PEN-200 Client-Side Attacks — Timed 25 Questions

Question 1

Refer to the exhibit. ```html ``` What type of client-side attack vector is demonstrated in this JavaScript code snippet?

Accepted Answer

Client-side Cross-Site Scripting exfiltration of internal web resources accessible to the victim browser. This code demonstrates Cross-Site Scripting combined with Cross-Origin Resource Sharing or intranet pivoting. The malicious script executes in the victim browser, requests a sensitive internal resource that the victim has access to, and exfiltrates the response text to an external attacker-controlled server.

Answer

SQL Injection extraction via asynchronous database polling loops

Answer

Server-Side Request Forgery via backend proxy manipulation

Answer

Cross-Site Request Forgery payload designed to modify state without reading responses

Question 2

You are reviewing a web application that implements Cross-Origin Resource Sharing (CORS). The server responds with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true. Why is this specific combination considered a severe security misconfiguration?

Accepted Answer

It allows any external website to make authenticated cross-origin requests and read sensitive response data from the victim session. Allowing any origin via the wildcard combined with credential sharing violates browser security rules and exposes the application to cross-site data theft. While modern browsers reject the wildcard when credentials are requested, misconfigured server implementations reflecting arbitrary origins pose severe risks.

Answer

It causes the web server to crash due to recursive header evaluation loops in the CORS parsing middleware

Answer

It automatically upgrades all incoming HTTP connections to encrypted TLS connections without requiring redirects

Answer

It permanently disables the Same-Origin Policy for all users globally across the entire internet domain

Question 3

You are performing a penetration test and successfully inject a script into a user's session via a stored XSS vulnerability. To capture the session cookie even when the 'HttpOnly' flag is enabled, which technique is most effective?

Accepted Answer

Pivot to a CSRF attack to execute unauthorized actions on behalf of the authenticated victim.. The 'HttpOnly' flag specifically prevents client-side scripts from accessing cookies via document.cookie. In such scenarios, an attacker cannot steal the session cookie directly through XSS. The only viable path is to perform an action that leverages the user's active session, such as CSRF or forcing the user to perform unauthorized administrative actions, rather than attempting to extract the protected cookie data.

Answer

Send an AJAX request to document.cookie to bypass the browser's HttpOnly security restriction.

Answer

Inject a hidden iframe that reloads the page to force the server to reveal the cookie in the DOM.

Answer

Use an XMLHttpRequest to perform a cross-origin request to read the response headers of the server.

Question 4

Which TWO of the following conditions are required to execute a successful Cross-Site Request Forgery (CSRF) attack against a target application?

Accepted Answer

The victim must be authenticated to the target application at the time of the attack.. CSRF succeeds when an application relies solely on ambient credentials like cookies for session management without verifying the intent of the request. The attacker must provide a link or script that the victim executes while authenticated. Because the browser automatically attaches cookies, the server processes the forged request as legitimate, which is why anti-CSRF tokens or SameSite cookie attributes are critical defenses against these exploitation attempts.

Answer

The attacker must be able to read the response from the server to extract the CSRF token.

Answer

The attacker must possess the victim's session cookie to successfully forge the request.

Answer

The target application must be vulnerable to reflective XSS on the login page.

Question 5

You have identified a reflected XSS vulnerability in a search parameter. The application implements a Content Security Policy (CSP). Which CSP directive, if configured, would most effectively prevent your XSS payload from executing script tags?

Accepted Answer

script-src 'self'; object-src 'none'. The 'script-src' directive is the primary CSP mechanism for controlling the execution of JavaScript. By restricting script sources to 'self' or specific trusted domains, and prohibiting 'unsafe-inline', the browser will refuse to execute any script tags injected via reflected XSS. This defense works by checking the origin of the script, ensuring only authorized code is run within the user's browser context.

Answer

default-src 'none'; img-src 'self'

Answer

frame-ancestors 'none'

Answer

connect-src 'self'

Question 6

Which THREE actions should a penetration tester perform to manually verify a suspected DOM-based XSS vulnerability?

Accepted Answer

Inject a benign payload like 'alert(document.domain)' into the URL fragment.. Verifying DOM XSS requires tracking the data flow from an input source to a dangerous execution sink. By using browser developer tools to inspect the DOM, monitoring the JavaScript console for execution errors, and using the debugger to trace variable values, a tester can confirm if their injected payload is being processed unsafely by the application's own scripts without ever needing to interact with the back-end server.

Answer

Analyze the server's HTTP response to see if the payload is reflected in the HTML.

Answer

Modify the server-side source code to remove input validation routines.

Question 7

During an authorized penetration test, you must deliver a malicious payload to a Windows user over the internal network. You have already obtained NetNTLMv2 hashes via a poisoned LLMNR response and now want to relay those credentials to a host that does not enforce SMB signing. Which Metasploit module is specifically designed to relay captured SMB credentials to a target host and execute a payload?

Accepted Answer

exploit/windows/smb/smb_relay. The SMB relay attack requires a module that accepts incoming SMB authentication and forwards it to a target host to execute code. The Metasploit smb_relay module is purpose-built for this relay, provided SMB signing is not enforced on the target. The other options either only capture hashes, exploit a different vulnerability, or perform LLMNR poisoning, none of which accomplish the relay.

Answer

exploit/windows/smb/ms17_010_eternalblue

Answer

auxiliary/spoof/llmnr/llmnr_response

Answer

auxiliary/server/capture/smb

Question 8

You are conducting a client-side attack against a Windows domain user. After sending a malicious link, you capture the user's NetNTLMv2 hash. You now want to crack this hash offline to recover the plaintext password. Which tool is specifically designed to perform this type of password cracking and supports the NetNTLMv2 hash format?

Accepted Answer

John the Ripper with the --format=netntlmv2 option. To crack a captured NetNTLMv2 hash offline, you need a tool that supports the hash format. John the Ripper with the --format=netntlmv2 option is specifically designed for this purpose. Hashcat can also crack NetNTLMv2 with mode 5600, but the question emphasizes a tool that directly handles the format; John the Ripper is a classic choice. Responder captures hashes, and Mimikatz extracts credentials from memory, neither cracks hashes offline.

Answer

Hashcat with the -m 5600 mode

Answer

Mimikatz with the sekurlsa::logonpasswords command

Answer

Responder with the -w flag

Question 9

You are performing a client-side attack against a Windows 10 workstation. The target user has Microsoft Office 2016 installed and macro execution is disabled via Group Policy. You need to execute arbitrary code when the user opens a weaponized document. Which technique is most likely to succeed?

Accepted Answer

Embed a Dynamic Data Exchange (DDE) payload in a Word document that prompts the user to enable content.. Dynamic Data Exchange (DDE) allows a document to execute commands without using VBA macros, bypassing Group Policy that disables macros. When the user opens the document and approves the prompt, the DDE payload runs. This technique is a classic client-side attack for macro-restricted environments.

Answer

Use a malicious .lnk file that executes a PowerShell one-liner when double-clicked.

Answer

Use a malicious Excel 4.0 (XLM) macro embedded in a .xlsm file.

Answer

Deliver a malicious .docm file with a VBA macro that uses AutoOpen().

Question 10

During a penetration test, you want to exploit a client-side vulnerability to steal sensitive data from a user's browser. You identify a web application that uses postMessage to communicate with an iframe. The application does not validate the origin of incoming messages. Which technique would best allow you to intercept and read the messages sent by the application to the iframe?

Accepted Answer

Host a malicious page that embeds the vulnerable application in an iframe and listens for postMessage events.. The best technique is to host a malicious page that embeds the vulnerable application in an iframe and listens for postMessage events. Since the application does not validate the origin of incoming messages, it may send sensitive data to the malicious page. The malicious page can then capture that data. This exploits the missing origin check without needing network interception or additional vulnerabilities.

Answer

Inject a keylogger into the application using a stored XSS vulnerability to capture keystrokes.

Answer

Use a man-in-the-middle proxy to intercept and modify the postMessage traffic between the application and the iframe.

Answer

Perform a DNS rebinding attack to bypass same-origin policy and read the iframe's content.

Question 11

During an authorized penetration test, you need to deliver a client-side payload to a target user via a phishing email. The payload must execute without user interaction beyond opening the email attachment. Which file format is most likely to achieve this on a fully patched Windows 10 system with default settings?

Accepted Answer

A .hta file that runs a script when opened.. HTA files are executed by mshta.exe and can run script immediately upon opening, often with only a single user action. They remain a viable client-side attack vector on fully patched Windows 10 systems, making them suitable for phishing delivery where minimal interaction is required.

Answer

A .pdf file with embedded JavaScript.

Answer

A .lnk file that points to a malicious executable.

Answer

A .docx file containing a malicious macro.

Question 12

During an authorized penetration test, you want to perform a client-side attack by delivering a malicious HTA file via a phishing email. Which technique is most effective to execute native commands silently when the user opens the file?

Accepted Answer

Using mshta.exe to process a VBScript payload embedded within the HTA container to spawn a reverse shell. HTA files execute via mshta.exe, allowing VBScript or JScript integration to run operating system commands directly without standard browser security sandboxes. This makes HTA files highly effective for initial access vectors during social engineering engagements when users trust and run local executables.

Answer

Embedding the HTA inside a standard PDF document using an external URI scheme pointing to a remote script

Answer

Hosting the HTA file on an Apache web server with a fake mime-type configuration forcing automatic execution

Answer

Converting the HTA payload into a malicious shortcut (.lnk) file that calls PowerShell with hidden window arguments

Question 13

You are analyzing a target web application that reflects user input directly into an HTML attribute without proper sanitization. Which vulnerability class should you primarily investigate for exploitation?

Accepted Answer

Cross-Site Scripting (XSS). Reflected Cross-Site Scripting occurs when untrusted user input is immediately processed and returned by a web application in an unsafe context, such as within an HTML attribute. Identifying this flaw allows attackers to craft malicious URLs that execute arbitrary JavaScript in the victim browser.

Answer

SQL Injection

Answer

Remote Code Execution

Answer

Cross-Site Request Forgery

Question 14

During a web application assessment, you discover that the application allows users to upload profile pictures. The server saves these files with their original extensions in a publicly accessible directory. What is the most effective client-side risk associated with this misconfiguration?

Accepted Answer

Execution of Stored Cross-Site Scripting when a victim user navigates directly to the uploaded SVG or HTML file. Allowing arbitrary file uploads without strict extension validation enables attackers to upload malicious HTML or SVG files containing embedded JavaScript. When another user visits the direct URL of the uploaded file, the browser renders the content, leading to Stored Cross-Site Scripting.

Answer

Direct execution of native ELF binaries on the underlying Linux web server operating system

Answer

Immediate compromise of the backend database via automated SQL injection through the filename

Answer

Bypassing network perimeter firewalls through encapsulated ICMP tunneling inside the image metadata

Question 15

You are conducting a client-side attack using a weaponized Microsoft Office document containing a malicious VBA macro. Which user interaction and application setting combination is required for the macro to execute successfully by default?

Accepted Answer

The user must click 'Enable Content' in the security banner after the file opens in Protected View. By default, modern Microsoft Office applications block macros in files obtained from the internet using Office Protected View and Antimalware Scan Interface integrations. Users must explicitly click 'Enable Content' in the Security Warning banner after opening the file for the VBA code to run.

Answer

The user must double-click the document while holding down the Shift key to bypass AutoOpen restrictions

Answer

The file must be saved in the local startup directory and the user must open the application normally

Answer

The target workstation must have macro auditing disabled via Group Policy Objects before execution

Question 16

During an assessment, you identify a Cross-Site Scripting vulnerability that allows you to execute arbitrary JavaScript in the context of a victim user's browser session. What is the primary objective of leveraging this capability against an authenticated user?

Accepted Answer

Hijacking the user session by accessing session tokens or performing actions on their behalf within the application. XSS allows attackers to execute scripts in the victim browser session, giving them access to document.cookie, local storage, and the ability to perform actions on behalf of the user. This effectively hijacks their session without needing to crack their underlying password.

Answer

Extracting plaintext password hashes directly from the remote web server operating system memory

Answer

Modifying the enterprise DNS records hosted on the primary domain controller via client-side DOM manipulation

Answer

Bypassing enterprise firewall packet inspection rules by encapsulating shellcode inside HTTPS headers

Question 17

When evaluating a web application for Cross-Site Scripting vulnerabilities during a penetration test, which TWO input contexts should you examine because they frequently lead to executable script injection?

Accepted Answer

Input reflected directly between opening and closing HTML tags, such as

USER_INPUT

. XSS occurs when untrusted user input is rendered in an unsafe context within the HTML document. Examining input reflected directly inside HTML body tags or inside event handler attributes (like onload or onerror) are primary areas where browsers will evaluate injected strings as executable JavaScript.

Answer

Input processed by a backend database stored procedure for primary key generation

Answer

Input stored as an encrypted binary blob inside the browser local session storage

Answer

Input utilized as a parameter value inside a server-side JSON response header without content-type sniffing

Question 18

You are performing a client-side phishing engagement and need to deliver a malicious payload using an ISO image file. Why is this delivery method often effective against modern Windows security warnings?

Accepted Answer

Windows natively mounts ISO files without requiring external software, and extracted payloads can evade certain Mark of the Web propagation behaviors. ISO image files can be mounted natively by Windows without third-party software, and files contained within the ISO often inherit a lower severity of Mark of the Web restrictions when extracted or executed, helping bypass certain SmartScreen prompts compared to direct web downloads.

Answer

ISO files automatically disable Windows Defender Antivirus real-time protection upon mounting

Answer

ISO files encrypt all internal payload binaries, rendering static signature analysis completely impossible

Answer

Mark of the Web attributes are permanently stripped from all files stored within virtual disk containers

Question 19

Refer to the exhibit. ```http HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

Welcome

``` Based on the HTTP response headers and body shown in the exhibit, what significant security risk is present regarding client-side attacks?

Accepted Answer

The 'unsafe-inline' directive permits the execution of inline scripts, undermining CSP protections against Cross-Site Scripting. The inclusion of the 'unsafe-inline' directive in the Content Security Policy script-src allows the browser to execute inline script blocks present in the HTML. This configuration largely defeats the protective benefits of a CSP against Cross-Site Scripting, as attackers who can inject inline scripts will achieve execution.

Answer

The application is completely immune to Cross-Site Scripting because a Content Security Policy is strictly enforced

Answer

The server is vulnerable to remote code execution because the nginx version header is explicitly exposed

Answer

The session token is vulnerable to interception because the response is transmitted over unencrypted HTTP

Question 20

When testing for DOM-based XSS, where should you focus your analysis to find the vulnerable code?

Accepted Answer

The application's source code, specifically looking for sinks like eval() or innerHTML.. DOM-based XSS occurs entirely on the client side, where JavaScript takes data from a 'source' (like the URL fragment) and passes it to a 'sink' (like innerHTML) without proper sanitization. Analyzing the client-side JavaScript code is essential to trace the data flow from these sources to the execution sinks. This is critical because the server might never see the malicious payload at all.

Answer

The server-side application logs for suspicious input patterns.

Answer

The database queries for evidence of script injection.

Answer

The server's response headers to check for security misconfigurations.