Qs Flashcards
PenTest For Dummies
You are preparing to perform a penetration test for a customer. What type of document does the customer typically have the penetration tester sign before the penetration test begins?
(A) Authorization letter
(B) Service-level agreement
(C) Non-disclosure agreement
(D) Master service agreement
C. Customers should have penetration testers sign a non-disclosure agreement (NDA) before starting the penetration test.
See Chapter 2.
PenTest For Dummies
You are performing a penetration test for a large customer. You are using Nmap to determine the ports that are open on the target systems. What phase of the penetration testing process are you currently on?
(A) Reporting and communication
(B) Attacks and exploits
(C) Planning and scoping
(D) Information gathering and vulnerability identification
D. The information gathering and vulnerability identification phase uses tools to discover systems, services running on those systems, and vulnerabilities that exist on those systems.
See Chapter 1
PenTest For Dummies
Which of the following penetration tools are considered OSINT tools? (Choose two.)
(A) Nmap
(B) Recon-ng
(C) Hydra
(D) Metasploit
(E) Maltego
B, E. Recon-ng and Maltego are examples of OSINT tools used to discover public information about a customer.
See Chapter 3.
PenTest For Dummies
You are in the discovery phase of a penetration test and would like to do a port scan on the network, but not perform a ping operation with the port scan. What Nmap switch would you use to disable pings with the port scan?
(A) -Pn
(B) -p
(C) -sP
(D) -sT
A. You can use the -Pn parameter on Nmap to disable ping operations when performing a port scan.
See Chapter 3.
PenTest For Dummies
You are looking to discover vulnerabilities on a group of systems that are target systems for your penetration test. What tools would you use to identify vulnerabilities in the systems? (Choose two.)
(A) OpenVAS
(B) Nessus
(C) Hydra
(D) Metasploit
(E) Nmap
A, B. OpenVAS and Nessus are examples of vulnerability scanners that can be used to discover vulnerabilities on a system.
See Chapter 4.
PenTest For Dummies
During a penetration test you are looking to perform a MiTM attack. Which of the following tools would you use to perform the attack?
(A) Hydra
(B) Metasploit
(C) arpspoof
(D) John
C. arpspoof is an example of a tool that can be used during a MiTM attack. arpspoof is used to poison the ARP cache of systems so that the attacker can place themselves in the middle of the communication.
See Chapter 5.
PenTest For Dummies
You are performing a penetration test on a wireless network. You would like to deauthenticate the clients from the access point. What tool would you use?
(A) Aircrack-ng
(B) Aireplay-ng
(C) Airodump-ng
(D) Deauth-ng
B. Aireplay-ng is a tool used to generate different types of wireless traffic, including a deauthentication packet that is used to instruct clients to disconnect.
See Chapter 6.
PenTest For Dummies
While performing a penetration test on a wireless network, you decide to try to brute force the WPS pin on the wireless access point. What command would you use in Kali Linux?
(A) aircrack-ng
(B) mimikatz
(C) reaver
(D) wpscrack-ng
C. Reaver is a command-line tool in Kali Linux that allows you to perform a brute force attack on the WPS pin.
See Chapter 6.
PenTest For Dummies
You are assessing the security of a web application running on a web server within the DMZ. Which of the following represents an example of a command injection attack?
(A) http://site/showData.php?id=1;phpinfo()
(B) http://site/purchase.aspx?redirect=confirmation.aspx
(C) http://site/prodt.php?id=5;update%20products%20set%20price=.50
(D) http://site/showData.php?dir=%3Bcat%20/etc/passwd
D. When looking at the URL that is used in the attack, you want to identify what is being injected. Choice D is injecting the cat command from the operating system so it is considered a command-injection attack.
See Chapter 7.
PenTest For Dummies
You are performing a penetration test for a customer and have exploited a system and gained a meterpreter session. What post-exploitation command was used to obtain the following output?
Admin:500:b45a8125648cbddf2c4272c:bddf2c4272cb45a8125648cGuest:501:b45a8125648cbddf2c4272c:bddf2c4272cb45a8125648ctestUser:1024:b45a8125648cbddf2c4272c:bddf2c4272cb45a8125648c
(A) hashdump
(B) hydra
(C) kill av
(D) truncate
A. The hashdump command is used during post-exploitation to retrieve a list of password hashes that can then be used in other attacks such as password cracking or a pass-the-hash attack.
See Chapter 8.
PenTest For Dummies
You are assessing the security of a web application. What tool would you use to identify vulnerabilities on a website?
(A) SQLdict
(B) Nmap
(C) Nikto
(D) Hydra
C. Nikto is an example of a web application vulnerability scanner.
See Chapter 9.
PenTest For Dummies
You have obtained the password hash for the administrator account on a system. What tool would you use to crack the password hash?
(A) Hashdump
(B) Nmap
(C) Aircrack-ng
(D) Hashcat
D. Hashcat is a command-line tool in Kali Linux that can be used to crack the password hash.
See Chapter 9.
PenTest For Dummies
During an authorized penetration test, you have used Nmap to locate systems on the network running RDP. What command would you use to perform password cracking using RDP traffic to the system?
(A) mimikatz
(B) hashcat
(C) hydra
(D) hashdump
C. Hydra is a tool used to crack passwords and can be used to crack passwords of a remote system using protocols such as RDP.
See Chapter 9.
PenTest For Dummies
What language was used to write the following code?
startTime = datetime.now()
try:
` for port in range(1,1024):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
result = sock.connect_ex((remoteSystemIP, port))
if result == 0:
print “Port {}: Open”.format(port)
sock.close()`
(A) PowerShell
(B) Python
(C) Ruby
(D) Bash
B. You can tell that the script was created in Python because of the comparison operator being used (==). PowerShell and Bash use -eq as the comparison operator. Also notice the use of the print statement (instead of echo) and the fact variables do not use $ in front of them.
See Chapter 10.
PenTest For Dummies
While performing a penetration test for a customer, you notice there is evidence of a previous security compromise on the web server. What should you do?
(A) Make a note of it and continue the pentest
(B) Continue the pentest and add evidence to the report
(C) Patch the system and continue the pentest
(D) Halt the pentest and discuss the findings with the stakeholder
D. If you notice evidence that a system has been hacked into already, you should halt the penetration test and discuss the finding with the stakeholders right away.
See Chapter 11.
