PEN-200 Client-Side Attacks — 15 Questions

Question 1

Refer to the exhibit. ```html ``` What type of client-side attack vector is demonstrated in this JavaScript code snippet?

Accepted Answer

Client-side Cross-Site Scripting exfiltration of internal web resources accessible to the victim browser. This code demonstrates Cross-Site Scripting combined with Cross-Origin Resource Sharing or intranet pivoting. The malicious script executes in the victim browser, requests a sensitive internal resource that the victim has access to, and exfiltrates the response text to an external attacker-controlled server.

Answer

SQL Injection extraction via asynchronous database polling loops

Answer

Server-Side Request Forgery via backend proxy manipulation

Answer

Cross-Site Request Forgery payload designed to modify state without reading responses

Question 2

You are reviewing a web application that implements Cross-Origin Resource Sharing (CORS). The server responds with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true. Why is this specific combination considered a severe security misconfiguration?

Accepted Answer

It allows any external website to make authenticated cross-origin requests and read sensitive response data from the victim session. Allowing any origin via the wildcard combined with credential sharing violates browser security rules and exposes the application to cross-site data theft. While modern browsers reject the wildcard when credentials are requested, misconfigured server implementations reflecting arbitrary origins pose severe risks.

Answer

It causes the web server to crash due to recursive header evaluation loops in the CORS parsing middleware

Answer

It automatically upgrades all incoming HTTP connections to encrypted TLS connections without requiring redirects

Answer

It permanently disables the Same-Origin Policy for all users globally across the entire internet domain

Question 3

You are performing a penetration test and successfully inject a script into a user's session via a stored XSS vulnerability. To capture the session cookie even when the 'HttpOnly' flag is enabled, which technique is most effective?

Accepted Answer

Pivot to a CSRF attack to execute unauthorized actions on behalf of the authenticated victim.. The 'HttpOnly' flag specifically prevents client-side scripts from accessing cookies via document.cookie. In such scenarios, an attacker cannot steal the session cookie directly through XSS. The only viable path is to perform an action that leverages the user's active session, such as CSRF or forcing the user to perform unauthorized administrative actions, rather than attempting to extract the protected cookie data.

Answer

Send an AJAX request to document.cookie to bypass the browser's HttpOnly security restriction.

Answer

Inject a hidden iframe that reloads the page to force the server to reveal the cookie in the DOM.

Answer

Use an XMLHttpRequest to perform a cross-origin request to read the response headers of the server.

Question 4

Which TWO of the following conditions are required to execute a successful Cross-Site Request Forgery (CSRF) attack against a target application?

Accepted Answer

The victim must be authenticated to the target application at the time of the attack.. CSRF succeeds when an application relies solely on ambient credentials like cookies for session management without verifying the intent of the request. The attacker must provide a link or script that the victim executes while authenticated. Because the browser automatically attaches cookies, the server processes the forged request as legitimate, which is why anti-CSRF tokens or SameSite cookie attributes are critical defenses against these exploitation attempts.

Answer

The attacker must be able to read the response from the server to extract the CSRF token.

Answer

The attacker must possess the victim's session cookie to successfully forge the request.

Answer

The target application must be vulnerable to reflective XSS on the login page.

Question 5

You have identified a reflected XSS vulnerability in a search parameter. The application implements a Content Security Policy (CSP). Which CSP directive, if configured, would most effectively prevent your XSS payload from executing script tags?

Accepted Answer

script-src 'self'; object-src 'none'. The 'script-src' directive is the primary CSP mechanism for controlling the execution of JavaScript. By restricting script sources to 'self' or specific trusted domains, and prohibiting 'unsafe-inline', the browser will refuse to execute any script tags injected via reflected XSS. This defense works by checking the origin of the script, ensuring only authorized code is run within the user's browser context.

Answer

default-src 'none'; img-src 'self'

Answer

frame-ancestors 'none'

Answer

connect-src 'self'

Question 6

Which THREE actions should a penetration tester perform to manually verify a suspected DOM-based XSS vulnerability?

Accepted Answer

Inject a benign payload like 'alert(document.domain)' into the URL fragment.. Verifying DOM XSS requires tracking the data flow from an input source to a dangerous execution sink. By using browser developer tools to inspect the DOM, monitoring the JavaScript console for execution errors, and using the debugger to trace variable values, a tester can confirm if their injected payload is being processed unsafely by the application's own scripts without ever needing to interact with the back-end server.

Answer

Analyze the server's HTTP response to see if the payload is reflected in the HTML.

Answer

Modify the server-side source code to remove input validation routines.

Question 7

During an authorized penetration test, you must deliver a malicious payload to a Windows user over the internal network. You have already obtained NetNTLMv2 hashes via a poisoned LLMNR response and now want to relay those credentials to a host that does not enforce SMB signing. Which Metasploit module is specifically designed to relay captured SMB credentials to a target host and execute a payload?

Accepted Answer

exploit/windows/smb/smb_relay. The SMB relay attack requires a module that accepts incoming SMB authentication and forwards it to a target host to execute code. The Metasploit smb_relay module is purpose-built for this relay, provided SMB signing is not enforced on the target. The other options either only capture hashes, exploit a different vulnerability, or perform LLMNR poisoning, none of which accomplish the relay.

Answer

exploit/windows/smb/ms17_010_eternalblue

Answer

auxiliary/spoof/llmnr/llmnr_response

Answer

auxiliary/server/capture/smb

Question 8

You are conducting a client-side attack against a Windows domain user. After sending a malicious link, you capture the user's NetNTLMv2 hash. You now want to crack this hash offline to recover the plaintext password. Which tool is specifically designed to perform this type of password cracking and supports the NetNTLMv2 hash format?

Accepted Answer

John the Ripper with the --format=netntlmv2 option. To crack a captured NetNTLMv2 hash offline, you need a tool that supports the hash format. John the Ripper with the --format=netntlmv2 option is specifically designed for this purpose. Hashcat can also crack NetNTLMv2 with mode 5600, but the question emphasizes a tool that directly handles the format; John the Ripper is a classic choice. Responder captures hashes, and Mimikatz extracts credentials from memory, neither cracks hashes offline.

Answer

Hashcat with the -m 5600 mode

Answer

Mimikatz with the sekurlsa::logonpasswords command

Answer

Responder with the -w flag

Question 9

You are performing a client-side attack against a Windows 10 workstation. The target user has Microsoft Office 2016 installed and macro execution is disabled via Group Policy. You need to execute arbitrary code when the user opens a weaponized document. Which technique is most likely to succeed?

Accepted Answer

Embed a Dynamic Data Exchange (DDE) payload in a Word document that prompts the user to enable content.. Dynamic Data Exchange (DDE) allows a document to execute commands without using VBA macros, bypassing Group Policy that disables macros. When the user opens the document and approves the prompt, the DDE payload runs. This technique is a classic client-side attack for macro-restricted environments.

Answer

Use a malicious .lnk file that executes a PowerShell one-liner when double-clicked.

Answer

Use a malicious Excel 4.0 (XLM) macro embedded in a .xlsm file.

Answer

Deliver a malicious .docm file with a VBA macro that uses AutoOpen().

Question 10

During a penetration test, you want to exploit a client-side vulnerability to steal sensitive data from a user's browser. You identify a web application that uses postMessage to communicate with an iframe. The application does not validate the origin of incoming messages. Which technique would best allow you to intercept and read the messages sent by the application to the iframe?

Accepted Answer

Host a malicious page that embeds the vulnerable application in an iframe and listens for postMessage events.. The best technique is to host a malicious page that embeds the vulnerable application in an iframe and listens for postMessage events. Since the application does not validate the origin of incoming messages, it may send sensitive data to the malicious page. The malicious page can then capture that data. This exploits the missing origin check without needing network interception or additional vulnerabilities.

Answer

Inject a keylogger into the application using a stored XSS vulnerability to capture keystrokes.

Answer

Use a man-in-the-middle proxy to intercept and modify the postMessage traffic between the application and the iframe.

Answer

Perform a DNS rebinding attack to bypass same-origin policy and read the iframe's content.

Question 11

During an authorized penetration test, you need to deliver a client-side payload to a target user via a phishing email. The payload must execute without user interaction beyond opening the email attachment. Which file format is most likely to achieve this on a fully patched Windows 10 system with default settings?

Accepted Answer

A .hta file that runs a script when opened.. HTA files are executed by mshta.exe and can run script immediately upon opening, often with only a single user action. They remain a viable client-side attack vector on fully patched Windows 10 systems, making them suitable for phishing delivery where minimal interaction is required.

Answer

A .pdf file with embedded JavaScript.

Answer

A .lnk file that points to a malicious executable.

Answer

A .docx file containing a malicious macro.

Question 12

During an authorized penetration test, you want to perform a client-side attack by delivering a malicious HTA file via a phishing email. Which technique is most effective to execute native commands silently when the user opens the file?

Accepted Answer

Using mshta.exe to process a VBScript payload embedded within the HTA container to spawn a reverse shell. HTA files execute via mshta.exe, allowing VBScript or JScript integration to run operating system commands directly without standard browser security sandboxes. This makes HTA files highly effective for initial access vectors during social engineering engagements when users trust and run local executables.

Answer

Embedding the HTA inside a standard PDF document using an external URI scheme pointing to a remote script

Answer

Hosting the HTA file on an Apache web server with a fake mime-type configuration forcing automatic execution

Answer

Converting the HTA payload into a malicious shortcut (.lnk) file that calls PowerShell with hidden window arguments

Question 13

You are analyzing a target web application that reflects user input directly into an HTML attribute without proper sanitization. Which vulnerability class should you primarily investigate for exploitation?

Accepted Answer

Cross-Site Scripting (XSS). Reflected Cross-Site Scripting occurs when untrusted user input is immediately processed and returned by a web application in an unsafe context, such as within an HTML attribute. Identifying this flaw allows attackers to craft malicious URLs that execute arbitrary JavaScript in the victim browser.

Answer

SQL Injection

Answer

Remote Code Execution

Answer

Cross-Site Request Forgery

Question 14

During a web application assessment, you discover that the application allows users to upload profile pictures. The server saves these files with their original extensions in a publicly accessible directory. What is the most effective client-side risk associated with this misconfiguration?

Accepted Answer

Execution of Stored Cross-Site Scripting when a victim user navigates directly to the uploaded SVG or HTML file. Allowing arbitrary file uploads without strict extension validation enables attackers to upload malicious HTML or SVG files containing embedded JavaScript. When another user visits the direct URL of the uploaded file, the browser renders the content, leading to Stored Cross-Site Scripting.

Answer

Direct execution of native ELF binaries on the underlying Linux web server operating system

Answer

Immediate compromise of the backend database via automated SQL injection through the filename

Answer

Bypassing network perimeter firewalls through encapsulated ICMP tunneling inside the image metadata

Question 15

You are conducting a client-side attack using a weaponized Microsoft Office document containing a malicious VBA macro. Which user interaction and application setting combination is required for the macro to execute successfully by default?

Accepted Answer

The user must click 'Enable Content' in the security banner after the file opens in Protected View. By default, modern Microsoft Office applications block macros in files obtained from the internet using Office Protected View and Antimalware Scan Interface integrations. Users must explicitly click 'Enable Content' in the Security Warning banner after opening the file for the VBA code to run.

Answer

The user must double-click the document while holding down the Shift key to bypass AutoOpen restrictions

Answer

The file must be saved in the local startup directory and the user must open the application normally

Answer

The target workstation must have macro auditing disabled via Group Policy Objects before execution