Network And Perimeter Exploitation

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

An elite penetration tester is conducting network reconnaissance behind a restrictive stateful firewall that drops anomalous TCP flag combinations. Which THREE Nmap scan types are most likely to fail or receive unreliable results because they rely on non-standard TCP flag combinations? (Choose THREE)

A penetration tester is evaluating network security controls and wants to check for insecure or plaintext authentication protocols in use across the network. Which TWO protocols transmit credentials or session tokens in cleartext and can be easily sniffed? (Choose TWO)

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

During an assessment of an enterprise network, you discover an insecure Server Message Block (SMB) configuration. You want to enumerate network shares and user accounts using enum4linux without triggering account lockout policies through brute-force methods. Which underlying protocol implementation does enum4linux primarily leverage to query Windows and Samba hosts for granular domain information?

You are performing a penetration test against a network segment where direct outbound TCP connections are blocked by a strict firewall, but outbound DNS queries over UDP port 53 to an external DNS server are permitted. To tunnel traffic out of this restricted environment, which tool allows you to encapsulate arbitrary TCP traffic within DNS queries?

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

When pivoting through a compromised Windows system during an internal engagement, you need to enumerate active TCP and UDP network connections, listening ports, and associated routing tables using native operating system binaries. Which THREE of the following commands or tools native to Windows can be used to gather this network enumeration data?

During an assessment of network perimeter services, you discover a misconfigured Simple Network Management Protocol (SNMP) daemon running on a core router. Which THREE of the following tools or Metasploit auxiliary modules can be leveraged to enumerate sensitive information such as running processes, network interfaces, and routing tables via SNMP?