PEN-200 Enumeration and Reconnaissance — Timed 20 Questions

Question 1

You are enumerating a target and find a service on port 3389. What is the most effective way to identify if this service is open to remote login attacks during the reconnaissance phase?

Accepted Answer

Perform version fingerprinting using Nmap.. Port 3389 is the standard port for Remote Desktop Protocol (RDP). The most effective way to enumerate this is to identify the service version and look for known vulnerabilities or ensure that the service requires Multi-Factor Authentication (MFA). Since RDP is a common target for brute-force, identifying whether it allows NLA (Network Level Authentication) or is susceptible to known exploits is critical for a professional assessment of the surface area.

Answer

Attempt a brute-force login with a large password list.

Answer

Connect using the telnet command.

Answer

Send an HTTP GET request to the port.

Question 2

Refer to the exhibit. Given the information discovered, what is the most logical immediate next step in the enumeration process?

Accepted Answer

Attempt to use the discovered credentials to log into the MySQL database service locally.. The discovery of a backup configuration file containing hardcoded credentials is a high-value finding. The immediate next step is to test these credentials against common services on the target, such as the database or SSH/RDP. Credentials often exhibit reuse across development and production environments. Verifying these credentials allows for potential data exfiltration, service manipulation, or further lateral movement within the infrastructure using the discovered password.

Answer

Upload a PHP web shell to the /includes/ directory to verify write permissions.

Answer

Perform a full port scan on the target using Nmap to identify other listening services.

Answer

Delete the config.php.bak file to hide your tracks and prevent others from finding it.

Question 3

You are conducting internal enumeration against a Windows host. Running `nmap -sU -p 161 --script snmp-brute <target>` fails to produce any output, but you know the host is running an SNMP service. Which command should you run next to retrieve basic system information from this host?

Accepted Answer

snmpwalk -v1 -c public <target> 1.3.6.1.2.1.1. SNMP enumeration typically begins by guessing default community strings. The 'public' community string is the most common read-only default. Walking the system group (1.3.6.1.2.1.1) returns hostname, contact, location, uptime, and description, which are valuable for further attacks. The other options either guess a less likely community string, perform redundant scanning, or retrieve only a single OID.

Answer

nmap -sU -p 161 --script snmp-info <target>

Answer

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <target>

Answer

snmpget -v2c -c private <target> 1.3.6.1.2.1.1.1.0

Question 4

During a penetration test, you run a UDP scan against a target and see that port 161 is open. You then run `snmpwalk -v2c -c public 192.168.1.50`. The command returns a large amount of system information, including running processes and installed software. What is the most likely reason this enumeration succeeded?

Accepted Answer

The SNMP service is configured with the default read-only community string 'public'.. The successful enumeration with `snmpwalk -v2c -c public` indicates that the SNMP service is using the default read-only community string 'public'. This allows an attacker to retrieve extensive system information without authentication. The other options either misidentify the protocol version or incorrectly attribute the success to firewall rules or permissive community string acceptance.

Answer

The target is using SNMPv3 with no authentication and no encryption.

Answer

The target's firewall is allowing all UDP traffic to port 161 from any source.

Answer

The SNMP service is configured to allow any community string for read access.

Question 5

You are enumerating a web server and discover that directory listing is enabled on `/backup/`. Browsing it reveals a file named `db_dump.sql.bz2`. You download it, decompress it, and find a `users` table containing password hashes in the format `$2y$10$...`. What is the most appropriate next step to further your access?

Accepted Answer

Attempt to crack the hashes with `john` using the `bcrypt` format and a wordlist.. The bcrypt hash format indicates the need for a bcrypt-aware cracking tool. `john` with the `bcrypt` format is the correct choice to recover plaintext passwords from the database dump. Other options either use the wrong hash mode, apply an incompatible attack technique, or ignore the data already in hand.

Answer

Perform a pass-the-hash attack using the bcrypt hashes against the web application's login form.

Answer

Use `hashcat -m 0` to crack the hashes in mode 0 (MD5).

Answer

Use the `users` table entries to perform a SQL injection attack on the login form.

Question 6

You are performing a penetration test against a Windows domain. You have obtained a low-privileged domain user's credentials. You want to enumerate all computers in the domain to identify potential targets. Which command is most appropriate to achieve this using built-in Windows tools?

Accepted Answer

dsquery computer -limit 0. The `dsquery computer -limit 0` command queries Active Directory for all computer objects, removing the default result limit. It uses the current user's credentials and is a built-in tool on domain-joined Windows systems with AD DS tools installed. This provides a comprehensive list of computers for further targeting. The other commands either list different objects or rely on deprecated services.

Answer

net group "Domain Computers" /domain

Answer

net view /domain

Answer

nltest /dclist:<domain>

Question 7

You are performing active reconnaissance against a target network and want to identify live hosts without triggering IDS alerts. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

TCP ACK ping with `nmap -PA` to a small set of critical IPs.. ARP scanning is inherently stealthy on a local subnet because it operates at layer 2 and does not generate IP traffic. TCP ACK ping to a small set of targets is also stealthy because it uses a minimal number of packets that often bypass simple firewall rules. Both techniques avoid the noisy patterns of full port scans or broad ICMP sweeps.

Answer

TCP SYN scanning with `nmap -sS` against all hosts.

Answer

ICMP echo requests with `nmap -sn` to a range of IPs.

Answer

Passive network sniffing with `tcpdump` on a mirrored port.

Question 8

You are enumerating a Windows host and discover that port 139 is open, but port 445 is closed. You want to list the available SMB shares. Which command should you use?

Accepted Answer

`smbclient -L //10.10.10.25 -N`. When only port 139 is open, SMB communication occurs over NetBIOS. `smbclient` supports this by default and can list shares with the `-L` flag. The `-N` flag attempts a null session. Other tools may rely on port 445 or be less direct, making `smbclient` the most appropriate choice.

Answer

`smbclient -L //10.10.10.25 -p 445 -N`

Answer

`nmap --script smb-enum-shares -p 139 10.10.10.25`

Answer

`enum4linux -a 10.10.10.25`

Question 9

You are performing a network scan on a target network and notice that ICMP echo requests are blocked, but you need to determine if the target host is alive. Which technique should you utilize to identify active hosts without relying on standard ICMP ping?

Accepted Answer

Perform a TCP SYN scan on common ports such as 80, 443, and 22.. When ICMP is filtered by firewalls, TCP SYN scanning on common ports like 80 or 443 is an effective alternative for host discovery. This technique works because the target system responds to a SYN packet with a SYN/ACK if the port is open, or an RST if closed, confirming the host's presence. Mastering non-ICMP discovery is critical for bypass techniques in hardened network environments where security policies block traditional discovery methods.

Answer

Send a UDP packet to port 53 and wait for a DNS response.

Answer

Use ARP scanning regardless of the network topography.

Answer

Send a broadcast ping to the entire subnet range.

Question 10

Refer to the exhibit. You have scanned a target and obtained these results. Which step is most logical to perform next to effectively enumerate the web service?

Accepted Answer

Perform directory busting using tools like ffuf or gobuster.. After identifying open ports, the next logical step is to enumerate the specific services running. For port 80, web directory brute-forcing is essential to uncover hidden administrative panels or configuration files that might not be linked on the home page. This systematic approach ensures no low-hanging fruit is missed, providing a deeper understanding of the target's attack surface before attempting any vulnerability exploitation against the identified web application or services.

Answer

Immediately attempt to exploit the FTP service with anonymous login.

Answer

Brute-force the SSH service using a list of common passwords.

Answer

Run a full vulnerability scanner against the entire target IP.

Question 11

Which TWO of the following techniques are most effective for enumerating SMB shares on a Windows host during a penetration test?

Accepted Answer

Use smbclient -L //target_ip -N to list available shares.. Enumerating SMB shares is crucial for identifying sensitive data, configuration files, or scripts that can lead to privilege escalation. Tools like smbclient and specialized scripts allow testers to interact with the SMB protocol to list shares and check for null sessions. Understanding these methods is fundamental for gathering intelligence in Windows environments, as misconfigured SMB permissions often provide an easy path to sensitive information and potential system compromise.

Answer

Perform a brute-force attack on the C$ share.

Answer

Attempt to ping the host using ICMP to check SMB connectivity.

Answer

Use the telnet command to connect to port 445.

Question 12

Which command-line tool is primarily used during the reconnaissance phase to identify open ports and service versions on a remote target?

Accepted Answer

Nmap. Nmap is the industry-standard tool for port scanning and service enumeration. By identifying open ports and the software versions running on them, a tester can pinpoint specific vulnerabilities to research. This step is the foundation of the reconnaissance phase, as it maps the target's attack surface and guides the subsequent selection of exploits, ensuring a focused and efficient penetration testing process.

Answer

netcat

Answer

Wireshark

Answer

grep

Question 13

When enumerating a web application, which THREE of the following items are most important to identify to increase the likelihood of finding a vulnerability?

Accepted Answer

Hidden directories and files.. Effective web enumeration requires looking beyond the main page. Identifying hidden directories, software versions, and input fields allows a tester to map the attack surface comprehensively. By finding these components, a tester can research known vulnerabilities associated with specific technologies or test for common web flaws like SQL injection or cross-site scripting, which are frequently found in custom application code and forgotten administrative paths.

Answer

The color scheme of the website.

Answer

The number of images hosted on the server.

Question 14

During a network assessment, you want to enumerate users on a domain controller. Which protocol and port combination is the most standard target for this type of enumeration?

Accepted Answer

LDAP on port 389. LDAP, running on port 389, is the standard protocol for querying directory information in a Windows domain. By successfully connecting to the LDAP service, a tester can often dump user lists, group memberships, and other organizational data. Understanding this protocol is vital, as it provides the foundation for password spraying attacks and deeper reconnaissance within Active Directory, which is a common objective in enterprise penetration tests.

Answer

HTTP on port 80

Answer

FTP on port 21

Answer

SMTP on port 25

Question 15

Refer to the exhibit. Based on the HTTP response headers provided, what critical information can be gathered for your reconnaissance?

Accepted Answer

The web server version and PHP version are disclosed.. The headers explicitly disclose the web server (Apache 2.4.41) and the application framework (PHP 7.4.3). This is crucial intelligence because these specific versions may have known vulnerabilities or CVEs associated with them. By identifying the exact software stack, you can tailor your future exploitation efforts to target the specific weaknesses documented for these versions, significantly increasing the probability of a successful engagement and minimizing the noise generated by generic testing.

Answer

The operating system is exclusively Windows.

Answer

The database being used is Microsoft SQL Server.

Answer

The application is currently configured for debugging mode.

Question 16

When performing reconnaissance on an unknown network, you discover a service running on port 161. What is the most appropriate action to take to determine if this service can be abused?

Accepted Answer

Use snmpwalk to attempt to retrieve data using default community strings.. Port 161 is the default port for SNMP (Simple Network Management Protocol). Often, SNMP is misconfigured with default community strings like 'public' or 'private'. By testing these strings, a tester can potentially retrieve sensitive system information such as running processes, network interfaces, and even user accounts. This is a classic, high-value enumeration target that frequently yields significant information for further lateral movement or privilege escalation within the network environment.

Answer

Attempt a brute-force attack on the SSH service.

Answer

Run a full Nmap script scan for all protocols.

Answer

Ignore the port as it is rarely used for anything critical.

Question 17

You have identified an open port 445 on a Windows machine. Which tool is most effective for checking if the machine is vulnerable to common SMB-based exploits like EternalBlue?

Accepted Answer

Use Nmap with the --script smb-vuln-ms17-010 argument.. Nmap's scripting engine (NSE) is the most effective way to check for specific vulnerabilities like EternalBlue without requiring a full-scale vulnerability scanner. The 'smb-vuln-ms17-010' script is specifically designed to detect this vulnerability. Using such targeted scripts allows for accurate assessment with minimal footprint, which is a hallmark of professional penetration testing practices, ensuring the system's security posture is evaluated safely and effectively during the reconnaissance phase.

Answer

Use ping to verify the host is reachable.

Answer

Run a full Nessus scan against the IP.

Answer

Use telnet to manually send an exploit string.

Question 18

Which TWO of the following actions are considered best practice during the initial host enumeration phase to avoid detection by security monitoring tools?

Accepted Answer

Prioritize passive reconnaissance using OSINT sources.. To minimize detection, penetration testers should prioritize passive information gathering before engaging in active, noisy scanning. When active scanning is required, rate-limiting and targeting specific ports rather than performing a 'scan all' approach helps blend the traffic into normal network behavior. These practices are essential for maintaining the stealth required in professional engagements, ensuring that the tester remains undetected while collecting the necessary intelligence to identify high-value targets.

Answer

Perform a full port scan on all 65535 ports concurrently.

Answer

Use aggressive service detection flags in all scans.

Answer

Scan from the same IP address at all times.

Question 19

You are enumerating an Apache web server and discover the '.git' directory is accessible. What is the most significant risk this poses for your reconnaissance?

Accepted Answer

The entire source code repository can be downloaded.. An exposed '.git' directory allows an attacker to download the entire project repository, including source code, configuration files, and commit history. This is a critical discovery because the source code may contain hardcoded credentials, API keys, or sensitive business logic that would otherwise be hidden. Analyzing this data often provides the most direct path to exploitation, as it reveals the application's internal workings and potential flaws that are not apparent from the outside.

Answer

It indicates the server is using an outdated version of Apache.

Answer

It means the server is vulnerable to SQL injection.

Answer

It suggests that the server is running on a Windows OS.

Question 20

Refer to the exhibit. Which ports are currently open on the target host 192.168.1.10?

Accepted Answer

Ports 22 and 80.. The Nmap output clearly indicates the state of the scanned ports. In this exhibit, ports 22 and 80 are explicitly listed as 'open', while 998 others are closed. Identifying these specific ports is the first step in mapping the target's attack surface. Understanding how to read scan output is a core competency that allows a tester to prioritize their focus towards the services that are most likely to be exploitable.

Answer

All ports from 1 to 1000.

Answer

Only port 22.

Answer

No ports are open.