10.3.3 Quiz – Tools and Code Analysis Answers

Explanation: Programming logic constructs are the building blocks that include the sequence or order in which instructions occur and are processed, the path a program takes when it is running, and the iteration (or repeated execution) of a section of code. Most programming languages include the following logic constructs: loops, conditionals, Boolean operators, string operators, and arithmetic operators.

Explanation: The most commonly used data structures in programming languages are JavaScript Object Notation (JSON), arrays, dictionaries, comma-separated values (CSV), lists, and trees.

Explanation: A library is a collection of resources that programs can reuse. Libraries can include prewritten code, configuration information, subroutines, documentation and help information, message templates, and classes.

Explanation: A procedure is a section of code that is created to perform a specific task. It can be used several times throughout a program.

Explanation: An array is a special variable with more than one value at a time. Lists are data structures in programming languages that contain an ordered structure of elements. Trees are non-linear data structures represented using nodes in a hierarchical model. Comma-separated values (CSV) files are plaintext files that contain data delimited by commas (,) and sometimes tabs or other characters, like a semicolon (;).

Explanation: JavaScript Object Notation, arrays, dictionaries, comma-separated values (CSV), lists, and trees are the most commonly used data structures in programming languages.

Explanation: A list is a data structure in programming languages that contains an ordered structure of elements. The example represents a list in Python.

Explanation: A procedure is a section of code that is created to perform a specific task. It can be used several times throughout a program. A function is a block of code useful when executing similar jobs repeatedly. Procedures and functions are very similar. In some programming languages, functions and procedures are practically the same thing.

Explanation: A library is a collection of resources that programs can reuse. It can include prewritten code, configuration information, subroutines, documentation and help information, message templates, and classes.

Explanation: Most Linux, Windows, and macOS versions support the Whois utility for querying the Whois database. Whois can also be used for reconnaissance. Unfortunately, the Whois database has been restricted to protect privacy because of the European Union´s General Data Protection Regulation (GDPR).

Explanation: Active reconnaissance involves gathering information about a victim using tools such as port and vulnerability scanners. Zenmap, Nmap, and Enum4linux are some of the most popular tools for active reconnaissance.

Explanation: Some of the most popular tools that can be used to brute force, crack, and compromise user credentials are John the Ripper, Cain and Abel, Hashcat, Hydra, Medusa, Ncrack, CeWL, w3af, Mimikatz, and Patator.

Explanation: BlackArch Linux is a Linux distribution with over 1900 security penetration testing tools. It can be downloaded from https://blackarch.org, and access the documentation at https://blackarch.org/guide.html. BlackArch Linux source code can be accessed at https://github.com/BlackArch/blackarch.

Explanation: Fingerprinting Organization with Collected Archives (FOCA) is a tool designed to find metadata and hidden information in documents. FOCA can analyze websites and Microsoft Office, Open Office, PDF, and other documents.

Explanation: A function is a block of code useful when executing similar tasks regularly throughout a program.

Explanation: Maltego is a tool for passive reconnaissance that can be used to find information about companies, individuals, gangs, educational groups, etc. Maltego organizes query entities within the Entity Palette, and the search options are called “transforms.”

Explanation: A class is a code template that can create different objects. It provides initial values for member variables and functions or methods.

Explanation: Censys is a tool that can be used for passive reconnaissance to find information about devices and networks on the Internet. It provides a free web and API access plan that limits the number of queries a user can perform. Censys also provides several other paid plans for premium support and additional queries.

Explanation: The Bourne-Again shell (Bash) is a command-line shell and language interpreter available on Linux, macOS, and Windows. It is helpful in penetration testing engagements to quickly create scripts, parse data, and automate different tasks.

Explanation: Kali Linux is one of the most popular penetration testing distributions in the industry. It is based on Debian GNU/Linux and evolved from previous penetration-testing Linux distributions (WHoppiX, WHAX, and BackTrack).

Explanation: Qualys is a security company that created one of the most popular vulnerability scanners in the industry. It has a cloud-based service that performs continuous monitoring, vulnerability management, and compliance checking.
This cloud solution interacts with cloud agents, virtual scanners, scanner appliances, and Internet scanners.

Explanation: Empire is a PowerShell-based post-exploitation framework that is very popular among pen testers. Empire is an open-source framework with PowerShell Windows and Python Linux agents. Empire implements the ability to run PowerShell agents without the need for powershell.exe. It allows you to rapidly deploy post-exploitation modules, including keyloggers, reverse shells, Mimikatz, and adaptable communications to evade detection.

Explanation: Veil is a framework that can be used with Metasploit to evade antivirus checks and other security controls.

Explanation: Malware can use Base64 encoding to put sensitive data (e.g., credit card numbers and personally identifiable information) in the payload of DNS packets.

Explanation: The Computer Aided Investigative Environment (CAINE) contains numerous tools that help investigators with analyses, including forensic evidence collection.