You have just completed a database security audit and writing the draft pen testing report.

Which of the following will you include in the recommendation section to enhance the security of the database server?

Reveal Solution Hide Solution

George, a freelance Security Auditor and Penetration Tester, was working on a pen testing assignment for Xsecurity. George is an ESCA certified professional and was following the LPT methodology in performing a comprehensive security assessment of the company. After the initial reconnaissance, scanning and enumeration phases, he successfully recovered a user password and was able to log on to a Linux machine located on the network. He was also able to access the /etc/passwd file; however, the passwords were stored as a single “x” character.

What will George do to recover the actual encrypted passwords?

Reveal Solution Hide Solution

An attacker targeted to attack network switches of an organization to steal confidential information such as network subscriber information, passwords, etc. He started transmitting data through one switch to another by creating and sending two 802.1Q tags, one for the attacking switch and the other for victim switch. By sending these frames. The attacker is fooling the victim switch into thinking that the frame is intended for it. The target switch then forwards the frame to the victim port.

Identify the type of attack being performed by the attacker?

Reveal Solution Hide Solution

An attacker targeted to attack network switches of an organization to steal confidential information such as network subscriber information, passwords, etc. He started transmitting data through one switch to another by creating and sending two 802.1Q tags, one for the attacking switch and the other for victim switch. By sending these frames. The attacker is fooling the victim switch into thinking that the frame is intended for it. The target switch then forwards the frame to the victim port.

Identify the type of attack being performed by the attacker?

Reveal Solution Hide Solution

65.172.55 microsoft.com

After performing a Who is lookup, Joe discovered the IP does not refer to Microsoft.com. The network admin denied modifying the host files.

Which type of attack does this scenario present?

Reveal Solution Hide Solution

The Rhythm Networks Pvt Ltd firm is a group of ethical hackers. Rhythm Networks was asked by their client Zombie to identify how the attacker penetrated their firewall. Rhythm discovered the attacker modified the addressing information of the IP packet header and the source address bits field to bypass the firewall.

What type of firewall bypassing technique was used by the attacker?

Reveal Solution Hide Solution

Todd is working on an assignment involving auditing of a web service. The scanning phase reveals the web service is using an Oracle database server at the backend. He wants to check the TNS Listener configuration file for configuration errors.

Which of the following directories contains the TNS Listener configuration file, by default:

Reveal Solution Hide Solution

Cedric, who is a software support executive working for Panacx Tech. Inc., was asked to install Ubuntu operating system in the computers present in the organization. After installing the OS, he came to know that there are many unnecessary services and packages in the OS that were automatically installed without his knowledge. Since these services or packages can be potentially harmful and can create various security threats to the host machine, he was asked to disable all the unwanted services.

In order to stop or disable these unnecessary services or packages from the Ubuntu distributions, which of the following commands should Cedric employ?

Reveal Solution Hide Solution

Jack, a network engineer, is working on an IPv6 implementation for one of his clients. He deployed IPv6 on IPv4 networks using a mechanism where a node can choose from IPv6 or IPv4 based on the DNS value. This makes the network resources work simpler.

What kind of technique did Jack use?

Reveal Solution Hide Solution

Arnold is trying to gain access to a database by inserting exploited query statements with a WHERE clause. He wants to retrieve all the entries from a particular table (e. g. StudName) using the WHERE clause.

What query does Arnold need to write to retrieve the information?

Reveal Solution Hide Solution