PEN-200 Practice Test 5 — 25 Questions

Question 1

You are testing a Java-based web application that uses the Spring framework. The application has an endpoint /api/users/{id} that returns user details in JSON. When you request /api/users/123, you receive your own details. You then request /api/users/124 and receive another user's details. The application uses a session cookie but does not implement any role-based checks on this endpoint. What is the MOST appropriate next step to demonstrate the impact of this vulnerability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enumerate a range of user IDs to identify administrative accounts and retrieve their sensitive information.. The endpoint lacks authorization checks, allowing any authenticated user to access other users' details by changing the user ID. This is an IDOR vulnerability. The most direct way to demonstrate impact is to enumerate IDs to find sensitive accounts, such as administrators, and retrieve their information. Other attacks like SQL injection or XSS are not indicated by the scenario and would not directly prove the IDOR.

Answer

Perform a cross-site scripting attack by injecting a script into the user details that are reflected back.

Answer

Attempt to inject SQL payloads into the id parameter to extract the entire database.

Answer

Use the session cookie to perform a session fixation attack and hijack an administrator's session.

Question 2

During exploitation of a stack-based buffer overflow on a 32-bit Windows application, you overwrite EIP with the address of a JMP ESP instruction, but the shellcode does not execute. You verify the JMP ESP address is correct and that the shellcode is in memory. Which of the following is the most likely cause?

Accepted Answer

The shellcode contains null bytes, which terminate the string copy and prevent the full shellcode from being placed on the stack.. Null bytes in shellcode are a frequent problem when exploiting buffer overflows in string-based functions. Functions like strcpy or sprintf treat null bytes as string terminators, so any null byte in the shellcode will cause the copy to stop prematurely. As a result, the shellcode on the stack will be incomplete, and even with a correct JMP ESP, execution will fail. Therefore, ensuring shellcode is free of null bytes or properly encoded is essential. This is a common pitfall in Windows exploit development.

Answer

The JMP ESP instruction address contains a null byte, which prevents it from being written correctly to EIP.

Answer

The shellcode is encoded, and the decoder stub is missing, so it cannot execute.

Answer

The JMP ESP instruction is located in a memory region with the DEP (Data Execution Prevention) flag set.

Question 3

You are fuzzing a Linux x86-64 network service and cause a segmentation fault. You run the binary under GDB and see that the instruction pointer is 0x41414141. However, the crash address is in a non-executable stack region. Which technique should you use to redirect execution to your shellcode?

Accepted Answer

Use a ret2libc attack to call system() with a pointer to "/bin/sh".. When the stack is non-executable, direct shellcode execution fails. The ret2libc technique bypasses this by reusing existing executable code, typically calling functions like system() with controlled arguments. This is a standard method taught in PEN-200 for defeating NX, provided you can locate the necessary addresses and gadgets.

Answer

Use a heap spray to place shellcode in a predictable location and jump to it.

Answer

Overwrite the return address with a pointer to the stack and rely on the NX bit being disabled.

Answer

Increase the size of the buffer to overwrite the saved return address with a stack address.

Question 4

A penetration tester is building a custom shellcode runner in C for a PEN-200 lab. The compiled loader is being flagged by static analysis before execution. The tester wants to modify the loader's source so the resulting binary is less likely to match signatures, without changing the shellcode's behavior. Which two changes best serve this goal? (Choose two.)

Accepted Answer

Encrypt the embedded shellcode with a simple XOR key and decrypt it in memory before execution.. Static analysis of the loader is driven by recognizable shellcode bytes and a suspicious import table. XOR-encrypting the shellcode removes its signature-matching bytes from disk, and resolving APIs dynamically with LoadLibrary and GetProcAddress removes telltale imports like VirtualAlloc and VirtualProtect. Optimization, static runtime linking, and padding change size or dependencies but leave the shellcode bytes and imported APIs that triggered detection in place.

Answer

Statically link the C runtime library so the loader has fewer external dependencies.

Answer

Add a large embedded PNG image resource to increase the binary's file size.

Answer

Compile the loader with the /O2 optimization flag to reduce the binary's overall size.

Question 5

You are attempting to escalate privileges on a Windows target and decide to exploit unquoted service paths. You find a service with the binary path `C:\Program Files\My App\service.exe` and the service is running as LocalSystem. Which condition must be true for this unquoted path to be exploitable?

Accepted Answer

A directory like `C:\Program.exe` or `C:\Program Files\My.exe` must be writable by your user, and the service must restart.. For an unquoted service path to be exploitable, a writable directory must exist in the search order before the intended executable, such as `C:\Program.exe` or `C:\Program Files\My.exe`. When the service starts, Windows will execute the first found executable from that path. If you can place a malicious binary in a writable location and the service restarts, you gain code execution as the service account.

Answer

The service must be configured to run as a domain user with a weak password that can be cracked.

Answer

The service must have the `SeImpersonatePrivilege` enabled for the LocalSystem account.

Answer

The directory `C:\Program Files\My App` must have Modify permissions for the Everyone group.

Question 6

You are conducting a penetration test and have obtained a list of usernames. You want to perform a password spray against an OWA (Outlook Web Access) portal. Which tool is specifically designed to automate password spraying against OWA while respecting lockout policies?

Accepted Answer

MailSniper. MailSniper is a dedicated tool for attacking Exchange and OWA environments. Its `Invoke-PasswordSprayOWA` cmdlet automates the process of trying a single password against multiple OWA accounts while allowing the tester to specify a delay to avoid lockouts. This specialization makes it more effective and safer than generic brute-force tools like Hydra or Medusa, which are not tailored for OWA. CrackMapExec does not support OWA, so MailSniper is the correct choice.

Answer

Hydra

Answer

Medusa

Answer

CrackMapExec

Question 7

During an authorized penetration test, a tester needs to deliver a Meterpreter payload to a Windows Server 2019 target that runs a next-generation antivirus with behavioral monitoring. The tester decides to use a process injection technique to run the payload inside a legitimate process. Which injection method is LEAST likely to be flagged by behavioral monitoring because it avoids allocating new executable memory in the target process?

Accepted Answer

Module stomping by overwriting the .text section of a loaded DLL with shellcode.. Module stomping avoids allocating new executable memory by reusing the existing .text section of a loaded DLL. Since the memory is already executable and associated with a legitimate module, it bypasses detection logic that looks for new PAGE_EXECUTE_READWRITE allocations or suspicious thread creation. Other injection methods require allocating or modifying executable memory in ways that behavioral monitoring commonly correlates with malicious activity, making them more likely to be flagged.

Answer

Process hollowing by creating a suspended process and replacing its image.

Answer

Thread execution hijacking by suspending a thread and modifying its context to point to shellcode.

Answer

Classic CreateRemoteThread with VirtualAllocEx and WriteProcessMemory.

Question 8

A tester is preparing a reverse shell executable for a Windows target protected by a signature-based antivirus product. To reduce the chance the file is flagged, the tester wants to modify the binary so it no longer matches known signatures while keeping its behavior. Which action best accomplishes this?

Accepted Answer

Recompile the source after renaming functions and adding benign junk instructions, then rebuild the binary.. Signature-based detection compares file bytes against known patterns derived from code, strings, and embedded payloads. Altering the source so the compiled binary's byte sequence changes, such as renaming functions and inserting junk instructions, breaks that match while preserving functionality. Metadata edits, directory changes, and privilege elevation leave the underlying bytes intact, so the original signature continues to identify the file.

Answer

Run the executable with administrator privileges so it can bypass user-level scanning hooks.

Answer

Move the executable from the Downloads folder to a less commonly scanned directory such as C:\Temp.

Answer

Change the file's icon and version information resource to mimic a legitimate application.

Question 9

You are enumerating a Linux target and discover that TCP port 2049 is open. You run `showmount -e 192.168.1.100` and see that the `/home` directory is exported to everyone. What is the most significant security risk this configuration presents?

Accepted Answer

An attacker can mount the share and read or modify any user's home directory files, potentially leading to privilege escalation.. An NFS export to everyone allows any attacker to mount the share without authentication, gaining read and write access to the /home directory. This can lead to theft of SSH keys, modification of scripts, or insertion of malicious code, ultimately enabling privilege escalation or lateral movement. The other options either describe unrelated vulnerabilities or less severe impacts.

Answer

The NFS service is vulnerable to a buffer overflow that allows remote code execution.

Answer

An attacker can use the NFS share to perform a denial-of-service attack by filling the disk.

Answer

The NFS share allows anonymous FTP access to the same directory.

Question 10

You download a public exploit for a known vulnerability from an untrusted source. Before running it against a client's production system, what is the most important action to take?

Accepted Answer

Review the exploit's source code to understand its actions and check for malicious payloads.. Reviewing the exploit's source code is the most important step because it reveals exactly what the code will execute. Permission and sandboxing are valuable but secondary to understanding the code, which protects both the client and the tester from unintended consequences.

Answer

Check the exploit's file hash against online databases to confirm it is known.

Answer

Run the exploit in a sandboxed virtual machine first to see if it works.

Answer

Ask the client for permission to run the exploit on their production system.

Question 11

You are performing a password spraying attack against an Active Directory environment. To avoid locking out accounts, which TWO of the following practices should you follow? (Choose two.)

Accepted Answer

Use a single password attempt per account per lockout window.. Password spraying avoids lockouts by limiting attempts per account. Using a single attempt per lockout window and monitoring the lockout policy are both critical. Attempting multiple passwords per account or using large password lists increases lockout risk. Targeting only never-logged-in accounts is irrelevant to lockout avoidance. Thus, the correct practices are to use one attempt per window and to monitor the policy.

Answer

Use a large list of common passwords for each account.

Answer

Attempt multiple passwords per account in quick succession.

Answer

Target only accounts that have never logged in.

Question 12

You are reviewing a public exploit for a Linux-based web application. The exploit is a Python script that uses a hardcoded offset to overwrite a return address, and it includes a comment stating it was tested on a specific kernel version. Your target runs a different kernel but the same application version. After running the exploit, the service crashes but no shell is obtained. Which action is the MOST appropriate next step?

Accepted Answer

Modify the exploit's offset to match the target's kernel by debugging the crash and calculating the correct offset.. A crash with no shell typically means the offset to the return address is wrong for the target's memory layout. Debugging the crash to find the correct offset and updating the exploit is the precise, minimal fix. This preserves the working parts of the exploit and directly addresses the kernel-dependent difference.

Answer

Recompile the target's kernel to match the version the exploit was tested on.

Answer

Search for a different public exploit that targets the same application version but is written in a different language.

Answer

Assume the exploit is unreliable and discard it, then attempt to exploit a different service on the target.

Question 13

During an authorized penetration test of a PHP e-commerce site, you discover that the 'remember me' cookie is created with the following code: setcookie('auth', base64_encode($user_id . ':' . $role), time()+2592000); The cookie value is 'MTIzNDp1c2Vy'. You decode it to '123:user'. The application trusts this cookie for authentication on subsequent requests. What is the MOST direct way to escalate privileges to administrator?

Accepted Answer

Modify the cookie value to base64_encode('123:admin') and set it in your browser.. The cookie contains base64-encoded user ID and role with no signature or encryption. Decoding reveals the format, allowing an attacker to change the role to 'admin' and re-encode. The application trusts the cookie for authorization, so this directly escalates privileges. Other methods like SQL injection or CSRF are not indicated by the scenario and would not be as straightforward.

Answer

Brute-force the base64-encoded cookie to discover the administrator's session identifier.

Answer

Use SQL injection on the login form to extract the administrator password hash.

Answer

Perform a cross-site request forgery (CSRF) attack to change the administrator's password.

Question 14

While mapping a subnet you want to discover live hosts quickly before running detailed service scans. Which approach best fits an initial host-discovery sweep?

Accepted Answer

Run an ICMP echo sweep combined with TCP SYN probes to common ports to identify responsive hosts.. Effective host discovery layers ICMP echo with TCP SYN probes to common ports, because many systems disable ping replies while still exposing services. This combination surfaces more live hosts faster than any single method, producing an accurate target list. Full port scans, single-port UDP probes, and ARP cache reads are either too slow, too unreliable, or too incomplete for an initial sweep.

Answer

Query the local ARP cache and enumerate only the entries already present.

Answer

Send UDP probes to port 53 on every address and treat any reply as proof of a live host.

Answer

Perform a full TCP connect scan of all ports against every address in the subnet range.

Question 15

You are assessing a web application that uses a relational database backend. During manual testing, you suspect a UNION-based SQL injection vulnerability in a product category parameter. Which two of the following steps are necessary to successfully extract data using a UNION-based SQL injection attack? (Choose two.)

Accepted Answer

Determine the number of columns returned by the original query.. UNION-based SQL injection requires matching the number of columns in the original query and finding columns that can display string data. These two steps allow the attacker to craft a valid UNION SELECT statement that returns additional data in the application's response. Without knowing the column count, the query will fail; without string-compatible columns, extracted data may not be visible. Other steps like encoding or time delays are not necessary for this attack type.

Answer

Encode the payload using Base64 to bypass web application firewalls.

Answer

Ensure the database user has file write privileges to create a web shell.

Answer

Use a time delay function to confirm the vulnerability before extracting data.

Question 16

You are testing an e-commerce application that uses a cookie named 'sessionid' to maintain authenticated sessions. The application sets this cookie without the HttpOnly attribute, and you have identified a reflected XSS vulnerability in the product search feature. Which of the following attack methods would allow you to steal the session cookie and hijack an authenticated user's session?

Accepted Answer

Inject a script that reads document.cookie and sends it to an attacker-controlled server.. When a session cookie lacks the HttpOnly attribute, client-side JavaScript can access it through document.cookie. A reflected XSS vulnerability allows an attacker to inject and execute arbitrary script in the victim's browser, which can then read the cookie and exfiltrate it. The stolen session identifier can be used to impersonate the authenticated user. Other attacks like redirects, fake forms, or CSRF do not directly steal the cookie.

Answer

Inject a script that calls window.location = 'https://attacker.com' to redirect the user.

Answer

Inject a script that triggers a CSRF request to change the user's password.

Answer

Inject a script that modifies the DOM to display a fake login form.

Question 17

During an internal assessment you receive a scope that lists a /24 subnet but explicitly forbids any traffic that could cause service disruption. You need to identify live hosts and open TCP ports while keeping the scan as quiet and non-intrusive as possible. Which single Nmap invocation best matches these constraints?

Accepted Answer

nmap -sS -T2 --top-ports 100 10.10.10.0/24. Balancing reconnaissance depth against a no-disruption clause requires a scan that avoids full TCP connections, throttles its own packet rate, and limits the port set. A half-open SYN scan with conservative timing and a small top-ports list achieves host discovery plus meaningful TCP port enumeration without stressing services. Full-range or high-rate scans and UDP sweeps either overload targets or answer a different question than the one asked.

Answer

nmap -sS -T4 -p- 10.10.10.0/24

Answer

nmap -sn 10.10.10.0/24

Answer

nmap -sU -T4 --min-rate 5000 10.10.10.0/24

Question 18

During an internal assessment, you find a public exploit for a Jenkins script console vulnerability. The exploit sends a Groovy script to /script via a POST request. When you run it, the server returns HTTP 403. The Jenkins version matches the vulnerable range, and the endpoint is reachable. Which is the MOST likely reason the exploit fails?

Accepted Answer

The exploit requires an authenticated session, and the request is being rejected due to missing or invalid credentials.. Jenkins protects the script console with authentication and authorization. Even on a vulnerable version, an unauthenticated request to /script is rejected with 403 before any Groovy executes. The exploit must include a valid session or API token belonging to a user with administrative rights. Version matching alone does not bypass access controls.

Answer

The target uses HTTPS and the exploit is sending plaintext HTTP requests to port 8080.

Answer

The Groovy script contains syntax errors that Jenkins rejects at parse time.

Answer

The Groovy payload is blocked by a Web Application Firewall rule matching common reverse-shell strings.

Question 19

You are testing a web application that uses a MySQL database. You suspect a UNION-based SQL injection in the 'id' parameter of a product page. The page displays product names and descriptions. Which two steps are necessary to successfully extract data using a UNION attack? (Choose two.)

Accepted Answer

Determine the number of columns in the original query using ORDER BY or UNION SELECT.. A successful UNION-based SQL injection requires matching the number of columns in the original query and identifying which columns are reflected in the response. These steps allow the attacker to craft a UNION SELECT that returns data in visible fields. Other techniques like time-based injection or file privileges are unrelated to UNION extraction and are not necessary for this scenario.

Answer

Ensure the database user has FILE privileges to read data from the filesystem.

Answer

Use a time-based injection to confirm the vulnerability before attempting UNION.

Answer

Encode the payload using base64 to bypass web application firewalls.

Question 20

During a penetration test, you need to enumerate DNS records for the domain `example.com` to find subdomains and mail servers. Which command should you use to perform a zone transfer attempt?

Accepted Answer

`dig axfr @ns1.example.com example.com`. The `dig axfr` command is the direct way to request a zone transfer from a name server. It targets the specific DNS server and domain, and if the server allows transfers, it returns the full zone file. Other commands may perform DNS queries but do not explicitly request a zone transfer.

Answer

`nslookup -type=any example.com`

Answer

`host -l example.com ns1.example.com`

Answer

`dnsenum --enum example.com`