PEN-200 Enumeration and Reconnaissance — 10 Questions

Question 1

You are enumerating a target and find a service on port 3389. What is the most effective way to identify if this service is open to remote login attacks during the reconnaissance phase?

Accepted Answer

Perform version fingerprinting using Nmap.. Port 3389 is the standard port for Remote Desktop Protocol (RDP). The most effective way to enumerate this is to identify the service version and look for known vulnerabilities or ensure that the service requires Multi-Factor Authentication (MFA). Since RDP is a common target for brute-force, identifying whether it allows NLA (Network Level Authentication) or is susceptible to known exploits is critical for a professional assessment of the surface area.

Answer

Attempt a brute-force login with a large password list.

Answer

Connect using the telnet command.

Answer

Send an HTTP GET request to the port.

Question 2

Refer to the exhibit. Given the information discovered, what is the most logical immediate next step in the enumeration process?

Accepted Answer

Attempt to use the discovered credentials to log into the MySQL database service locally.. The discovery of a backup configuration file containing hardcoded credentials is a high-value finding. The immediate next step is to test these credentials against common services on the target, such as the database or SSH/RDP. Credentials often exhibit reuse across development and production environments. Verifying these credentials allows for potential data exfiltration, service manipulation, or further lateral movement within the infrastructure using the discovered password.

Answer

Upload a PHP web shell to the /includes/ directory to verify write permissions.

Answer

Perform a full port scan on the target using Nmap to identify other listening services.

Answer

Delete the config.php.bak file to hide your tracks and prevent others from finding it.

Question 3

You are conducting internal enumeration against a Windows host. Running `nmap -sU -p 161 --script snmp-brute <target>` fails to produce any output, but you know the host is running an SNMP service. Which command should you run next to retrieve basic system information from this host?

Accepted Answer

snmpwalk -v1 -c public <target> 1.3.6.1.2.1.1. SNMP enumeration typically begins by guessing default community strings. The 'public' community string is the most common read-only default. Walking the system group (1.3.6.1.2.1.1) returns hostname, contact, location, uptime, and description, which are valuable for further attacks. The other options either guess a less likely community string, perform redundant scanning, or retrieve only a single OID.

Answer

nmap -sU -p 161 --script snmp-info <target>

Answer

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <target>

Answer

snmpget -v2c -c private <target> 1.3.6.1.2.1.1.1.0

Question 4

During a penetration test, you run a UDP scan against a target and see that port 161 is open. You then run `snmpwalk -v2c -c public 192.168.1.50`. The command returns a large amount of system information, including running processes and installed software. What is the most likely reason this enumeration succeeded?

Accepted Answer

The SNMP service is configured with the default read-only community string 'public'.. The successful enumeration with `snmpwalk -v2c -c public` indicates that the SNMP service is using the default read-only community string 'public'. This allows an attacker to retrieve extensive system information without authentication. The other options either misidentify the protocol version or incorrectly attribute the success to firewall rules or permissive community string acceptance.

Answer

The target is using SNMPv3 with no authentication and no encryption.

Answer

The target's firewall is allowing all UDP traffic to port 161 from any source.

Answer

The SNMP service is configured to allow any community string for read access.

Question 5

You are enumerating a web server and discover that directory listing is enabled on `/backup/`. Browsing it reveals a file named `db_dump.sql.bz2`. You download it, decompress it, and find a `users` table containing password hashes in the format `$2y$10$...`. What is the most appropriate next step to further your access?

Accepted Answer

Attempt to crack the hashes with `john` using the `bcrypt` format and a wordlist.. The bcrypt hash format indicates the need for a bcrypt-aware cracking tool. `john` with the `bcrypt` format is the correct choice to recover plaintext passwords from the database dump. Other options either use the wrong hash mode, apply an incompatible attack technique, or ignore the data already in hand.

Answer

Perform a pass-the-hash attack using the bcrypt hashes against the web application's login form.

Answer

Use `hashcat -m 0` to crack the hashes in mode 0 (MD5).

Answer

Use the `users` table entries to perform a SQL injection attack on the login form.

Question 6

You are performing a penetration test against a Windows domain. You have obtained a low-privileged domain user's credentials. You want to enumerate all computers in the domain to identify potential targets. Which command is most appropriate to achieve this using built-in Windows tools?

Accepted Answer

dsquery computer -limit 0. The `dsquery computer -limit 0` command queries Active Directory for all computer objects, removing the default result limit. It uses the current user's credentials and is a built-in tool on domain-joined Windows systems with AD DS tools installed. This provides a comprehensive list of computers for further targeting. The other commands either list different objects or rely on deprecated services.

Answer

net group "Domain Computers" /domain

Answer

net view /domain

Answer

nltest /dclist:<domain>

Question 7

You are performing active reconnaissance against a target network and want to identify live hosts without triggering IDS alerts. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

TCP ACK ping with `nmap -PA` to a small set of critical IPs.. ARP scanning is inherently stealthy on a local subnet because it operates at layer 2 and does not generate IP traffic. TCP ACK ping to a small set of targets is also stealthy because it uses a minimal number of packets that often bypass simple firewall rules. Both techniques avoid the noisy patterns of full port scans or broad ICMP sweeps.

Answer

TCP SYN scanning with `nmap -sS` against all hosts.

Answer

ICMP echo requests with `nmap -sn` to a range of IPs.

Answer

Passive network sniffing with `tcpdump` on a mirrored port.

Question 8

You are enumerating a Windows host and discover that port 139 is open, but port 445 is closed. You want to list the available SMB shares. Which command should you use?

Accepted Answer

`smbclient -L //10.10.10.25 -N`. When only port 139 is open, SMB communication occurs over NetBIOS. `smbclient` supports this by default and can list shares with the `-L` flag. The `-N` flag attempts a null session. Other tools may rely on port 445 or be less direct, making `smbclient` the most appropriate choice.

Answer

`smbclient -L //10.10.10.25 -p 445 -N`

Answer

`nmap --script smb-enum-shares -p 139 10.10.10.25`

Answer

`enum4linux -a 10.10.10.25`

Question 9

You are performing a network scan on a target network and notice that ICMP echo requests are blocked, but you need to determine if the target host is alive. Which technique should you utilize to identify active hosts without relying on standard ICMP ping?

Accepted Answer

Perform a TCP SYN scan on common ports such as 80, 443, and 22.. When ICMP is filtered by firewalls, TCP SYN scanning on common ports like 80 or 443 is an effective alternative for host discovery. This technique works because the target system responds to a SYN packet with a SYN/ACK if the port is open, or an RST if closed, confirming the host's presence. Mastering non-ICMP discovery is critical for bypass techniques in hardened network environments where security policies block traditional discovery methods.

Answer

Send a UDP packet to port 53 and wait for a DNS response.

Answer

Use ARP scanning regardless of the network topography.

Answer

Send a broadcast ping to the entire subnet range.

Question 10

Refer to the exhibit. You have scanned a target and obtained these results. Which step is most logical to perform next to effectively enumerate the web service?

Accepted Answer

Perform directory busting using tools like ffuf or gobuster.. After identifying open ports, the next logical step is to enumerate the specific services running. For port 80, web directory brute-forcing is essential to uncover hidden administrative panels or configuration files that might not be linked on the home page. This systematic approach ensures no low-hanging fruit is missed, providing a deeper understanding of the target's attack surface before attempting any vulnerability exploitation against the identified web application or services.

Answer

Immediately attempt to exploit the FTP service with anonymous login.

Answer

Brute-force the SSH service using a list of common passwords.

Answer

Run a full vulnerability scanner against the entire target IP.