JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD MCA 2021 ETHICAL HACKING Previous Question Paper (July/August - 2021 - R17)

Enumeration is the process of extracting user names, machine names, network resources, shares, and services from a system. It is a critical phase in network security attacks where an attacker establishes an active connection to the target to identify potential entry points. Common techniques include querying DNS, SNMP, LDAP, and SMB services to map the network topology and identify valid user accounts or system vulnerabilities.

Vulnerability Analysis involves the systematic identification and evaluation of security weaknesses in a network, application, or system. Once enumeration provides a map of the target, vulnerability analysis uses automated scanners and manual testing to detect flaws such as unpatched software, weak configurations, or insecure protocols. The goal is to determine the exploitability of these weaknesses to gain unauthorized access or escalate privileges.

Application security focuses on protecting software from threats throughout its lifecycle. Key features include:

• Authentication and Authorization: Ensuring only verified users access the application and restricting their actions based on defined roles and permissions.
• Input Validation: Sanitizing all user-provided data to prevent common attacks like SQL injection, Cross-Site Scripting (XSS), and buffer overflows.
• Session Management: Securely handling user sessions through encrypted tokens, timeouts, and secure cookie attributes to prevent session hijacking.
• Encryption: Protecting data at rest and in transit using robust cryptographic standards (e.g., TLS/SSL) to ensure confidentiality and integrity.
• Logging and Auditing: Maintaining detailed records of application events and security-sensitive actions to facilitate incident detection and forensic analysis.
• Error Handling: Providing generic error messages to users to prevent information leakage that could assist an attacker in footprinting the system.