PenTest+ concepts

Question 1

Which tools are used for password cracking?

Answer 1

• Hydra
• John the Ripper

Question 2

What tool is used for SQL injection attacks?

Answer 2

• Sqlmap

Question 3

What tool is used to automate exploit development and execution against a vulnerable target system?

Answer 3

• Metasploit is a framework used for developing and executing exploits against remote targets.

Question 4

What technique is best to maintain access to a compromised system after a reboot or if the initial exploit is closed?

Answer 4

• Setting up a cron job is a common post-exploitation technique used to maintain persistence by ensuring a reverse shell or another method of access is re-established at regular intervals.

Question 5

What techniques are useful for covering tracks or gaining further access?

Answer 5

• Clear system logs
• Escalate privileges
• Use PsExec for lateral movement

Question 6

What are the types of Nmap commands?

Answer 6

• -sV = Displays open ports to determine service and version running [i.e. Operating system (OS) of a target]
• -PA = Sends only a TCP ACK ping command and not wait for the echo request
• -sU = Displays UDP ports that are open [DNS, SNMP, and DHCP]. UDP are slower than TCP ports
• -PS = Discovers open ports by sending out only TCP SYN ping
• -Pn = Foregoes host discovery and will assume all hosts are online [useful if host appears offline]
• -O = Fingerprints an OS of a device [to target vulnerabilities based on OS]
• -a = Used for OS detection, version detection, script scanning, and traceroute
• -PR = Used to gather MAC addresses by doing an ARP ping
• -ST = Nmap switch that does a TCP connect scan

Question 7

If you see a “../” in a question, what is the most likely answer?

Answer 7

• Directory Traversals
• Local file inclusion

Question 8

How can you identify a Cross-site scripting attack on a question?

Answer 8

• A log snippet or captured URLs that have the script or any kind of JavaScript inside
• If you see “Like document.cookie” or “document.write” it is a DOM-based Cross-site Scripting Attack

Question 9

If you see a “‘OR 1=1” in a question, what is the most likely answer?

Answer 9

• SQL injection

Question 10

How do you prevent an SQL injection?

Answer 10

• Input validation
• Web application firewall