21⟩ How do I crack VMS passwords?
Write a program that uses the SYS$GETUAF functions to compare the
results of encrypted words against the encrypted data in SYSUAF.DAT.
Two such programs are known to exist, CHECK_PASSWORD and
GUESS_PASSWORD.
Hacking
Home Basic Common Hacking
“Hacking is a criminal act, The terms hack and hacking are also used to refer to a modification of a program or device to give the user access to features that were otherwise unavailable, such as by circuit bending. It is from this usage that the term hacking is often used to refer to more nefarious criminal uses such as identity theft, credit card fraud or other actions categorized as computer crime. So get start preparation for a job interview related to the Hacking”
56 Hacking Questions And Answers
22⟩ What is NIS/yp?
NIS (Network Information System) in the current name for what was once
known as yp (Yellow Pages). The purpose for NIS is to allow many
machies on a network to share configuration information, including
password data. NIS is not designed to promote system security. If
your system uses NIS you will have a very short /etc/passwd file with
a line that looks like this:
+::0:0:::
To view the real password file use this command "cd/etc;ypcat passwd"
23⟩ How do I access the password file under VMS?
Under VMS, the password file is SYS$SYSTEM:SYSUAF.DAT. However,
unlike Unix, most users do not have access to read the password file.
24⟩ What is NTP?
To synchronize clocks of networked computers, NTP (Network Time Protocol) is used. For its primary means of communication UDP port 123 is used. Over the public internet NTP can maintain time to within 10 milliseconds.
25⟩ What is Keylogger Trojan?
Keylogger Trojan is malicious software that can monitor your keystroke, logging them to a file and sending them off to remote attackers. When the desired behaviour is observed, it will record the keystroke and captures your login username and password.
26⟩ Define Mac Flooding?
Mac Flooding is a technique where the security of given network switch is compromised. In Mac flooding the hacker or attacker floods the switch with large number of frames, then what a switch can handle. This make switch behaving as a hub and transmits all packets at all the ports. Taking the advantage of this the attacker will try to send his packet inside the network to steal the sensitive information.
27⟩ Define Enumeration?
The process of extracting machine name, user names, network resources, shares and services from a system. Under Intranet environment enumeration techniques are conducted.
28⟩ What is Defacement?
In this technique the attacker replaces the organization website with a different page. It contains the hackers name, images and may even include messages and background music.
29⟩ Define Cross-site scripting?
Cross site scripting is done by using the known vulnerabilities like web based applications, their servers or plug-ins users rely upon. Exploiting one of these by inserting malicious coding into a link which appears to be a trustworthy source. When users click on this link the malicious code will run as a part of the client's web request and execute on the user's computer, allowing attacker to steal information.
30⟩ List the types of Cross site scripting?
There are three types of Cross-site scripting:
★ Non-persistent
★ Persistent
★ Server side versus DOM based vulnerabilities
31⟩ List the common forms of DOS attack?
★ Buffer Overflow Attacks
★ SYN Attack
★ Teardrop Attack
★ Smurf Attack
★ Viruses
32⟩ What is DHCP Rogue Server?
A Rogue DHCP server is DHCP server on a network which is not under the control of administration of network staff. Rogue DHCP Server can be a router or modem. It will offer users IP addresses , default gateway, WINS servers as soon as user's logged in. Rogue server can sniff into all the traffic sent by client to all other networks.
33⟩ What is DOS (Denial of service) attack?
Denial of Service, is a malicious attack on network that is done by flooding the network with useless traffic. Although, DOS does not cause any theft of information or security breach, it can cost the website owner a great deal of money and time.
34⟩ How to avoid or prevent ARP poisoning?
ARP poisoning can be prevented by following methods:
Packet Filtering:
Packet filters are capable for filtering out and blocking packets with conflicting source address information.
Avoid trust relationship:
Organization should develop protocol that rely on trust relationship as little as possible.
Use ARP spoofing detection software:
There are programs that inspects and certifies data before it is transmitted and blocks data that is spoofed.
Use cryptographic network protocols:
By using secure communications protocols like TLS, SSH, HTTP secure prevents ARP spoofing attack by encrypting data prior to transmission and authenticating data when it is received.
35⟩ Define SQL injection?
SQL is one of the technique used to steal data from organizations, it is a fault created in the application code. SQL injection happens when you inject the content into a SQL query string and the result mode content into a SQL query string, and the result modifies the syntax of your query in ways you did not intend.
36⟩ What is Pharming?
In this technique the attacker compromises the DNS ( Domain Name System) servers or on the user computer so that traffic is directed to a malicious site.
37⟩ What is ARP Spoofing or ARP poisoning?
ARP (Address Resolution Protocol) is a form of attack in which an attacker changes MAC ( Media Access Control) address and attacks an internet LAN by changing the target computer's ARP cache with a forged ARP request and reply packets.
38⟩ What is Network Sniffing?
A network sniffer monitors data flowing over computer network links. By allowing you to capture and view the packet level data on your network, sniffer tool can help you to locate network problems. Sniffers can be used for both stealing information off a network and also for legitimate network management.
39⟩ List the types of computer based social engineering attacks?
Computer based social engineering attacks are:
★ Phishing
★ Baiting
★ On-line scams
40⟩ Define Stack Fingerprinting?
Once the hosts and port have been mapped by scanning the network, the final footprinting step can be performed. This is called Stack fingerprinting.
