CompTIA PenTest+ (PT0-001) Practice Certifications Exams (Jason DIon3 of 6) Flashcards
Your company is setting up a system to accept credit cards in their retail and online locations. Which of the following compliance types should you be MOST concerned with dealing with credit cards? A.PCI-DSS B.GDPR C.PHI D.PII
A.PCI-DSS
Explanation:
OBJ-1.4: The Payment Card Industry Data Security Standard (PCI DSS) applies to companies of any size that accept credit card payments. If your company intends to accept card payment and store, process, and transmit cardholder data, you need to securely host your data and follow PCI compliance requirements.
A firewall technician configures a firewall to allow HTTP traffic as follows:
-=-=-=-=-=-
Source IP Zone Dest IP Zone Port Action
Any Untrust Any DMZ 80 Allow
-=-=-=-=-=-
The organization should upgrade to what technology to prevent unauthorized traffic from traversing the firewall? A.Application-aware firewall B.HTTPS C.Stateless packet inspection D.Intrusion detection system
A.Application-aware firewall
Explanation:
OBJ-5.3: Application-aware firewall can analyze and verify protocols all the way up to layer 7 of the OSI reference model. It has the advantage of being aware of the details in the application layer. Since we desired to allow HTTP traffic, we must deal with the traffic at the application layer. This will prevent an attacker from sending SSH traffic over port 80, for example. By using an application-aware firewall, only HTTP traffic will be allowed over port 80.
Your organization has been receiving many phishing emails recently, and you are trying to determine why they are effective in getting your users to click on their links. The latest email consists of what looks like an advertisement that is offering an exclusive early access opportunity to buy a new iPhone at a discounted price. Still, there are only 5 phones available at this price. What type of social engineering principle is being exploited here? A.Trust B.Familiarity C.Intimidation D.Scarcity
D.Scarcity
Explanation:
OBJ-3.1: Scarcity is used to create a fear in a person of missing out on a special deal or offer. This technique is used in advertising all the time, such as “supplies are limited,” “only available for the next 4 hours”, and other such artificial limitations being used.
You are performing a web application security test, notice that the site is dynamic, and must be using a back-end database. You decide you want to determine if the site is susceptible to a SQL injection. What is the first character that you should attempt to use in breaking a valid SQL request? A.Exclamation mark B.Semicolon C.Single Quote D.Double Quote
C.Single Quote
Explanation:
OBJ-3.4: The single quote character (‘) is the character limiter in SQL. With a single quote,’ you delimit strings, and therefore you can test whether the programmer has properly escaped the strings in the targeted application. If not escaped directly, you can end any string supplied to the application and add other SQL code after it. This is a common technique for SQL injections. A semicolon is a commonly used character at the end of a line of code or command in many programming languages. An exclamation mark comments a line of code in several languages. Double quotes contain a string that is passed to a variable.
Tierra works as a cybersecurity analyst for a large multi-national oil and gas company. She responds to an incident at her company in which their public-facing web server has been defaced with the words, “Killers of the Arctic.” She believes this was done in response to her company’s latest oil drilling project in the Arctic Circle. Which threat actor is most likely to blame for the website defacement? A.APT B.Hacktivist C.Organized Crime D.Script Kiddie
B.Hacktivist
Explanation:
OBJ-1.3: It appears this hack was motivated by a pro-environmentalist agenda based on the message of the website defacement. This is an example of hacktivism. In 2012, five top multi-national oil companies were targeted by members of Anonymous as a form of digital protests against drilling in the Arctic, a practice that these hacktivists believe has contributed to the melting of the ice caps in that region.
Dion Training has applied a new Group Policy to all student accounts that will lock out any account in which the student enters their password incorrectly 3 times in a row. Once the account is locked out, the student must wait 15 minutes before they can attempt to log in again. What type of attack is this mitigation strategy trying to prevent? A.Spoofing B.Privilege Escalation C.Brute force attack D.Man-in-the-middle
C.Brute force attack
Explanation:
OBJ-5.3: Since the policy will lockout the student for 15 minutes between attempts, it is a valid mitigation technique against a brute force attack. By extending the waiting period, the attacker’s brute force attempts are less effective.
Which of the following is the BEST way to regularly prevent different security threats from occurring within your network? A.User training and awareness B.Penetration testing C.Business COntinuity training D.Disaster Recovery Planning
A.User training and awareness
Explanation:
OBJ-5.3: Users are the biggest vulnerability on your network. Therefore, increasing user training can decrease the number of security threats that are realized on your networks. According to industry best practices, you should conduct end-user security awareness training at least annually (if not more frequently).
During your reconnaissance, you have determined that your client has devices used to send remote control signals to industrial assets used by their critical infrastructure utilities connected to their corporate network. Which of the following methods would MOST likely be the best method for exploiting these systems?
A.Identify a jailbroken device for easy exploitation
B.Use Metasploit modules designed to target the SCADA systems
C.Use social engineering to trick a user into opening a malicious APK
D.Use a spearphishing campaign to trick a user into installing a RAT
B.Use Metasploit modules designed to target the SCADA systems
Explanation:
OBJ-2.5: A penetration tester can exploit supervisory control and data acquisition (SCADA) systems if they are within the engagement’s scope. While Metasploit was initially designed for engagements against workstations and servers, Metasploit has several modules in the exploit/ windows/scada category that target vendor-specific SCADA components running Windows. Many of these trigger a buffer overflow, though, so be careful when using them and ensure you have permission to exploit these devices in your written authorization.
During a penetration test, you conduct an exploit that creates a denial of service condition by crashing the httpd server. What should you do?
A.Contact the organizations customer service department and conduct further information gathering
B>Immediately contact the organization and inform them of the issue
C.Continue withj the exploitation
D.Pivot to another machine
B>Immediately contact the organization and inform them of the issue
Explanation:
OBJ-5.4: If at any point during an assessment, an issue arises due to your actions, then you should immediately stop exploitation and contact the trusted point of contact provided by the organization. You should not continue your exploitation or pivot to another machine. While you may contact the organization’s customer service department, you first need to verify if that is part of the allowed communication procedures outlined in the assessment plan. If you are conducting a red team event, the customer service team may be the target and not be informed of the issues directly. As a pentester, you should notify your trusted point of contact within the organization, per your approved test plan.
You are working as part of a penetration testing team targeting Dion Training's Linux-based network. You want to determine if you can crack the password on their remote authentication servers. Which of the following tools should you use? A.Mimikatz B.W3AF C.Medusa D.CeWL
C.Medusa
Explanation:
OBJ-4.2: Medusa is a command-line-based free password cracking tool often used in brute force password attacks on remote authentication servers. W3AF (Web Application Attack and Audit Framework) is a Python tool included in Kali Linux that tries to identify and exploit any web app vulnerabilities. CeWL is a ruby app that crawls websites to generate word lists for use with other password crackers. Mimikatz is an open-source tool that enables you to view credential information stored on Microsoft Windows computers.
You are analyzing a Linux server that you suspect has been tampered with by an attacker. You went to the terminal and typed ‘history’ into the prompt and see the output:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> echo 127.0.0.1 diontraining.com»_space; /etc/hosts
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Which of the following best describes what actions were performed by this line of code?
A.Added the website to the systems whitelist in the hosts file
B>Routed traffic destined for the localhost to the diontraining.com domain
C.Routed traffic destined for diontraining.com domain to the localhost
D.Attempted to overwrite the host file and deleted all data except this entry
C.Routed traffic destined for diontraining.com domain to the localhost
Explanation:
OBJ-3.5: Based on the output provided, it appears that the attacker has attempted to route all traffic destined for diontraining.com to the IP address specified (127.0.0.1). This is typically done to prevent a system from communicating with a specific domain to redirect a host to a malicious site. In this example, the IP/domain name pair of 127.0.0.1 and diontraining.com is being written to the /etc/hosts file. Modifying your hosts file enables you to override the domain name system (DNS) for a domain on a specific machine. The command echo»_space; redirects the output of the content on the left of the»_space; to the end of the file on the right of the»_space; symbol. If the > were used instead of»_space;, then this command would have overwritten the host file completely with this entry. The hosts file is not a system whitelist file.
During a penetration test, which of the following should you perform if your goal is to conduct a successful spear phishing attack?
A.Send targeted emails with a malicious attachment to the sales team
B.Send a targeted email with a malicious attachment to the organizations CEO
C.Send a test message with a malicious link to the organizations executives
D.Call the CTOs assistant using a pretext to gather information about their schedule
A.Send targeted emails with a malicious attachment to the sales team
Explanation:
OBJ-3.1: Spear phishing attacks are crafted to target a specific person or group of people. In this example, you are targeting the sales team with an email. This allows you to create an email that they are more likely to open based on the subject line and its content.
Annah is deploying a new application that she received from a vendor, but she is unsure if the hardware is adequate to support a large number of users during peak usage periods. What type of testing could Annah perform to determine if the application will support the required number of users? A.Regression testing B>Fuzz testing C.User acceptance testing D.Load testing
D.Load testing
Explanation:
OBJ-3.2: Load testing or stress testing puts an application, network, or system under full load conditions to document any performance lapses. User Acceptance Testing is the process of verifying that a created solution/software works for a user. Regression testing is defined as software testing to confirm that a recent program or code change has not adversely affected existing features. Fuzz testing, or fuzzing, is a quality assurance technique used to discover coding errors and security loopholes in software, operating systems, or networks. It involves inputting massive amounts of random data to the test subject to make it crash. User acceptance testing, regression testing, and fuzz testing are not designed to test a system under heavy load conditions. Therefore, they will not be suitable for Annah’s needs in this scenario.
You have been contracted to perform a remote scan of Dion Training's servers to determine if they comply with the company's software baseline. Which of the following types of scans should you conduct? A.Stealth scan B.Discovery scan C>Compliance scan D.Full scan
C>Compliance scan
Explanation:
OBJ-2.2: Compliance scanning verifies that a network adheres to certain policy requirements, such as a corporate baseline. These policies can be corporate, industry, or governmental regulations. In this scenario, you are asked to verify the servers comply with the company’s software baseline. Therefore, a compliance scan is the best option to select.
You are working as part of a DevSecOps team at Dion Training on a new practice exam web application. Which of the following tools should you utilize to scan the web application's database to determine if it is vulnerable to injection flaws? A.SQLMap B.Dirbuster C>Theharvester D.Kismet
A.SQLMap
Explanation:
OBJ-4.2: SQLmap is an open-source database scanner that searches for and exploits SQL injection flaws. This tool is included by default within Kali Linux. Dirbuster, Kismet, and Theharvester are not tools for conducting SQL vulnerability scans. Dirbuster is a brute force tool included with Kali Linux that exposes directories and file names on web and application servers. Kismet is an 802.11 Layer 2 wireless network detector, sniffer, and intrusion detection system included with Kali Linux that monitors wireless activity, identifies device types, and captures raw packets for later password cracking. Theharvester is an open-source intelligence tool (OSINT) that gathers information such as email addresses, subdomains, hostnames, open ports, and banners from publicly available sources.
You are analyzing a Python script that isn’t functioning properly. You suspect the issue is with the string manipulation being used in the code. Review the following Python code snippet:
-=-=-=-=-=- #!/usr/bin/python s = "DionTraining.com" print(s[-12:-7]) -=-=-=-=-=-
Based on your analysis, what should be displayed on the screen by the print command? A.Train B.nTrai C.oc..g D.moc
A.Train
Explanation:
OBJ-4.4: When evaluating the code s[-12:-7], you would receive “Train” in response. Within Python, characters in a string can be accessed by their index location. If the string (s) is “DionTraining.com”, then each letter from left to right is referenced as s[0] to s[15]. If you want to reference it from right to left, you simply use a negative number, such as s[-12:-7]. The format for the array is [start:end:increment], so s[-12:-7] is evaluated as starting with the 12th position from the right (T in DionTraining.com), count until it reaches the 7th position from the right, incrementing by the default value of 1 each time. This would display, from the end of the word, the 12th position (T), 11th position (i), 10th position (o), 9th position (i), and 8th position (T), and then stop. Note that when counting positions from the right, you begin counting at 1. When counting from the left, you start with position 0 and work up from there.
While conducting a penetration test against an organization, you gained access to the CEO’s account. You log in as the CEO and send the following email:
-=-=-=-=-=-=-
Subject: URGENT - Payment Required
Date: December 3, 2020 12:43 pm
From: “Jason Dion - CEO”
To: “Cristian Santiago - Financial Analyst”
Attachment: WiringInstructions.pdf
Cristian,
Please find the attached wiring instruction for the $15,425 payment to the cloud hosting provider.
This bill is showing as overdue, and payment MUST be transferred today. Please process ASAP.
Thanks,
Jason Dion, CEO
Dion Training Solutions, LLC
-=-=-=-=-=-=-
Which of the following attacks are you utilizing in this scenario? A.BEC Attack B.Deauthentication attack C.WHaling attack D.SMishing Attack
A.BEC Attack
Explanation:
OBJ-3.1: A business email compromise (BEC) is a form of elicitation where the attacker impersonates a high-level executive or directly takes over their email account. The attacker then sends an email to elicit personnel to take actions on their behalf. In this example, the attacker is impersonating the company’s CEO by sending an email to the financial personnel requesting they send a money transfer for what appears to be a legitimate service. This example also uses the urgency and authority motivation factors to convince the employee to take action.
A malicious user is blocking mobile devices from connecting to the Internet when other people are in the coffee shop. What is the malicious user performing? A.SPoofing B.Frequency jamming B.Blacklisting IP addresses in the ACL D.Man-in-the-Middle attack
B.Frequency jamming
Explanation:
OBJ-3.3: Frequency jamming is one of the many exploits used to compromise a wireless environment. It works by denying service to authorized users as legitimate traffic is jammed by the overwhelming frequencies of illegitimate traffic. There is no indication that the malicious user is creating a rogue AP (which is a form of spoofing) or performing a MITM attack by having users connect through their laptop or device. Also, there is no mention of certain websites or devices being blocked logically. Therefore there is no blacklisting of IP addresses performed.
Which of the following is the MOST important thing to receive from the client during the planning for an engagement? A.Key management policies B.Storage time for a report C.TOlerance to impact D.On-site versus off-site targets
C.TOlerance to impact
Explanation:
OBJ-1.3: The client’s tolerance to impact will allow the penetration test to balance the tasks to be performed in the assessment against real-world network utilization. If the client has a low tolerance to impact, then the assessment may be conducted on a cloned or a sandboxed version of the network or its applications. If the client has a high tolerance to impact, then they understand and agree that the penetration test may have real-world consequences to the production network during the assessment. This is usually based on the organization’s risk appetite.
A company has had several virus infections over the past few months. The cause was vulnerabilities in the software applications in use. What should an administrator implement to prevent future outbreaks? A.Host-based intrusion detection systems B.Patch management C>Incident response team D.Acceptable use policies
B.Patch management
Explanation:
OBJ-5.3: Since the viruses exploited known vulnerabilities, there should be patches available from the manufacturer/vendor. Based on this, proper patch management would prevent future outbreaks.
Which of the following attacks would most likely be used to create an inadvertent disclosure of information from an organization's database? A.Cross-site scripting B>SQL Injection C.Denial of service D.Buffer overflow
B>SQL Injection
Explanation:
OBJ-3.4: A SQL injection poses the most direct and more impactful threat to an organization’s database. A SQL injection could allow the attacker to execute remote commands on the database server and lead to sensitive information disclosure. A buffer overflow attack attempts to overwrite the memory buffer to send additional data into adjacent memory locations. A buffer overflow attack might target a database server, but it isn’t intended to disclose information directly. Instead, a buffer overflow attack may be used to gain initial access to a server and allow for other malicious code running. A denial of service targets the availability of the information by attempting to take the server offline. A cross-site scripting attack typically is focused on the user, not the server or database.
Windows file servers commonly hold sensitive files, databases, passwords, and more. What common vulnerability is usually used against a Windows file server to expose sensitive files, databases, and passwords? A.SQL Injection B>Cross-site scripting C.MIssing patches D.CRLF Injection
C.MIssing patches
Explanation:
OBJ-2.3: Missing patches are the most common vulnerability found on both Windows and Linux systems. When a security patch is released, attackers begin to reverse engineer the security patch to exploit the vulnerability. If your servers are not patched against the vulnerability, they can become victims of the exploit, and the server’s data can become compromised. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. Cross-site scripting focuses on exploiting a user’s workstation, not a server. CRLF injection is a software application coding vulnerability that occurs when an attacker injects a CRLF character sequence where it is not expected. SQL injection is the placement of malicious code in SQL statements via web page input. SQL is commonly used against databases, but they are not useful when attacking file servers.
You are conducting a wireless penetration test against an organization. During your reconnaissance, you discover that their network is known as "BigCorpWireless" has its SSID broadcast is enabled. You configure your laptop to respond to requests for connection to "BigCorpWireless" and park at the far end of the parking lot. At the end of the workday, as people get in their cars in the parking lot, you see numerous smartphones connecting to your laptop over WiFi. Which of the following exploits did you utilize? A.Downgrade attack B.Fragmentation attack C.Deauthentication attack D.Karma Attack
D.Karma Attack
Explanation:
OBJ-3.3: A karma attack is a variant of the evil twin attack. A karma attack exploits the behavior of a wireless client trying to connect to its preferred network list. This list contains the SSIDs of access points the device has connected to in the past. When a wireless device is looking to connect to the internet, it firsts beacons to determine if any of these previously connected to networks are within range. This allows an attacker to answer the request, allowing the user to connect to them instead as an evil twin. At this point, the attacker is now the man-in-the-middle between the wireless client and the internet, which is useful for many different exploits.
You have been contracted by Dion Training to conduct a penetration test against its learning management system (LMS). The LMS is a web application that is hosted in the organization's DMZ. Which of the following appliances should the organization whitelist your source IP in before the engagement begins? A.NIDS B.HIDS C.DLP D.WAF
D.WAF
Explanation:
OBJ-1.3: Whitelisting allows the IP address to be excluded from ACL rules and other signatures. This prevents an active device, like a web application firewall (WAF), layer 4 firewall, or an intrusion protection system (IPS) from blocking the penetration tester during the assessment. By having your IP added to the whitelist, you can focus your time and efforts on finding vulnerabilities with the servers themselves instead of trying to break through a compensating control like a WAF or IPS.
The physical security manager has asked you to assist with his risk assessment of his proposed security measures. He is concerned that during a power outage, the server room might be targeted for attack. Luckily, he has many different protection measures in place to keep intruders out of the server room. During a power outage, which of the following security controls would still be usable? A.Biometric scanners B.Door locks C.Motion detectors D.CCTV
B.Door locks
Explanation:
OBJ-3.6: A traditional door lock doesn’t require power to operate. Therefore, it will still protect the facility and keep the intruder out of the server room. The other options all require power to function and operate.
What techniques are commonly used by port and vulnerability scanners to identify the services running on a target system?
A.Banner grabbing and UDP response timing
B.Banner grabbing and comparing response fingerprints
C.Using the -O option in nmap and UDP response timing
D.COmparing response fingerprinting and registry scanning
B.Banner grabbing and comparing response fingerprints
Explanation:
OBJ-2.1: Service and version identification are often performed by conducting a banner grab or by checking responses for services to known fingerprints for those services. UDP response timing and other TCP/IP stack fingerprinting techniques are used to identify operating systems only. Using nmap -O will conduct an operating system fingerprint scan, but it will not identify the other services being run.
What programming language is most vulnerable to buffer overflow attacks? A.Swift B.Python C.C++ D.Java
C.C++
Explanation:
OBJ-3.4: Many memory manipulation functions in C and C++ do not perform bounds checking and can easily overwrite the allocated bounds of the buffers they operate upon. Newer languages like Python, Java, and Swift do a better job of protecting against a buffer overflow, but even they are not perfect.
While conducting a static analysis source code review of a program, you see the following line of code:
-=-=-=-=-=-=-
String query = “SELECT * FROM CUSTOMER WHERE CUST_ID=’” + request.getParameter(“id”) + “’”;
-=-=-=-=-=-=-
What is the issue with the largest security issue with this line of code?
A.The * operator will allow retrieval of every data field about this customer in the CUSTOMER table
B.The code is using parameterized queries
C.A SQL injection could occur because input validation is not being used on the id parameter
D.This code is vulnerable to a buffer overflow attack
C.A SQL injection could occur because input validation is not being used on the id parameter
Explanation:
OBJ-5.3: This code takes the input of “id” directly from a user or other program without conducting any input validation. This could be exploited and used as an attack vector for an SQL injection. If a malicious user can alter the ID source, it might get replaced with something like’ or ‘1’ =’1. This will cause the SQL statement to become: “SELECT * FROM CUSTOMER WHERE CUST_ID=’’ or ‘1’=’1’”. Because ‘1’ always equals ‘1’, the where clause will always return ‘true,’ meaning that EVERY record in the database could now become available to the attacker. When creating SQL statements, there are reasons for and against the use of the * operator. Its presence alone does not necessarily indicate a weakness. With only one line of code being reviewed, you cannot make any statement about whether it is vulnerable to a buffer overflow attack. You do not see the declaration values for the initialization of the id variable. This code is not using parameterized queries, but if it did, then it would eliminate this vulnerability. A parameterized query is a type of output encoding that relies on prepared statements to reduce the risk of an SQL injection
A security analyst is conducting a log review of the company’s web server and found two suspicious entries:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[12Nov2020 10:07:23] “GET /logon.php?user=test’+oR+7>1%20—HTTP/1.1” 200 5825
[12Nov2020 10:10:03] “GET /logon.php?user=admin’;%20—HTT{/1.1” 200 5845
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The analyst contacts the web developer and asks for a copy of the source code to the logon.php script. The script is as follows:
- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Based on source code analysis, which type of vulnerability is this web server vulnerable to? A.Command injection B.Directory traversal C.LDAP Injection D.SQL Injection
D.SQL Injection
Explanation:
OBJ-3.4: Based on the log entries, it appears the attack was successful in conducting a SQL injection. Notice the escape character (‘) used in the log. A connection to the MySQL database is being used in the script, which could be exploited since no input validation is being performed. Command injection is an attack in which the goal is to execute arbitrary commands on the host operating system via a vulnerable application. SQL injection is a specific type of command injection. LDAP injection is a code injection technique used to exploit web applications that could reveal sensitive user information or modify information represented in the LDAP (Lightweight Directory Access Protocol) data stores. Directory traversal or Path Traversal is an HTTP attack that allows attackers to access restricted directories and execute commands outside of the web server’s root directory.
You have been tasked to create some baseline system images to remediate vulnerabilities found in different operating systems. Before any of the images can be deployed, they must be scanned for malware and vulnerabilities. You must ensure the configurations meet industry-standard benchmarks and that the baselining creation process can be repeated frequently. What vulnerability option would BEST create the process requirements to meet the industry-standard benchmarks?
A.Utilizing an operating system SCAP plugin
B.Utilizing a non-credential scan
C.Utilizing an authorized credential scan
D.Utilizing a known malware plugin
A.Utilizing an operating system SCAP plugin
Explanaition:
OBJ-2.2: Security Content Automation Protocol (SCAP) is a multi-purpose framework of specifications supporting automated configuration, vulnerability and patch checking, technical control compliance activities, and security measurement. It is an industry-standard and support testing for compliance. The other options will not allow for a truly repeatable process since individual scans would occur each time instead of comparing against a known good baseline.
What should a vulnerability report include if a cybersecurity analyst wants it to reflect the assets scanned accurately? A.Organized governance B.Processor utilization C.Virtual hosts D.Log disposition
C.Virtual hosts
Explanation:
OBJ-2.2: Vulnerability reports should include both the physical hosts and the virtual hosts on the target network. A common mistake of new cybersecurity analysts is to include physical hosts, thereby missing many network assets.
Which of the following types of encryption would ensure the best security of a website? A.TLS B.SSLv1 C.SSLv3 D.SSLv2
A.TLS
Explanation:
OBJ-5.3: Transport Layer Security (TLS) is a widely adopted security protocol designed to facilitate privacy and data security for communications over the internet. A primary use case of TLS is encrypting the communication between web applications and servers, such as web browsers loading a website. TLS was developed in 1999 as SSLv3.1, but its name was changed to separate itself from Netscape, who developed the original SSL protocol. Because of this history, the terms TLS and SSL are often used interchangeably. Secure Socket Layer uses three versions: SSLv1, SSLv2, and SSLv3. All of these versions of SSL are considered obsolete and insecure.
You are analyzing the vulnerability scanning results from a recent web vulnerability scan in preparation for the exploitation phase of an upcoming assessment. A portion of the scan results is shown below.
Which exploit is the website vulnerable to based on the results?
A.Cookie manipulation
B.SQL Injection
C.Local file inclusion
D.XSS
D.XSS
Explanation:
OBJ-2.3: Cross-site scripting exploits a vulnerability with a malicious script injected into a trusted website and then downloaded and executed by a user’s browser. In this scan result, you can see that the parameter for the name that was posted included some javascript (onload, this.src). This result shows that this site is vulnerable to a cross-site scripting attack.
You are working as part of a penetration testing team targeting Dion Training’s webserver. You want to determine if you can expose any directories or file names on the webserver. Which of the following tools should you use?
A.Mimikatz
B.Dirbuster
C.IDA
D.CeWL
B.Dirbuster
Explanation:
OBJ-4.2: Dirbuster uses brute force to expose directories and file names on web and application servers. CeWL is a ruby app that crawls websites to generate word lists for use with other password crackers. Mimikatz is an open-source tool that enables you to view credential information stored on Microsoft Windows computers. IDA (Interactive Disassembler) is a reverse-engineering tool that generates source code from machine code for Windows, Mac OS X, and Linux applications.
