Ethical Hacking

115 flashcards by MentisLibrary

How an authorized penetration test is scoped, run and reported: rules of engagement, the legal rules, methodologies, reconnaissance and scanning concepts, the common vulnerability classes and their defenses.

What is a penetration test?
An authorized, scoped, time-boxed assessment in which a tester simulates an attacker to find and demonstrate exploitable weaknesses, then reports them so they can be fixed.
Penetration test vs vulnerability assessment
A vulnerability assessment enumerates and rates weaknesses, usually with automated scanning and broad coverage. A penetration test goes further and demonstrates real impact by chaining findings, at the cost of narrower coverage.
Penetration test vs red team engagement
A penetration test aims for coverage of a defined scope and reports everything it finds. A red team engagement is objective-driven and stealthy, testing whether the defenders detect and respond, not whether every flaw is catalogued.
Black box, grey box and white box testing
Black box gives the tester no internal information, grey box gives partial information such as a low-privileged account, and white box gives full source code, architecture and credentials.
Red team, blue team and purple team
The red team plays the attacker, the blue team defends and monitors, and purple teaming runs both together so each attack technique is executed while detection is watched and tuned in real time.
What is a rules of engagement document?
The written agreement fixing what may be tested, from where, at what times, with which techniques, who to contact, and under what conditions testing stops. It is signed before any activity begins.
What belongs in a scope statement?
The exact assets in scope, listed by hostname, IP range, application URL, or account, plus everything explicitly out of scope, the depth of testing allowed, and the goals of the test.
Why does a tester need a written authorization letter?
Because unauthorized access to a computer system is a criminal offence in most jurisdictions, and a signed authorization from someone with the power to grant it is the only thing distinguishing a test from an intrusion.
Who is allowed to authorize a test?
Only a person with legal authority over the systems in question, usually a system owner or executive acting for the organization that owns or lawfully controls the asset.
Why do cloud and third-party assets need separate permission?
The provider owns the infrastructure and other tenants share it, so testing can affect systems the client does not control. Providers publish their own testing policies, and some techniques remain prohibited.
What are testing windows and blackout periods?
Agreed times when testing may and may not run, chosen to limit business disruption. Blackout periods typically cover month-end processing, peak trading, and major releases.
What are stop conditions?
Pre-agreed triggers that halt testing immediately, such as evidence of a real intrusion, an unexpected outage, discovery of unexpected sensitive data, or a system becoming unstable.
What is an assumed breach assessment?
A test that starts from a foothold the client grants deliberately, such as a standard workstation or a low-privileged account, so the exercise measures what an attacker could do after initial access rather than how they get in.
What is a retest, and why does it belong in the contract?
A follow-up check that the reported issues were actually fixed and that the fix did not introduce a new problem. Without it, the report is a list of intentions rather than a record of resolved risk.
What is safe harbor in a bug bounty policy?
A published commitment that the organization will not pursue legal action against researchers who follow the stated rules. It defines authorized scope for people the organization has never met.
What does the US Computer Fraud and Abuse Act prohibit?
Accessing a computer without authorization, or exceeding authorized access, along with related offences such as causing damage. Authorization is the pivot on which the entire statute turns.
What does the UK Computer Misuse Act 1990 cover?
Unauthorized access to computer material, unauthorized access with intent to commit further offences, unauthorized acts impairing operation, and the supply of articles for use in such offences.
Why is "I was only testing" not a legal defense?
Because the offences are defined by lack of authorization, not by intent to cause harm. Good motives may affect sentencing but do not make unauthorized access lawful.
What should a tester do on finding real personal data?
Stop collecting it, record only the minimum evidence needed to prove the finding exists, notify the client through the agreed channel, and follow the contract's data handling terms.
What should a tester do on finding signs of a prior compromise?
Stop, preserve what has already been observed without altering the system, and escalate to the client's incident response contact immediately.
What is coordinated vulnerability disclosure?
A process where the finder reports privately to the vendor, both agree a remediation timeline, and details are published after a fix is available or an agreed deadline passes.
Coordinated disclosure vs full disclosure
Coordinated disclosure withholds detail until a fix exists. Full disclosure publishes immediately, arguing that users cannot defend against a risk they do not know about and that vendors act faster under pressure.
What is a CVE identifier, and who assigns it?
A unique public identifier for a specific vulnerability in a specific product, in the form CVE-YEAR-NUMBER. Identifiers are assigned by CVE Numbering Authorities, which include many large vendors as well as the central program.
What is scope creep in a test, and why is it a breach?
Extending testing to systems, techniques or timeframes not covered by the agreement. It is a breach because authorization is bounded, and anything outside those bounds is unauthorized access.
What are the phases of the Penetration Testing Execution Standard?
Pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
What is NIST SP 800-115?
The US federal technical guide to information security testing and assessment. It groups activities into planning, discovery, attack and reporting, and covers review, target identification and validation techniques.
What is the OWASP Web Security Testing Guide?
A detailed, freely available manual of web application test cases organized by area, from configuration and identity management through input validation, error handling and business logic.
What is MITRE ATT&CK?
A public knowledge base of adversary tactics and techniques observed in real intrusions, organized as tactics such as initial access, persistence, privilege escalation and exfiltration, with techniques beneath each.
What is the Cyber Kill Chain?
A seven-stage model of an intrusion published by Lockheed Martin: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
What is threat modeling?
A structured exercise, done during design, that identifies what could go wrong with a system, which threats matter, and what controls address them. STRIDE is a common prompt set.