Encryption Hashing

Lee has established a new startup where they develop android applications. In order to meet memory requirements of the company, Lee has hired a Cloud Service Provider, who offered memory space along with virtual systems. Lee was dissatisfied with their service and wanted to move to another CSP, but was denied as a part of the contract, which reads that the user cannot switch to another CSP. What is this condition called? Virtualization Lock-in Resource Isolation Lock-up

Nancy Jones is a network admin at Society Technology Ltd. When she is trying to send data packets from one network (Token-ring) to another network (Ethernet), she receives an error message stating: 'Destination unreachable' What is the reason behind this? Packet is lost Packet fragmentation is required Packet contains image data Packet transmission is not done properly

Stuart is a database penetration tester working with Regional Server Technologies. He was asked by the company to identify the vulnerabilities in its SQL database. Stuart wanted to perform a SQL penetration by passing some SQL commands through a web application for execution and succeeded with a command using a wildcard attribute indicator. Which of the following strings is a wildcard attribute indicator? ?Param1=foo&Param2=bar % @variable @@variable

Richard, a penetration tester was asked to assess a web application. During the assessment, he discovered a file upload field where users can upload their profile pictures. While scanning the page for vulnerabilities, Richard found a file upload exploit on the website. Richard wants to test the web application by uploading a malicious PHP shell, but the web page denied the file upload. Trying to get around the security, Richard added the ‘jpg’ extension to the end of the file. The new file name ended with ‘.php.jpg’. He then used the Burp suite tool and removed the ‘jpg’’ extension from the request while uploading the file. This enabled him to successfully upload the PHP shell. Which of the following techniques has Richard implemented to upload the PHP shell? Session stealing Cookie tampering Cross site scripting Parameter tampering

James, a penetration tester, found a SQL injection vulnerability in the website http://www.xsecurity.com. He used sqlmap and extracted the website’s databases from the sql server, one of them being “offices.” Which among the following sqlmap queries does James issue in order to extract the tables related to the database “offices”? sqlmap -u “www.xsecurity.com” --dbs offices -T sqlmap -u “www.xsecurity.com” --dbs offices --T sqlmap -u “www.xsecurity.com” --dbs offices -tables sqlmap -u “www.xsecurity.com” --dbs offices --tables

Dale is a network admin working in Zero Faults Inc. Recently the company’s network was compromised and is experiencing very unusual traffic. Dale checks for the problem that compromised the network. He performed a penetration test on the network’s IDS and identified that an attacker sent spoofed packets to a broadcast address in the network. Which of the following attacks compromised the network? ARP Spoofing Amplification attack MAC Spoofing Session hijacking

Sandra, a wireless network auditor, discovered her client is using WEP. To prove the point that the WEP encryption is very weak, she wants to decrypt some WEP packets. She successfully captured the WEP data packets, but could not reach the content as the data is encrypted. Which of the following will help Sandra decrypt the data packets without knowing the key? A. Fragmentation Attack B. Chopchop Attack C. ARP Poisoning Attack D. Packet injection Attack

Tom is a networking manager in XYZ Inc. He and his team were assigned the task to store and update the confidential files present on a remote server using Network File System (NFS) client-server application protocol. Since the files are confidential, Tom was asked to perform this operation in a secured manner by limiting the access only to his team. As per the instructions provided to him, to use NFS securely, he employed the process of limiting the superuser access privileges only to his team by using authentication based on the team personnel identity. Identify the method employed by Tom for securing access controls in NFS? Root Squashing nosuid noexec Suid

Gibson, a security analyst at MileTech Solutions, is performing cloud penetration testing. As part of this process, he needs to check for any governance and compliance issues against cloud services. Which of the following documents helps Gibson in checking whether the CSP is regularly audited and certified for compliance issues? Service level agreement Data use agreement ROE agreement Nondisclosure agreement

ABC bank, a UK-based bank hired Anthony, to perform a penetration test for the bank. Anthony began performing lookups on the bank’s DNS servers, reading news articles online about the bank, performing competitive intelligence gathering, watching what times the bank employees come and go, and searching the bank’s job postings. What phase of the penetration testing is Anthony currently in? Attack phase Post-attack phase Pre-attack phase Remediation phase