PT0-002 Attacks and Exploits Practice Test 10 — 15 Questions

Question 1

During a penetration test, a tester uses Metasploit to exploit a Windows service and gets a meterpreter session. The tester wants to dump hashes from the compromised system. Which meterpreter command should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

hashdump. The hashdump command in meterpreter dumps the SAM database hashes.

Answer

shell

Answer

sysinfo

Answer

getsystem

Question 2

A penetration tester is testing a web application and discovers an endpoint that returns XML data. The tester attempts to read /etc/passwd by injecting an external entity. Which type of attack is this?

Accepted Answer

XXE injection. XML External Entity (XXE) injection allows reading files or performing SSRF via XML processing.

Answer

Command injection

Answer

SSRF

Answer

SQL injection

Question 3

While performing a web application penetration test, a tester observes that the application reflects user input in the page without proper sanitization. To steal session cookies, the tester crafts a payload like . Which XSS type is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the injected script is reflected off the web server immediately.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

SQL injection

Question 4

A penetration tester wants to perform a pass-the-hash attack against a Windows system. Which tool can be used to authenticate using the NTLM hash instead of a password?

Accepted Answer

CrackMapExec. CrackMapExec supports pass-the-hash authentication with NTLM hashes.

Answer

Responder

Answer

Hashcat

Answer

John the Ripper

Question 5

During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits the SeImpersonatePrivilege by abusing the Windows Print Spooler service's named pipe (\.\pipe\spoolss) to coerce a SYSTEM-level token and impersonate it, yielding NT AUTHORITY\SYSTEM. It is specifically designed for the SeImpersonatePrivilege/SeAssignPrimaryTokenPrivilege abuse class (alongside JuicyPotato, RoguePotato, and GodPotato). Because the question explicitly names SeImpersonatePrivilege, PrintSpoofer is the direct match.

Answer

PowerUp

Answer

CrackMapExec

Answer

Mimikatz

Question 6

A tester finds that a web application is vulnerable to Server-Side Request Forgery (SSRF). The tester wants to access the cloud metadata endpoint to obtain instance credentials. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. The cloud metadata endpoint is typically at 169.254.169.254 for AWS, GCP, and Azure.

Answer

127.0.0.1

Answer

10.0.0.1

Answer

192.168.1.1

Question 7

A penetration tester has obtained a set of NTLM hashes from a Windows domain. The tester wants to perform lateral movement to other systems. Which TWO tools can be used for this purpose? (Select TWO.)

Accepted Answer

pth-winexe. CrackMapExec and pth-winexe both support pass-the-hash for lateral movement.

Answer

Responder

Answer

Nmap

Answer

Hashcat

Question 8

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection (C) is correct because when the application returns no visible query output or error messages, the tester can inject conditional statements (e.g., WAITFOR DELAY in MSSQL or SLEEP() in MySQL) and infer data by measuring response delays. UNION-based SQL injection (E) is correct because it appends a crafted UNION SELECT statement to the original query, allowing the attacker to retrieve data from other tables or columns directly in the application's response when the column count and data types match. Command injection (A) targets OS command execution, not SQL query manipulation, so it does not extract database data. XXE injection (B) exploits XML external entity parsing to read files or perform SSRF, which is unrelated to SQL injection. Reflected XSS (D) is a client-side scripting attack that executes JavaScript in a victim's browser and cannot query a database.

Answer

Command injection

Answer

XXE injection

Answer

Reflected XSS

Question 9

During a penetration test, a tester captures NTLMv2 hashes using Responder. The tester then uses ntlmrelayx to relay the captured hashes to a target server. Which of the following best describes this attack technique?

Accepted Answer

NTLM relay attack. NTLM relay attacks forward captured authentication attempts to other servers, allowing the attacker to authenticate without cracking the hash. This is distinct from pass-the-hash, which requires a hash of the target account for local authentication.

Answer

Kerberoasting attack

Answer

SMB relay attack

Answer

Pass-the-hash attack

Question 10

A penetration tester has gained a low-privilege shell on a Windows server and discovered that the SeImpersonatePrivilege is enabled. Which of the following tools would be most appropriate to escalate privileges to SYSTEM-level access?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows token impersonation. Tools like PrintSpoofer exploit this to gain SYSTEM privileges. Potato attacks (JuicyPotato) also work, but PrintSpoofer is more modern and reliable.

Answer

pth-winexe

Answer

Responder

Answer

CrackMapExec

Question 11

A tester is exploiting a web application and identifies a parameter that reflects user input in the response without sanitization. The tester wants to steal session cookies from other users. Which type of cross-site scripting (XSS) attack should the tester use?

Accepted Answer

Reflected XSS. Reflected XSS occurs when input is immediately reflected in the response. Stored XSS persists on the server. DOM-based XSS occurs client-side. For stealing cookies, reflected XSS can be crafted into a link sent to the victim.

Answer

Stored XSS

Answer

Blind XSS

Answer

DOM-based XSS

Question 12

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows domain controller. Which hash mode should the tester specify for NTLM hashes?

Accepted Answer

-m 1000. Hashcat uses mode -m 1000 for NTLM hashes. Mode 0 is for MD5, mode 13100 is for Kerberoast, and mode 22000 is for WPA2.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 13

During a web application test, a tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester attempts to modify the 'alg' header to 'none' and sends the token. The server accepts the forged token. Which vulnerability is being exploited?

Accepted Answer

alg:none attack. The 'alg:none' attack exploits JWT libraries that accept tokens without verifying signatures. This allows an attacker to forge tokens. Weak secret brute-force would crack the signing key; kid injection manipulates the key ID.

Answer

kid injection

Answer

Algorithm confusion

Answer

Weak signing secret

Question 14

A tester is targeting a web application that makes server-side requests to internal resources based on user input. The tester attempts to access the AWS metadata endpoint at http://169.254.169.254/latest/meta-data/. The request returns sensitive cloud credentials. Which vulnerability is being exploited?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) allows the attacker to make the server send requests to internal resources. The metadata endpoint is a classic SSRF target. XXE can also access files but typically via entity injection, not direct URL.

Answer

IDOR

Answer

XXE

Answer

CSRF

Question 15

During a penetration test, a tester gains access to a Linux system and runs 'sudo -l', which reveals that the user can run /usr/bin/python with root privileges without a password. Which resource should the tester consult to find a method to escalate privileges using this configuration?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions. It provides techniques for privilege escalation using binaries like python. GTFOBins is specifically for Unix privilege escalation.

Answer

PayloadsAllTheThings

Answer

HackTricks

Answer

Exploit-DB