CVA Exploit Frameworks & Attack Vectors Flashcards

What is the primary security control that Address Space Layout Randomization (ASLR) provides against exploit attacks?

Answer: Randomizes the memory addresses of key program components, making it harder to predict addresses needed for reliable exploitation

ASLR randomizes base addresses of the stack, heap, and loaded libraries each time a program runs, making it significantly harder for attackers to reliably jump to known memory locations.

What technique is used to bypass Data Execution Prevention (DEP/NX) protections during exploitation?

Answer: Return-Oriented Programming (ROP)

Return-Oriented Programming (ROP) chains together small snippets of legitimate executable code ('gadgets') already in memory, bypassing DEP by never executing attacker-supplied code.

During a vulnerability assessment, you identify a cross-site scripting vulnerability. What is the most impactful proof-of-concept to demonstrate to stakeholders?

Answer: Demonstrate session hijacking by stealing and using a session cookie via the XSS payload

Demonstrating actual session hijacking via XSS — stealing a session cookie and using it to authenticate as the victim — proves the real-world impact far more effectively than a simple alert popup.

What is 'command injection' and how does it differ from SQL injection?

Answer: Command injection allows arbitrary OS commands to execute by injecting shell metacharacters into application inputs, while SQL injection targets database query manipulation

Command injection injects OS shell commands (e.g., '; cat /etc/passwd') through application inputs that are passed to system shells, while SQL injection manipulates database query structure.

What is the significance of 'CVE score' (CVSS) when prioritizing vulnerability remediation after an assessment?

Answer: It provides a standardized numerical score representing vulnerability severity based on exploitability and impact metrics

CVSS (Common Vulnerability Scoring System) provides a standardized 0-10 severity score based on exploitability factors and impact metrics, helping prioritize remediation efforts across many findings.

What is 'living off the land' (LotL) in the context of post-exploitation attack techniques?

Answer: Using legitimate system tools and features (e.g., PowerShell, WMI, certutil) already present on the target to perform malicious actions while evading detection

Living off the land uses built-in OS tools and legitimate binaries (LOLBins) for malicious purposes, making attacker activity harder to detect since these tools are whitelisted and expected.