PT0-002 Attacks and Exploits — 100 Questions

Question 1

A penetration tester is conducting an internal network assessment and wants to capture NTLMv2 hashes from Windows hosts without sending any authentication traffic. Which tool and attack technique should the tester use?

Accepted Answer

Responder with LLMNR/NBT-NS/mDNS poisoning. Responder poisons LLMNR/NBT-NS/mDNS to trick hosts into sending NTLM hashes to the attacker, capturing them without the attacker needing to authenticate.

Answer

Metasploit's hashdump module

Answer

Hashcat with a wordlist attack

Answer

Bettercap with ARP spoofing

Question 2

During a web application test, the tester discovers a parameter that reflects user input in the response without sanitization. Which type of vulnerability is most likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately reflected in the response without proper encoding or sanitization.

Answer

DOM-based XSS

Answer

Stored XSS

Answer

SQL injection

Question 3

A tester wants to exploit a Windows service running with SYSTEM privileges that has an unquoted service path containing spaces. Which technique should be used to escalate privileges?

Accepted Answer

Unquoted service path exploitation. An unquoted service path allows placing an executable with the same name as a folder in the path, which Windows will execute with SYSTEM privileges.

Answer

AlwaysInstallElevated

Answer

Token impersonation

Answer

DLL hijacking

Question 4

A penetration tester is performing a password attack on a Windows domain and has captured NTLM hashes. Which tool can be used to perform a pass-the-hash attack to gain remote code execution on a target system?

Accepted Answer

pth-winexe. pth-winexe is a tool specifically designed for pass-the-hash attacks to execute commands on remote Windows systems.

Answer

Hashcat

Answer

Responder

Answer

John the Ripper

Question 5

During a web application test, the tester uses sqlmap and identifies a time-based blind SQL injection. Which technique is sqlmap using to extract data?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection uses conditional delays to infer the truth of queries based on response time.

Answer

Error-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

UNION-based SQL injection

Question 6

A penetration tester needs to escalate privileges on a Linux system and finds that the current user can run a specific command with sudo without a password. Which tool should the tester consult to find known exploitation techniques for that command?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions.

Answer

Exploit-DB

Answer

HackTricks

Answer

Metasploit

Question 7

A penetration tester is attempting to exploit a server-side request forgery (SSRF) vulnerability in a cloud-hosted web application to access the cloud metadata service. Which IP address should the tester target?

Accepted Answer

169.254.169.254. The cloud metadata service for most cloud providers (AWS, GCP, Azure) is accessible via 169.254.169.254.

Answer

192.168.1.1

Answer

127.0.0.1

Answer

10.0.0.1

Question 8

A tester has gained a low-privilege shell on a Windows machine and found that the user has the SeImpersonatePrivilege enabled. Which attack can be used to escalate privileges to SYSTEM?

Accepted Answer

Token impersonation using PrintSpoofer. SeImpersonatePrivilege allows impersonating a client after authentication; tools like PrintSpoofer, RoguePotato exploit this to gain SYSTEM.

Answer

DLL hijacking

Answer

Kerberoasting

Answer

AlwaysInstallElevated

Question 9

A penetration tester wants to crack NTLM hashes obtained from a Windows domain. Which hashcat mode should the tester use?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 13100

Answer

-m 0

Question 10

During a penetration test, the tester discovers a JWT token that uses the 'alg:none' header. Which attack does this vulnerability enable?

Accepted Answer

Signature bypass using alg:none. JWT with 'alg:none' allows an attacker to forge tokens without any signature, bypassing verification.

Answer

Key confusion attack

Answer

Algorithm substitution attack

Answer

Timing attack

Question 11

A penetration tester has compromised a Linux host and wants to use it as a pivot point to access an internal network that is not directly reachable from the attacker's machine. Which tool can create a SOCKS proxy for routing traffic through the compromised host?

Accepted Answer

chisel. Chisel is a fast TCP/UDP tunnel over HTTP that can create a SOCKS proxy for pivoting.

Answer

Responder

Answer

nmap

Answer

netcat

Question 12

A tester is exploiting a vulnerable web application and wants to perform a UNION-based SQL injection to extract data. Which condition is necessary for a successful UNION attack?

Accepted Answer

The number of columns in both queries must match. UNION-based injection requires the same number of columns between the original query and the injected SELECT.

Answer

The database must be MySQL

Answer

The application must use GET parameters

Answer

The application must display error messages

Question 13

A penetration tester is performing a Kerberoasting attack. Which TWO steps are required for a successful Kerberoasting attack?

Accepted Answer

Request TGS tickets for service accounts. Kerberoasting involves requesting TGS tickets for service accounts and then cracking the tickets offline.

Answer

Enumerate domain admins

Answer

Perform a relay attack

Answer

Capture NTLMv2 hashes using Responder

Question 14

A penetration tester is testing a web application and wants to exploit an XXE vulnerability to read sensitive files. Which TWO payloads could be used?

Accepted Answer

]>. XXE can be used to read files via file:// or to perform SSRF to internal resources via http://, including cloud metadata.

Answer

Answer

'; DROP TABLE users; --

Answer

../../etc/passwd

Question 15

A penetration tester is performing lateral movement in a Windows domain after compromising a workstation. Which THREE techniques can be used to move to another machine?

Accepted Answer

Evil-WinRM. PsExec, WMIExec, and Evil-WinRM are common tools for lateral movement in Windows environments.

Answer

ARP spoofing

Answer

SSH with captured credentials

Question 16

During an internal penetration test, a tester wants to capture NTLMv2 hashes by poisoning LLMNR and NBT-NS traffic. Which tool should the tester use?

Accepted Answer

Responder. Responder is specifically designed to respond to LLMNR and NBT-NS queries and capture NetNTLM hashes.

Answer

ntlmrelayx

Answer

Bettercap

Answer

Hashcat

Question 17

A penetration tester has successfully compromised a Windows machine and wants to perform lateral movement to another machine using captured NTLM hashes. Which tool would allow the tester to pass the hash and execute commands remotely?

Accepted Answer

CrackMapExec. CrackMapExec is a popular tool for pass-the-hash and executing commands via SMB or other protocols.

Answer

John the Ripper

Answer

Metasploit

Answer

pth-winexe

Question 18

During a penetration test, a tester identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). The tester attempts to access the AWS metadata endpoint to retrieve temporary credentials. Which IP address is commonly used for the cloud metadata endpoint?

Accepted Answer

169.254.169.254. The AWS metadata endpoint is available at 169.254.169.254 for all cloud providers.

Answer

127.0.0.1

Answer

192.168.1.254

Answer

10.0.0.1

Question 19

A penetration tester is exploiting a SQL injection vulnerability in a login page. The tester wants to extract data from another table without returning data in the original query. Which SQL injection technique should the tester use?

Accepted Answer

UNION-based SQL injection. Union-based SQL injection combines results from multiple SELECT statements into a single output. Blind time-based injection uses conditional delays to infer data bit by bit.

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Answer

Blind time-based SQL injection

Question 20

A tester wants to crack NTLM hashes captured from a Windows domain. Which hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode 1000 corresponds to NTLM hashes.

Answer

-m 13100

Answer

-m 0

Answer

-m 22000