Certified Ethical Hacker (CEH) flashcards

Common web app security risks, updated periodically

Users acting outside intended permissions

Sensitive data exposed due to weak crypto

Untrusted data sent to interpreter; SQL, NoSQL, OS

Missing security controls by design; threat modeling issue

Default configs, open ports, verbose errors

Using libraries, frameworks with known issues

Weak passwords, session management, MFA bypass

Updates, critical data without integrity checks

Insufficient logging, alerting on security events

Server fetches malicious URL, internal systems exposed

Information gathering before attack

Passive: no direct interaction

Publicly available information gathering

Advanced search operators for specific data

Search engine for internet-connected devices

Internet-wide scan data and search engine

Domain registration information

Mapping DNS records for a domain

Requesting full DNS zone data; often restricted

Collecting email addresses for phishing

Gathering info from public profiles

On-site observation, dumpster diving

Maltego, Nmap, Recon-ng

Graphical link analysis tool for OSINT

Directs web crawlers; can reveal hidden paths

Info in documents, images; author, creation date

Archives past versions of websites

Website uptime, OS, web server info

Maps network path to target; router hops

Identify active hosts on a network segment

Identify open ports, running services

Network scanner, port discovery, OS detection

Identifies software and version on open ports

Identifies known weaknesses in systems, applications

SNMP, telnet, SSH for device info

Gather network device info from MIBs

Gaining access, escalating, maintaining, covering tracks

Brute force, dictionary, hybrid, rainbow table

Try all possible combinations until match

Uses list of common words, phrases

Precomputed hashes to find plaintext passwords

Single common password against many accounts

Extracting service account hashes from AD

Reusing NTLM hash without knowing plaintext password

NTLM: challenge-response

Gaining higher access levels on a system

Low user to administrator

User A to User B, same level

Vulnerabilities in OS kernel for root access

Running with excessive permissions; path to escalation

Allows modification of service executables

Windows search order vulnerability; executable hijack

Loading malicious DLL instead of legitimate one

Modifying or creating tasks for persistence/escalation

Replacing accessibility tool with cmd.exe

Forged Kerberos Ticket Granting Ticket (TGT)

Forged Kerberos Ticket Granting Service (TGS)

User-mode, kernel-mode, firmware, hypervisor

Clearing logs, altering timestamps, steganography

Capturing data packets from network traffic

Network interface sees all traffic, not just its own

Injecting traffic to force responses, e.g., ARP poisoning

Just listening to traffic without interaction

Associating attacker MAC with victim IP, MITM

Overwhelming switch CAM table; forces broadcast mode

Exhausting IP addresses in DHCP pool; DoS

Injecting malicious DNS records into resolver cache

Encapsulating one protocol within another, often for evasion

VPN: concept

Fragmentation, tunneling, port forwarding, ICMP tunneling

Encryption, obfuscation, polymorphic code, atomicity

Decoy systems to attract attackers, gather info

Identifying open ports and services on a host

Sends SYN, checks SYN-ACK, doesn't complete handshake

Sends FIN packet; closed ports reply RST, open don't

Sends FIN, URG, PSH; closed ports reply RST

Sends packet with no flags set; closed ports reply RST

Uses IP ID sequence of idle host to scan target

Manipulating database queries via input fields

Triggering database errors to reveal information

Using UNION SELECT to combine query results

Inferring data based on true/false responses or time delays

Using delays to deduce information, no direct output

Observing true/false application responses

Attacker receives data via a separate channel, DNS/HTTP

Injecting client-side scripts into web pages

Script returned immediately in response, not stored

Malicious script saved on server, served to all users

Vulnerability in client-side code modifying DOM

Tricking user's browser into executing unwanted actions

Stealing or predicting a valid session ID

Attacker forces a known session ID onto a victim

Weaknesses in login, session management, password handling

Accessing resources directly without proper authorization

Default credentials, unpatched systems, open ports

Processing untrusted XML input, accessing local files

Server makes requests to internal/external resources

Uploading malicious files, e.g., web shells

Executing OS commands via application input

Accessing files outside intended directory using '..'

Exploiting weak IVs to recover key

Capturing 4-way handshake, offline brute force

Rogue AP mimics legitimate one, intercepts traffic

Forcing clients off network to capture handshake

Tools for wireless network auditing, cracking

Offline brute force on WPS PIN, vulnerable routers

Tool for WPS brute force attacks

Denial of service, flooding channel with noise

Interface for device control, file transfer, shell access

Removing vendor restrictions, allows unsigned code

Gaining superuser access, bypasses OS security

Analyzing compiled code, understanding logic, finding flaws

Common mobile app vulnerabilities, risk categories

Installing apps outside official stores, bypassing checks

Sensitive data saved unencrypted on device

Weak algorithms or improper crypto implementations

Centralized policy enforcement, security controls for devices

Extracting, examining firmware for vulnerabilities

Finds internet-connected devices, services, ports

Scalability, cost savings, accessibility, resource pooling

Public, private, hybrid, community

IaaS, PaaS, SaaS

Infrastructure as a Service

Platform as a Service

Software as a Service

Vendor secures the cloud, customer secures in the cloud

Data breaches, misconfigurations, account hijacking, insecure APIs

Shared secret key

Public/private key pair

Asymmetric

One-way transformation

Sender's private key

Fixed 128-bit block length

Exploits collision probability in hash functions

Ephemeral keys