CompTIA PenTest+ Certification Practice Exam Chapter 3 (Total Sem Online Material) Flashcards
Web fuzzing is a data validation technique used to identify flaws in websites or web applications. Which of the following is not a practice commonly used in web fuzzing?
A.Feeding garbage or unexpected data to a user data input point to elicit error messages or other information
B.Inspection of website source data to check for potentially exploitable errors or warnings
C.Tampering with URL parameters
D.Sending HTTP request methods such as HEAD or POST where another method is expected
B.Inspection of website source data to check for potentially exploitable errors or warnings
Explanation:
While it is common to inspect a website’s source page to check for exploitable errors or warnings, this is not a practice that can be defined as fuzzing, which at its most basic level feeds unexpected data to a website or web application to attempt to elicit an unexpected system response.
A, C, and D are incorrect. A is incorrect because feeding garbage or unexpected data to elicit error messages or other information is essentially the definition of web fuzzing. Indeed, C and D—tampering with URL parameters and sending unexpected HTTP request methods—are themselves specific examples of this task.
On which port(s) does the Windows Remote Management interface listen? A.TCP/5985 and TCP/5986 B.TCP/389 and TCP/636 C.TCP/139 and TCP/445 D.TCP/135
A.TCP/5985 and TCP/5986
Explanation:
The Windows Remote Management interface, or WinRM, listens on TCP ports 5985 and 5986, leveraging HTTP and HTTPS, respectively, for management actions.
B, C, and D are incorrect. B is incorrect because TCP ports 389 and 636 are the ports for LDAP and LDAPS (LDAP over SSL), respectively. C is incorrect because TCP ports 139 and 445 are used for NetBIOS and SMB, respectively. D is incorrect because TCP/135 is used for Microsoft’s DCOM Service Control Manager.
During a penetration test, you determine that a wireless network in your scope is running WEP encryption. Unfortunately, there are no actively connected clients transmitting data, but the access point allows open authentication. Which of the following would be the method of attack to ultimately obtain the encryption key? A.Fragmentation attack B.KRACK C.Pixie dust attack D.Reaver attack
A.Fragmentation attack
Explanation:
Like the ChopChop attack, fragmentation attacks are used to obtain an XOR file; the XOR file is not the encryption key but may be used to create packets for injection into the network. A fragmentation attack repeatedly pulls fragments of the keystream from occasional packets sent by the access point. Because some of the contents of a packet are predictable to a degree (due to headers), a small portion of the keystream may be obtained by XOR-ing. This small piece of keystream may then be used to inject fragments of arbitrary data, allowing the attacker to repeat the attack and recover more of the keystream. Over a long enough time period, a complete XOR file can be built, allowing for arbitrary packet injection. At this point, the attacker can send arbitrary data to the AP (such as ARP request packets), which the AP will relay out. The attacker can collect these packets to obtain sufficient initialization vectors (IVs) to ultimately crack the WEP key with aireplay-ng. The project page for aircrack-ng has an excellent guide for this attack method; at the time of this writing, it may be found at https://aircrack-ng.org/doku.php?id=how_to_crack_wep_with_no_clients.
B, C, and D are incorrect. B is incorrect because KRACK (or the Key Reinstallation AttaCK) is a replay attack technique that targets WPA2. By spoofing a portion of an authenticated system’s four-way handshake, an attacker is able to trick the AP and client into resetting their key data to known values, effectively causing reuse of cryptographic information. Because cryptographic information is being reused, the contents of packets are then vulnerable to decryption, allowing an attacker to view potentially sensitive information. C is incorrect because a pixie dust attack is another attack focused on WPA2 and its use of Wi-Fi Protected Setup (WPS). Since the seed values of WPS are often simple to guess or known values based on published research, the attacker can simply sniff traffic for a period of time to be able to decrypt the WPS pin and password, allowing access to the AP. D is incorrect because a reaver attack is another WPA2 attack targeting WPS. Here, the eight-digit PIN is simply guessed via brute force.
Which of the following are examples of establishing daemon-based persistence? (Choose two.)
A.Copying the attacking system’s public SSH key into ~/.ssh/authorized_hosts
B.Creating a cronjob that attempts to establish a reverse shell to the attacking system every 15 minutes
C.Modifying the BootExecute registry key value to establish a bound shell on the victim system at boot time
D.Modifying an application that users of the compromised system are known to use frequently, such that it establishes a reverse shell callback on launch
B.Creating a cronjob that attempts to establish a reverse shell to the attacking system every 15 minutes
C.Modifying the BootExecute registry key value to establish a bound shell on the victim system at boot time
Explanation:
The abuse of system-executed services such as cron (which will execute user-defined cron jobs as defined in the cron table—just in the context of the user in question) and certain Windows registry keys to provide readily available shells is the defining feature of daemon-based persistence methods. In the case of B, persistence is maintained by the cron daemon; even if the reverse shell is killed manually, the cron daemon will attempt to reestablish it every 15 minutes. With C, persistence is achieved on a Windows system by establishing a bound shell whenever the server reboots, as the Session Manager (smss.exe) executes the programs listed in the Data field of the BootExecute key at boot time.
A and D are incorrect. A is incorrect because the use of SSH key-based persistence abuses a feature of SSH for persistence, rather than exploiting automated services. D is incorrect because modifying a frequently used application is not exploitation of an automated process, as it requires user interaction to provide shell access rather than such access being provided in the background and invisibly to the user.
Which ATT&CK matrix category describes techniques used to bypass detection or other network protection mechanisms? Specific examples include bypassing UAC and deploying rootkits. A.Initial access B.Lateral movement C.Persistence D.Defense evasion
D.Defense evasion
Explanation:
Defense evasion techniques described in the ATT&CK matrix are ultimately aimed toward evading detection or other network defenses. In the examples provided, bypassing UAC allows attackers to execute commands in an administrative context on Windows systems without a UAC alert notifying users, while rootkits hide the presence of malware by intercepting core operating system calls that supply key system information.
A, B, and C are incorrect. A is incorrect because initial access techniques are used to gain initial footholds into a target network. Examples of this include spearphishing and abuse of trusted relationships with outside organizations. B is incorrect because lateral movement techniques facilitate an attacker’s movement throughout a target organization’s network, allowing access to and control of additional systems. Examples of this include pass-the-hash and pass-the-ticket attacks. C is incorrect because persistence techniques consist of any access, action, or configuration changes that enable an attacker to ensure they can retain a presence on the system. Examples of this include modification of user .bash_profile files and new account creation.
Popularly exploited by the Conficker worm, which vulnerability relies on a buffer overflow in the Microsoft Server service to achieve remote code execution on Windows 2000, XP, and Server 2003? A.DoublePulsar B.MS08-067 C.EternalSynergy D.MS15-127
B.MS08-067
Explanation:
MS08-067 describes the vulnerability at the heart of the Conficker worm and relies on a buffer overflow in the Windows Server service, which handles remote procedure calls.
A, C, and D are incorrect. A is incorrect because DoublePulsar is a backdoor implant payload frequently used with other exploits, rather than a vulnerability. C is incorrect because EternalSynergy is an exploit (rather than a vulnerability) that targets SMBv1 with a buffer overflow to achieve code execution. D is incorrect because MS15-127 is a vulnerability that targets Microsoft DNS rather than its Server service to achieve remote code execution; in addition, MS15-127 was not leveraged by the Conficker worm.
During a penetration test, you discover that HTTP parameters are contained in the URL in plaintext with no obfuscation in a web application. You find that by changing the “?OrderNumber=12345” component of the URL to “?OrderNumber=XXXXX”, you are able to gain access to orders you would not otherwise be able to see. This is an example of what type of vulnerability? A.HTTP parameter pollution B.Unvalidated redirection C.Persistent XSS D.Insecure direct object reference
D.Insecure direct object reference
Explanation: The vulnerability in question is an example of an insecure direct object reference, and is shown through two facts: First, the use of a query (denoted by the “?” operator) tells us that the browser is sending the information that follows to the web server. Second, the use of the term “OrderNumber” in plaintext with a simple five-digit value suggests that the web server simply takes a client’s word for it when they say they have authorization to view a file. This class of vulnerability is best remedied by validating private object references and verifying authorization to all such referenced objects.
A, B, and C are incorrect. A is incorrect because HTTP parameter pollution would consist of sending specially crafted HTTP requests that contain multiple instances of an HTTP parameter with different values for the purpose of fuzzing a website or web application. HTTP parameter pollution is typically a complex enough issue to require manual testing, and different web servers will handle multiple identically named HTTP parameters differently. The results of parameter pollution can range from simple error messages to authentication or input validation bypasses. B is incorrect because the vulnerability described in the question produces information disclosure on the same website rather than redirecting the user to a different, malicious site. Unvalidated redirection would require that an attacker craft a malicious link to the vulnerable site, which then redirects the victim to a site of the attacker’s choosing, typically for the purpose of a phishing campaign or XSS attack. C is incorrect because the vulnerability described does not result in malicious code being served by the hosting server, as persistent XSS occurs when malicious code is embedded into a website that is visited by the victim. Additionally, persistent XSS targets the information held in the visitor’s browser (by getting the user to transfer information such as session tokens or other sensitive information) rather than the web server itself.
Which technique is marked by overwriting a program’s execution stack with “no operation” instructions, with an end goal of shifting a program’s instruction pointer to a specific command sequence? It is used extensively in the development of buffer overflow attacks. A.Return-oriented programming B.Ret2libc C.Stack smashing D.NOP sled
D.NOP sled
Explanation:
The technique described is a NOP sled (also called a NOP slide or NOP ramp). A NOP instruction indicates that no action should be taken by a processor during the execution of a program, effectively sliding the instruction pointer further down the stack until it reaches an instruction that can be acted upon.
A, B, and C are incorrect. A is incorrect because return-oriented programming is a category of attack used to achieve arbitrary code execution in spite of existing defenses such as code signing and executable space protection. Briefly, return-oriented programming seeks to gain control of a program’s execution flow and then employ instruction sequences already present in memory. Since return-oriented programming is an attack type rather than a specific technique used to slide the instruction pointer along, this answer is incorrect. B is incorrect because ret2libc attacks are a specific type of return-oriented programming that attempts to leverage an existing library function in memory to obtain code execution rather than deploying a custom-written payload. As with the broader category of return-oriented programming, this is a category of attack rather than a specific technique used in the attack, making this answer incorrect as well. C is incorrect because stack smashing is a specific type of buffer overflow attack that occurs when data is written to memory addresses on a program’s call stack, taking up more storage space than the intended data buffer is meant to contain. Since stack smashing is a type of buffer overflow attack rather than a technique used in the development of buffer overflow attacks, this answer is incorrect.
During preparation for a phishing campaign, you identify a critical business web application that does not verify the target of a redirect included in an HTTP GET parameter. You choose to create links that route to the legitimate web service but redirect to your attacking system where you are hosting a cloned version of the application’s login page that will harvest user credentials. This is an example of what type of vulnerability? A.Reflected XSS B.Unvalidated redirection C.HTTP parameter pollution D.Unauthorized API use
B.Unvalidated redirection
Explanation:
Unvalidated redirection occurs when untrusted input is accepted by a web application in such a way that it can cause a visitor to be redirected to another site. If an attacker leverages this and links to a malicious site of their own creation, this attack could be a critical component of a successful phishing campaign, as phishing victims are more likely to trust a link that appears to be part of a site they visit frequently.
A, C, and D are incorrect. A is incorrect because reflected XSS would require a user to be tricked into clicking a malicious link that sends the payload (typically a snippet of JavaScript that steals the user’s session token or gets them to download a malicious file) to the web server; the web server then does nothing with this payload but feed it back to the victim, without storing it locally. In this instance, a malicious link is crafted and sent directly to the user, after which the intended site is loaded before redirecting the visitor to a cloned site under the attacker’s control for the purpose of harvesting credentials. As such, this answer is incorrect. C is incorrect because HTTP parameter pollution would require the attacker to fuzz the target web server with HTTP requests that have multiple instances of the same HTTP parameter, rather than sending a malicious link to the victim, as in the example. Recall that HTTP parameter pollution is a type of application fuzzing that specifically tests how a website handles multiple HTTP parameters with the same name. Different web servers will handle multiple identically named HTTP parameters differently, and the results of parameter pollution can range from simple error messages to authentication or input validation bypasses. D is incorrect because unauthorized API use would involve the use of a feature or interface not intended for typical end users. In this case, a standard feature (an HTTP redirect) is abused due to a lack of sanitization of user input before the redirect is processed, making this answer incorrect as well. As a refresher, unauthorized or unexpected API use can come up for numerous reasons: developers may have left a feature enabled when pushing an application into an environment, development and production environments may not be properly segregated, or developers and administrators may just find it convenient to have the functionality of the API in question available at all times.
Which of the following attack vectors is best defined as tricking an application into loading a malicious library file by exploiting the documented library search order paths? A.DLL hijacking B.DLL injection C.LSASS dumping D.Unquoted service path abuse
A.DLL hijacking
Explanation:
DLL hijacking occurs when an application is manipulated into loading a malicious DLL file by exploiting the documented search path for DLL files as followed by Windows. Compare this with DLL injection, explained next.
B, C, and D are incorrect. B is incorrect because DLL injection is a technique wherein a running service is manipulated into loading a library file—but rather than abusing the default DLL lookup paths as documented by Microsoft, as with DLL hijacking, this is accomplished through means such as the SetWindowsHookExA function in the Windows API, or through modification of registry values that define the standard DLLs loaded into user processes. In other words, hijacking relies on normal Windows behavior to trick an application into loading a malicious library, whereas injection forcibly causes the application in question to load a malicious library. C is incorrect because LSASS dumping does not rely on getting a process to load a malicious library file. Rather, LSASS dumping occurs when an attacker obtains a memory dump of the LSASS.exe process on a Windows system. If the .dmp file produced is fed into Mimikatz or parsed manually, plaintext passwords can be retrieved for all user accounts on the system. D is incorrect because unquoted service path abuse becomes possible when a service managed via the Windows Service Control Manager has a space somewhere in the path to the executable and the path string is not encased with quotation marks. While this is likely to cause Windows to load library files that it would not otherwise load, the feature being exploited is the method Windows uses to find a service executable rather than the library search paths, making this answer incorrect.
Which of the following tools is best suited for routing penetration testing traffic between a network accessible to a penetration tester and another that cannot be accessed directly? A.Proxychains B.Responder C.Process Explorer D.RDP
A.Proxychains
Explanation:
Proxychains is used to route any network traffic through an established SOCKS proxy. It simplifies the process of scanning and attacking networks to which a penetration tester may not otherwise be able to access.
B, C, and D are incorrect. None of these options is capable of proxying arbitrary traffic to remote networks otherwise inaccessible to an attacker. B is incorrect because Responder is a LLMNR, NBT-NS, and MDNS poisoner with a built-in rogue authentication server. C is incorrect because Process Explorer is a component of Microsoft’s Sysinternals suite that provides a greatly enhanced task manager and system monitor that can be used in system troubleshooting and debugging. D is incorrect because RDP (Remote Desktop Protocol) is a remote access protocol that enables users to obtain graphical desktop sessions across networks.
Consider an /etc/hosts file with hundreds of entries similar to the following:
10.10.1.2 host.domain.com host
Of the following options, which would be the best choice to create a text file containing a list of IP addresses?
A.grep 10. /etc/hosts»_space; ips.txt
B.awk {‘print $2’} /etc/hosts > ips.txt
C.awk {‘print $1’} /etc/hosts»_space; ips.txt
D.grep -v domain.com /etc/hosts»_space; ips.txt
C.awk {‘print $1’} /etc/hosts»_space; ips.txt
Explanation:
The print function in awk can be used to extract specific columns of text as delineated by whitespace (that is, spaces or tabs), or by any other delimiter character when used with the -F flag. The»_space; operator is used to concatenate output to the named file rather than overwrite the entire file each time matching data is found.
A, B, and D are incorrect. A is incorrect because the use of grep would pull the entire line any time a match for “10.” was found, rather than just the IP address in question. B is incorrect because the use of {‘print $2’} in awk would print the second field of text—usually a hostname or FQDN in a hosts file—rather than the IP addresses. D is incorrect because the use of grep would pull whole lines rather than individual fields of data before feeding them into the text file. In addition, the -v flag would provide matches for all lines that did not contain the string “domain.com”, leaving only lines which did not contain an FQDN.
Which of the following general privilege escalation vectors is applicable to Windows hosts? (Choose two.) A.SUID/GUID program abuse B.Unattended installation artifacts C.Insecure sudo use D.DLL hijacking
B.Unattended installation artifacts
D.DLL hijacking
Explanation:
The collection of artifacts from unattended operating system installations and DLL hijacking are both categories of privilege escalation techniques that target Windows operating systems.
A and C are incorrect. SUID/GUID program abuse and insecure sudo access are privilege escalation vectors used in attacking *nix operating system families.
Which of the following are common targets used to test for local file inclusion vulnerabilities? (Choose two.) A./etc/shadow B.Windows\System32\config\SAM C./etc/passwd D.Windows\System32\drivers\etc\hosts
C./etc/passwd
D.Windows\System32\drivers\etc\hosts
Explanation:
The passwd file in *nix operating systems and the hosts file in Windows operating systems are some of the more common candidates for initial LFI tests, as they are world-readable and can provide some further enumeration of the system in question (system users in the case of the passwd file in *nix environments, and frequently visited remote systems in the case of the hosts file for Windows).
A and B are incorrect. The shadow files in *nix operating systems and SAM files in Windows operating systems are expected to be locked behind root or administrative access, respectively, for security reasons; while it is not unheard of to encounter a web server running as a root or administrative user, it is still a rare occurrence, making it a more productive use of time to test with files that should be accessible by all users first.
Spanning Tree Protocol is a link layer network protocol that ensures there are no switching loops in a series of connected Layer 2 networks. Triggering repeated election broadcasts can prevent hosts on the network from requesting information needed for legitimate communications, as all their bandwidth is ultimately absorbed in nominating root bridges for the local link. Why is this not an avenue of attack that should be considered by a penetration tester?
A.The technique effectively halts testing of any further targets, thereby preventing the penetration tester from fully assessing the target network or the related goals, such as privilege escalation or lateral movement.
B.Denial of service methods often only last as long as the attacker focuses their resources on the attack, essentially wasting billable hours that could be better spent performing other tasks.
C.Denial of service attacks are destructive, focusing solely on disruption of legitimate use of services, which can effectively halt business operations for a client organization
D.All of the above
D.All of the above
Explanation:
Each of the answers listed details a different reason that this attack vector (and more broadly, DoS attacks in general) is ill-advised without extensive coordination with the client. Denying service to others also necessarily involves denying service to yourself as a penetration tester, preventing you from conducting any further activities that would achieve the goals of the penetration test. In addition, these efforts are often time sinks that consume valuable testing time that could be spent trying to find another means of ingress to a target network. Arguably most important, however, is the fact that DoS attacks can halt legitimate business activity on client networks and systems. Penetration testing should be conducted with the aim of identifying and verifying vulnerabilities, rather than simply exploiting vulnerabilities for its own sake without regard to the client’s need to conduct business during the penetration test. In the case of DoS vulnerability testing and verification, it should generally be conducted only when explicitly called for in the RoE, or in close coordination with the client through the listed point of contact. Otherwise, it is generally best to simply document the vulnerability and press on to other issues.
A, B, and C are incorrect. All of these are good reasons not to blindly conduct DoS testing of targets during a penetration test, making them incorrect answers, as “All of the above” is the best fit for this question.
