PEN-200 Practice Test 12 — 15 Questions

Question 1

You are testing an e-commerce application that uses a cookie named 'sessionid' to maintain authenticated sessions. The application sets this cookie without the HttpOnly attribute, and you have identified a reflected XSS vulnerability in the product search feature. Which of the following attack methods would allow you to steal the session cookie and hijack an authenticated user's session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inject a script that reads document.cookie and sends it to an attacker-controlled server.. When a session cookie lacks the HttpOnly attribute, client-side JavaScript can access it through document.cookie. A reflected XSS vulnerability allows an attacker to inject and execute arbitrary script in the victim's browser, which can then read the cookie and exfiltrate it. The stolen session identifier can be used to impersonate the authenticated user. Other attacks like redirects, fake forms, or CSRF do not directly steal the cookie.

Answer

Inject a script that calls window.location = 'https://attacker.com' to redirect the user.

Answer

Inject a script that triggers a CSRF request to change the user's password.

Answer

Inject a script that modifies the DOM to display a fake login form.

Question 2

During an internal assessment you receive a scope that lists a /24 subnet but explicitly forbids any traffic that could cause service disruption. You need to identify live hosts and open TCP ports while keeping the scan as quiet and non-intrusive as possible. Which single Nmap invocation best matches these constraints?

Accepted Answer

nmap -sS -T2 --top-ports 100 10.10.10.0/24. Balancing reconnaissance depth against a no-disruption clause requires a scan that avoids full TCP connections, throttles its own packet rate, and limits the port set. A half-open SYN scan with conservative timing and a small top-ports list achieves host discovery plus meaningful TCP port enumeration without stressing services. Full-range or high-rate scans and UDP sweeps either overload targets or answer a different question than the one asked.

Answer

nmap -sS -T4 -p- 10.10.10.0/24

Answer

nmap -sn 10.10.10.0/24

Answer

nmap -sU -T4 --min-rate 5000 10.10.10.0/24

Question 3

During an internal assessment, you find a public exploit for a Jenkins script console vulnerability. The exploit sends a Groovy script to /script via a POST request. When you run it, the server returns HTTP 403. The Jenkins version matches the vulnerable range, and the endpoint is reachable. Which is the MOST likely reason the exploit fails?

Accepted Answer

The exploit requires an authenticated session, and the request is being rejected due to missing or invalid credentials.. Jenkins protects the script console with authentication and authorization. Even on a vulnerable version, an unauthenticated request to /script is rejected with 403 before any Groovy executes. The exploit must include a valid session or API token belonging to a user with administrative rights. Version matching alone does not bypass access controls.

Answer

The target uses HTTPS and the exploit is sending plaintext HTTP requests to port 8080.

Answer

The Groovy script contains syntax errors that Jenkins rejects at parse time.

Answer

The Groovy payload is blocked by a Web Application Firewall rule matching common reverse-shell strings.

Question 4

You are testing a web application that uses a MySQL database. You suspect a UNION-based SQL injection in the 'id' parameter of a product page. The page displays product names and descriptions. Which two steps are necessary to successfully extract data using a UNION attack? (Choose two.)

Accepted Answer

Determine the number of columns in the original query using ORDER BY or UNION SELECT.. A successful UNION-based SQL injection requires matching the number of columns in the original query and identifying which columns are reflected in the response. These steps allow the attacker to craft a UNION SELECT that returns data in visible fields. Other techniques like time-based injection or file privileges are unrelated to UNION extraction and are not necessary for this scenario.

Answer

Ensure the database user has FILE privileges to read data from the filesystem.

Answer

Use a time-based injection to confirm the vulnerability before attempting UNION.

Answer

Encode the payload using base64 to bypass web application firewalls.

Question 5

During a penetration test, you need to enumerate DNS records for the domain `example.com` to find subdomains and mail servers. Which command should you use to perform a zone transfer attempt?

Accepted Answer

`dig axfr @ns1.example.com example.com`. The `dig axfr` command is the direct way to request a zone transfer from a name server. It targets the specific DNS server and domain, and if the server allows transfers, it returns the full zone file. Other commands may perform DNS queries but do not explicitly request a zone transfer.

Answer

`nslookup -type=any example.com`

Answer

`host -l example.com ns1.example.com`

Answer

`dnsenum --enum example.com`

Question 6

You are performing a penetration test on a web application that uses a PHP session cookie. You notice the cookie lacks the HttpOnly flag. An attacker could exploit this by injecting a script that steals the cookie. Which attack technique is most directly enabled by the missing HttpOnly flag?

Accepted Answer

Cross-Site Scripting (XSS) cookie theft. The HttpOnly flag prevents client-side scripts from accessing the cookie, mitigating XSS-based session theft. Without it, an XSS vulnerability can be used to read the session cookie and hijack the user's session. CSRF, session fixation, and SQL injection are separate issues not directly enabled by the absence of HttpOnly. Thus, XSS cookie theft is the most direct attack technique enabled by this misconfiguration.

Answer

Session fixation

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL injection

Question 7

You are performing web enumeration against a target application and want to discover hidden directories, backup files, and administrative interfaces that are not linked from the visible pages. Which two approaches are most appropriate for this goal? (Choose two.)

Accepted Answer

Inspect the robots.txt and sitemap.xml files for disallowed or listed paths.. Discovering unlinked web content requires either actively probing candidate paths with a wordlist-driven tool or harvesting the metadata files administrators use to guide crawlers. Content discovery tools test many paths and interpret responses, while robots.txt and sitemap.xml often expose restricted or sensitive directories directly. Passive search operators, port scans, and a single root request all fail to reveal paths that are not linked or already indexed.

Answer

Use the search engine operator site:target.com to enumerate internal directories.

Answer

Send a single HTTP GET request to the web root and review the returned status code.

Answer

Perform a full TCP port scan of the web server to reveal application directories.

Question 8

During a web application assessment, you identify a blind SQL injection vulnerability in a cookie parameter. The backend database is PostgreSQL. You want to determine the first character of the database name using a time-based injection. Which of the following payloads would correctly test if the first character is 'p' by causing a 5-second delay?

Accepted Answer

'; SELECT CASE WHEN (SELECT SUBSTRING(current_database(),1,1)='p') THEN pg_sleep(5) ELSE pg_sleep(0) END; --. Time-based blind SQL injection on PostgreSQL requires using the pg_sleep function. The payload uses a CASE statement to conditionally execute pg_sleep(5) if the first character of the current database name is 'p'. This causes a 5-second delay, allowing the attacker to infer the character. The other options use syntax from MySQL or SQL Server, which are incompatible with PostgreSQL.

Answer

'; SELECT CASE WHEN (SELECT SUBSTRING(current_database(),1,1)='p') THEN BENCHMARK(5000000,MD5(1)) ELSE 0 END; --

Answer

'; SELECT CASE WHEN (SELECT SUBSTRING(database(),1,1)='p') THEN SLEEP(5) ELSE SLEEP(0) END; --

Answer

'; IF (SELECT SUBSTRING(current_database(),1,1)='p') WAITFOR DELAY '0:0:5' --

Question 9

During a PEN-200 lab engagement you locate a public exploit for a web application running on the target. The exploit's banner string is 'Mozilla/5.0' and the script appends the payload to a URL parameter. Before running it against the target, which action best reduces the risk of unintended side effects on the production web service?

Accepted Answer

Review the exploit's HTTP request construction and test it against a local instance of the same application version.. Examining how the exploit builds its HTTP request and replaying it against a matching local instance is the only approach that both reveals the payload's behavior and prevents production impact. Local reproduction lets the tester observe success or failure and confirm the exploit is appropriate before touching the live service, which is the safe validation workflow emphasized in PEN-200.

Answer

Increase the exploit's timeout value to ensure the request completes fully before you observe the result.

Answer

Change the target URL to a non-existent host so the exploit exits early, then redirect it to the real target.

Answer

Run the exploit with a --safe flag if the script supports it, then immediately run it against the target.

Question 10

You download a public exploit from Exploit-DB for a known vulnerability in a web application. Before running it against a client's production server, which action is the MOST appropriate next step?

Accepted Answer

Review the exploit's source code to understand its actions and test it in a lab environment first.. Public exploits are not inherently trustworthy. Reviewing the source reveals destructive actions, unexpected network callbacks, or hidden backdoors, and lab testing validates behavior safely. Only after understanding the exploit should it be considered for use against a production target, consistent with professional and OSCP-aligned methodology.

Answer

Run the exploit immediately because Exploit-DB entries are verified by OffSec.

Answer

Ask the client to disable their antivirus so the exploit runs without interference.

Answer

Submit the exploit to VirusTotal to confirm it is not malicious, then run it.

Question 11

During a Linux privilege escalation assessment, you discover that the current user can run `/usr/bin/find` via sudo without a password. You execute `sudo find /home -exec /bin/bash \;`. What is the outcome?

Accepted Answer

A root shell is spawned because sudo runs find as root, and -exec executes /bin/bash with root privileges.. When a user is allowed to run find with sudo, they can leverage the -exec action to execute arbitrary commands as root. Because the entire find process runs with root privileges, any command spawned by -exec inherits those privileges. This allows an attacker to spawn a root shell, achieving privilege escalation.

Answer

A root shell is spawned because find's -exec runs the command as the invoking user, not root.

Answer

The command fails because find does not allow -exec to run shell commands.

Answer

A root shell is spawned only if the current user is a member of the sudo group.

Question 12

You are performing a penetration test against a web application that uses a Linux backend. You discover a file inclusion vulnerability in the 'page' parameter: 'index.php?page=home.php'. You attempt to include '/etc/passwd' using path traversal, but the application appends '.php' to the input. You try 'page=../../../../etc/passwd%00' but the null byte is blocked. Which of the following techniques is most likely to allow you to read the '/etc/passwd' file?

Accepted Answer

Use a PHP filter wrapper: 'page=php://filter/convert.base64-encode/resource=/etc/passwd'. The php://filter wrapper allows reading files by applying filters. Using convert.base64-encode encodes the file content, which is then returned in the response. This bypasses the .php extension append because the wrapper is specified as the resource, and the server includes the filtered stream. This technique is effective for reading sensitive files like /etc/passwd when file inclusion is present.

Answer

Use a zip wrapper: 'page=zip:///tmp/shell.jpg%23shell.php'

Answer

Use a data wrapper: 'page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4='

Answer

Use a path traversal with a trailing slash: 'page=../../../../etc/passwd/'

Question 13

You are enumerating a Windows host and have obtained valid low-privilege domain credentials. You want to identify which systems in the domain the account can access administratively, so you can plan lateral movement. Which approach most efficiently maps that access?

Accepted Answer

Use CrackMapExec or NetExec with the credentials to test administrative access across the domain.. Mapping administrative access requires testing authorization, not just reachability or inventory. Credentialed tools such as CrackMapExec and NetExec authenticate to each host and report whether the supplied account holds administrative rights, typically by performing a privileged action. Port scans only show that SMB is listening, directory queries only list computers, and packet capture observes rather than tests, so none of those alternatives directly answers where the low-privilege account can move laterally.

Answer

Query the domain controller with ldapsearch for all computer objects and their operating systems.

Answer

Capture network traffic on the domain controller to observe authentication events.

Answer

Run a full TCP port scan of every host in the domain to find open port 445.

Question 14

You are testing a Java web application that stores user-supplied SVG avatars. The application sanitizes SVG files by stripping `<script>` tags, then serves them from the same origin with `Content-Type: image/svg+xml`. When a victim views another user's profile, the browser renders the SVG inline. Which technique most reliably achieves script execution in the victim's session despite the sanitizer?

Accepted Answer

Use the SVG `` element with an `onbegin` event handler that calls `alert(document.domain)` when the animation starts.. SVG is an XML format that supports SMIL animation and event attributes, so stripping only `

Answer

Encode `<script>` as `<scr&#x69;pt>` so the sanitizer's regex fails to match the tag but the browser still parses it as script.

Answer

Embed a JavaScript URL in an SVG `<a xlink:href="javascript:alert(document.domain)">` element that the victim must click.

Answer

Insert an external `<image href="https://attacker.example/evil.svg">` reference that loads a second SVG containing the payload.

Question 15

You are developing an exploit for a Windows 32-bit application with a stack buffer overflow. You have identified a JMP ESP instruction at a static address. However, the application uses SafeSEH. Which statement is true regarding the use of JMP ESP in this scenario?

Accepted Answer

JMP ESP can still be used if the address is in a module not compiled with SafeSEH.. SafeSEH is a mitigation for SEH overwrites, not for return address overwrites. If you are overwriting the saved return address, you can still use a JMP ESP gadget from a module that is not SafeSEH-protected. The presence of SafeSEH does not prevent this technique, as it only validates exception handlers when an exception occurs.

Answer

SafeSEH encrypts the JMP ESP instruction, making it unusable.

Answer

You must use a POP POP RET sequence instead of JMP ESP to bypass SafeSEH.

Answer

JMP ESP will not work because SafeSEH validates all addresses on the stack, including the return address.