GPEN Flashcards — Free GIAC Penetration Tester Study Cards

Weak algorithms allow rapid recovery of passwords once a breach occurs.

Even with a strong password policy, an organization remains vulnerable if the hashing algorithm is cryptographically broken or lacks proper salting. A weak algorithm like MD5 or NTLM allows attackers to crack even complex passwords almost instantaneously using modern hardware. Evaluating the hashing implementation ensures that the organization is protected against offline attacks, providing a necessary layer of defense that policies alone cannot guarantee if the underlying data storage mechanism is compromised.

The NTHash, because it is the primary hash used by NTLM authentication.

Modern Windows systems prioritize NTLM authentication, which relies on the NTHash. The LM hash is deprecated, weak, and often stored as a null value or a fixed constant in modern systems. Targeting the NTHash allows for pass-the-hash attacks or brute-force attempts that align with the underlying authentication protocol. Understanding the structure of these hashes is crucial for penetration testers to select the correct dictionary or mask attack strategies during local account auditing.

Utilize TCP SYN ping (-PS) on common service ports.

Nmap's TCP SYN ping (-PS) is highly effective because it sends a small SYN packet to specified ports, like 80 or 443, which are typically open or acknowledged by firewalls. This bypasses ICMP filters while mimicking legitimate traffic. Understanding how to circumvent basic perimeter defenses is critical for penetration testers to ensure comprehensive discovery without alerting security systems that monitor for common ICMP-based scanning patterns or heavy traffic floods.

sessions -i

The 'sessions' command is the primary method for managing active connections within Metasploit. Once an exploit establishes a payload, the session moves to the background. Using 'sessions -i <id>' connects the user to the specific meterpreter shell, enabling post-exploitation activities. This is crucial for maintaining persistence and executing lateral movement tasks in a penetration test, as it allows the operator to toggle between multiple compromised targets effectively.

Create a dedicated service account with granular WMI and remote registry permissions.

Using dedicated, low-privilege service accounts with specific WMI and registry permissions minimizes the blast radius if credentials are intercepted. This approach adheres to the principle of least privilege, preventing the scanner from having full domain administrator access, which could be abused if the scanning server is compromised. Effective vulnerability management relies on deep system visibility without granting excessive authority to the scanning service.

Kerberoasting targets the service account's password hash by requesting a TGS, not by leveraging existing NTLM hashes.

Kerberoasting requires requesting a Service Ticket (TGS) from the Key Distribution Center (KDC) for a specific Service Principal Name (SPN). The attacker then extracts the encrypted TGS blob from memory or network traffic to crack the service account's password offline. The NTLM hash is a separate credential format; having it allows for Pass-the-Hash or silver ticket creation, but does not involve the KDC-based SPN request process required for Kerberoasting.

To identify publicly exposed sensitive files or directories.

Google Dorks are advanced search operators that allow testers to find sensitive information inadvertently indexed by search engines. This is a powerful form of passive reconnaissance that requires no interaction with the target infrastructure. By finding publicly exposed configuration files, logs, or login portals, testers can gain valuable intelligence. Mastering these operators is a fundamental skill for finding 'low hanging fruit' that often gets overlooked by automated scanning tools.

Implementing Domain Generation Algorithms (DGA). / Utilizing cloud providers for domain fronting.

Resilient C2 infrastructure often relies on decentralized or dynamic components to ensure that the connection remains viable even if individual nodes are identified and blocked. By utilizing domain generation algorithms and cloud-based relay services, attackers create a moving target that is difficult for incident responders to fully dismantle in a timely manner. Mastery of these techniques is essential for assessing the robust nature of an organization's defense-in-depth posture.

Exploitation

This scenario demonstrates the execution of arbitrary code, which is the core of the exploitation phase. Exploitation is the process of leveraging a vulnerability to gain unauthorized access or control over a target system. Understanding this transition from vulnerability discovery to exploitation is critical for testers to effectively assess the impact of security flaws and demonstrate real-world risk to stakeholders during the assessment reporting phase.

Compromise of the private signing key allows for the creation of unauthorized authentication tokens.

The token-signing certificate is the foundation of trust in a federated environment. If an attacker compromises the private key of this certificate, they can forge SAML tokens for any user in the directory. This bypasses Multi-Factor Authentication and allows for complete identity impersonation, making the protection of the AD FS server and its associated secrets a critical objective for both defenders and attackers.

Place a malicious binary at the first detected space-delimited path segment.

Unquoted service paths exist when the service binary path contains spaces and lacks quotes. Windows interprets the path incorrectly, searching for intermediate executables. Placing a malicious binary at the identified path allows it to execute with SYSTEM privileges upon service restart. This technique is critical for privilege escalation as it exploits inherent Windows path resolution logic, often bypassing standard user restrictions if the directory has weak permissions.

External collaboration settings for Guest user access restrictions.

By default, Microsoft Entra ID allows guest users to see other users and groups in the directory. This is a common reconnaissance vector for attackers to map the organization's structure. Restricting this access is a critical step in hardening the tenant, ensuring that guest identities have limited visibility into the internal organizational structure during an initial compromise.

Modify the PATH variable to point to a malicious directory.

When a binary calls a command without an absolute path, it relies on the PATH environment variable to locate the executable. By modifying the PATH to include a directory under the attacker's control, the attacker can place a malicious executable with the same name as the target command. This forces the SUID binary to execute the malicious file instead of the intended system utility, resulting in command execution as the owner.

secretsdump.py

Impacket's secretsdump.py is the industry standard for parsing NTDS.dit files and SYSTEM hives to extract domain credentials. It leverages the boot key stored in the SYSTEM hive to decrypt the encrypted hashes within the NTDS.dit database. Understanding this process is critical for penetration testers because it represents the most common method of achieving domain-wide compromise after gaining the necessary domain controller files.

Discovery phases consume disproportionate time, leaving insufficient hours for the deep manual analysis required to uncover logic flaws.

Black-box testing forces testers to spend the majority of the engagement on reconnaissance and basic discovery rather than deep vulnerability analysis. To effectively evaluate complex business logic flaws, testers require white-box or gray-box scoping with documentation and credentials to achieve adequate depth within standard assessment timeframes.