PT0-003 Exam Questions and Answers

White box

White box testing grants the tester complete knowledge of the target environment, including source code, architecture diagrams, credentials, and internal documentation. This enables deep static analysis and code-path-specific vulnerability discovery, such as identifying logic flaws or hardcoded secrets that would be invisible to a black-box approach. The elevated access reduces reconnaissance effort and speeds up the assessment, but requires the tester to prioritize findings against a vast attack surface and validate beyond mere code scanning.

Rules of engagement (RoE)

The rules of engagement (RoE) is the official document that codifies all permissible actions, boundaries, and constraints for a penetration test, including explicit 'no testing' restrictions on designated assets or services. It also specifies emergency procedures, legal boundaries, and points of contact, ensuring both client and tester agree on the exact operational parameters. In a pre-engagement meeting, the client's stated restrictions would be formally recorded in the RoE, making it the correct document that defines what is off-limits.

Personnel scope

Personnel scope defines the specific subset of employees, departments, or roles that a social engineering campaign may legitimately target. For example, it may list all non-executive staff as in-scope but exclude executive leadership or a particular division for internal political reasons. This is the correct scoping element because the question asks where the target population is recorded, and that is precisely what the personnel scope does.

Stop testing and contact the client's emergency contact

Halting all testing and invoking the client's pre-arranged emergency contact path is the only action that both preserves the integrity of forensic evidence and keeps the engagement within its legal scope. The emergency contact is typically the client's incident-response lead or executive with authority to decide whether to involve law enforcement, issue containment orders, or terminate the test. This step ensures that the tester remains a controlled, auditable resource rather than acting unilaterally on potentially sensitive criminal matters.

PTES

PTES, the Penetration Testing Execution Standard, offers a comprehensive, structured methodology that explicitly defines seven phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. It standardizes both technical execution and communication, including rules of engagement, data handling, and report templates. This makes it a complete, industry-recognized standard for penetration testing, clearly surpassing the narrower guides.

Red team exercise

A red team exercise is a full-scope, objective-based simulation that mimics a real adversary's tactics, techniques, and procedures (TTPs), including social engineering, physical access, email phishing, and exploitation. Unlike a single-vector assessment, it is designed to test the organization's overall security posture — people, processes, and technology — by stealthily moving toward a defined goal, such as data exfiltration or domain compromise. Social engineering is a core component because it validates whether employee awareness and security policies can resist real-world manipulation.

Responder with LLMNR/NBT-NS/mDNS poisoning

Responder is the correct tool because it actively listens for LLMNR, NBT-NS, and mDNS name-resolution queries broadcast by Windows hosts when DNS lookups fail. By replying with a spoofed response that claims to be the requested host, Responder forces the victim to initiate an SMB authentication handshake to the attacker, sending an NTLMv2 hash in the process. This hash can then be cracked offline with hashcat or relayed with ntlmrelayx, and the attack works without any prior credentials or access to the target system.

Reflected XSS

Reflected XSS is correct because the tester's parameter value is immediately included in the server's HTTP response without proper output encoding, creating a non-persistent vulnerability. An attacker can craft a malicious URL that, when clicked, causes the victim's browser to execute the injected script in the context of the application's origin. The immediate echo back in the response exactly matches the definition of reflected XSS, distinguishing it from stored XSS, which involves server-side persistence, and DOM-based XSS, which never involves the server response.

Unquoted service path exploitation

An unquoted service path occurs when the ImagePath registry value for a service contains spaces but is not enclosed in quotes. When Windows starts the service, it attempts to locate the executable by splitting the path at each space and trying the resulting filenames, moving from left to right. If an attacker has write access to a directory earlier in that sequence, they can drop a malicious executable (e.g., C:\Program.exe or C:\Program Files\Vendor.exe) that Windows will execute with the service's SYSTEM privileges. This is the correct exploitation method because it directly abuses the service's own path configuration to achieve code execution as SYSTEM.

pth-winexe

pth-winexe is part of the pass-the-hash toolkit that implements the Windows SMB client and authentication stack, allowing you to authenticate to a remote Windows host using only the NTLM hash as the credential. It substitutes the password in the NTLM/SPNEGO exchange with the hash, establishes an authenticated session, and executes a specified command without ever knowing the plaintext password. This directly demonstrates pass-the-hash: the hash itself serves as the proof of knowledge to impersonate the user.

Time-based blind SQL injection

Time-based blind SQL injection is the correct answer because the tester can extract data by injecting conditional expressions that invoke database delay functions, such as `IF(condition, SLEEP(5), 0)` in MySQL or `WAITFOR DELAY '0:0:5'` in MSSQL, and then measuring the application's response time. Sqlmap automatically generates these payloads and uses a statistical threshold to distinguish between true and false conditions based on elapsed time, making it effective when no error messages or content changes are visible. This aligns perfectly with the scenario where the tester used sqlmap and observed time-based behavior.

GTFOBins

GTFOBins is the authoritative, community-maintained list of Unix binaries that can be abused to bypass local security restrictions, with a dedicated 'sudo' section. It provides exact commands—such as `sudo find . -exec /bin/sh \;`—for each binary that can be used to escalate privileges when that binary is listed in the sudoers file. Cross-referencing the output of `sudo -l` against GTFOBins is the standard technique for detecting sudo misconfigurations during a Linux privilege escalation assessment.

mimikatz # sekurlsa::tickets /export

The sekurlsa::tickets command in Mimikatz lists all Kerberos tickets in memory for the current session, and the /export option exports them to .kirbi files. These files can then be used with kerberos::ptt to inject the tickets into a new session, enabling pass-the-ticket. This is the standard method for extracting and reusing Kerberos tickets during post-exploitation.

Using wmic /node:target process call create "cmd.exe /c ..."

The wmic command-line tool can execute processes on a remote host via WMI. When using process call create, it creates a new process on the target, which runs the specified command. This does not require writing a file to disk on the target, as the command is executed directly. However, it may create temporary files depending on the command, but the WMI mechanism itself does not write a payload to disk. This is a common fileless lateral movement technique.

Using Invoke-WmiMethod -Class Win32_Process -Name Create -ComputerName target -ArgumentList "cmd.exe /c ..."

The Invoke-WmiMethod PowerShell cmdlet calls the Win32_Process Create method on a remote computer. This executes the specified command without writing any files to the target's disk. The command runs in the context of the WMI provider, and the output can be captured if needed. This is a fileless method for remote command execution via WMI, often used in penetration testing to avoid leaving artifacts on disk.

Metasploit Framework

The Metasploit Framework is the correct choice because it is a dedicated exploitation framework with a large, continuously updated database of exploit modules, payloads, encoders, and post-exploitation tools. It allows a penetration tester to pair a specific exploit (e.g., a buffer overflow in a network service) with a compatible payload (e.g., Meterpreter reverse shell), then launch the attack and maintain interactive access to the compromised host. This workflow directly matches the task of exploiting a vulnerable service, encompassing both the delivery and the post-exploitation phases that standalone tools like Wireshark or Nmap lack.

secretsdump.py

secretsdump.py is an Impacket tool that copies the SAM, SYSTEM, and SECURITY hives from a local Windows machine, or remotely retrieves NTDS.dit and registry data using Volume Shadow Copy or the DRSUAPI (DCSync) protocol. On a domain controller, it can extract all domain password hashes, including NTDS.dit database and cached credentials, without requiring additional tools on the target. Its ability to perform DCSync and remote registry reads makes it the standard for credential harvesting after gaining admin access to Active Directory.

aircrack-ng

Aircrack-ng performs the actual offline cryptanalysis of the captured four-way handshake, deriving the WPA2 pre-shared key by testing candidate passphrases against the MIC. Other suite tools only capture, inject or deauthenticate; aircrack-ng is the cracking component the scenario requires.

SQL injection

SQL injection is confirmed when user input is embedded directly into an SQL query without sanitization or parameterization, allowing the attacker to modify the query's logic. For example, input like ' OR '1'='1 can bypass authentication, and UNION SELECT statements can extract data from other tables. This occurs because the database engine interprets the attacker's input as part of the SQL syntax, not just as data. Proper defense involves prepared statements with bound parameters or stored procedures, which separate data from SQL code.

Hydra

Hydra is the correct choice because it is a network logon cracker that supports the SSH protocol among hundreds of others. It can supply username/password pairs from wordlists, perform parallel connection attempts, and handle SSH's banner and authentication exchange, making it ideal for online brute-force testing against a live target.

scapy

Scapy is purpose-built for packet crafting and manipulation. It provides a declarative, layer-by-layer API where you can compose packets like `IP(src='10.0.0.1')/TCP(dport=80, flags='S')`, then send them with functions such as `send()`, `sendp()`, or `sr()`. Scapy also handles checksum calculation, fragmentation, retransmissions, and dissection of responses, making it the de facto standard for network exploration, fuzzing, and custom TCP flag testing in penetration tests.

theHarvester

theHarvester is the correct answer because it is a dedicated OSINT tool engineered to passively gather emails, subdomains, hostnames, and employee names from public sources. It queries search engines like Bing and Google, PGP key servers, and other open data repositories, making it ideal for the early reconnaissance phase of a penetration test. Its specific focus on email harvesting and subdomain enumeration aligns precisely with the task of gathering information about an organization's digital footprint, unlike general-purpose scanners or link-analysis platforms.

False positive

A false positive is an incorrect alert in which the scanner reports a vulnerability that does not actually exist in the web application, such as flagging a sanitized input parameter as SQL injectable. This often occurs due to heuristic detection misfires, outdated signature databases, or responses that imitate vulnerability patterns without the underlying weakness. It consumes security team time and resources on investigating and remediating non-existent issues, highlighting why every automated finding should be validated before being acted upon.

-sS

The -sS option, Nmap's default SYN scan, transmits a raw TCP packet with only the SYN flag set to each port; an open port replies with a SYN/ACK, a closed port with an RST, and a filtered port drops the packet or returns an ICMP unreachable. Because Nmap aborts the handshake immediately upon receiving SYN/ACK, it determines TCP port state without ever completing a full connection, making it fast and relatively unobtrusive.

Certificate transparency logs

Certificate transparency logs are a passive discovery resource because they are publicly available, append-only ledgers maintained by independent log operators, and querying them does not involve sending any packets to the target organization's own servers or infrastructure. Services like crt.sh or Censys provide APIs that return certificates issued for a domain, often revealing subdomains, wildcard entries, and even expired certificates that were previously in use. This method leaves no trace on the target's DNS logs, web servers, or intrusion detection systems, making it a classic OSINT/ passive-recon technique. For a penetration tester, it provides a high-yield, low-risk baseline for expanding the attack surface before active testing begins.

Arjun and ffuf

Arjun discovers hidden API parameters and endpoints through its extensive wordlists and passive/active scanning, while ffuf fuzzes directories, parameters and virtual hosts at high speed. Together they satisfy the stem's need to uncover endpoints and hidden parameters in a web application.

WPScan

WPScan is a dedicated WordPress vulnerability scanner that enumerates installed plugins, themes and users, then checks them against known vulnerability databases and tests for weak credentials. Generic web scanners lack this WordPress-specific enumeration and detection logic.