PT0-002 Attacks and Exploits Practice Test 11 — 15 Questions

Question 1

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR responses. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

John the Ripper

Answer

Bettercap

Answer

Hashcat

Question 2

A penetration tester wants to perform a pass-the-hash attack against a Windows target. Which tools can be used to authenticate using an NTLM hash without knowing the plaintext password? (Choose the best option.)

Accepted Answer

CrackMapExec. CrackMapExec is a popular tool for pass-the-hash attacks across many Windows services.

Answer

Nmap

Answer

Responder

Answer

Wireshark

Question 3

During a web application test, a tester discovers a parameter that appears to be vulnerable to SQL injection. They want to extract data from a database using a technique that does not rely on visible output. Which type of SQL injection is most appropriate?

Accepted Answer

Blind time-based SQL injection. Blind SQL injection, specifically time-based, is used when no error or data is returned, allowing inference via time delays.

Answer

UNION-based SQL injection

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Question 4

A penetration tester identifies a Linux binary with the SUID bit set. Which command can find all SUID binaries on a Linux system?

Accepted Answer

find / -perm /4000. The find command with -perm /4000 lists files with SUID set.

Answer

ps aux

Answer

ls -la

Answer

chmod u+s

Question 5

While exploiting a Windows machine, a tester gains a shell with limited privileges. They attempt to escalate privileges using a tool that exploits the SeImpersonatePrivilege. Which tool is specifically designed for this purpose on modern Windows versions?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege on Windows 10/Server 2016+ to gain SYSTEM.

Answer

Mimikatz

Answer

JuicyPotato

Answer

PowerUp

Question 6

A tester is performing a JWT attack and modifies the header to set the algorithm to 'none'. Which vulnerability are they exploiting?

Accepted Answer

Algorithm confusion. Setting alg to 'none' bypasses signature verification, a known JWT vulnerability.

Answer

Token theft

Answer

Weak secret brute-force

Answer

Kid injection

Question 7

After gaining initial access to a target, a tester wants to pivot to an internal network that is not directly accessible. Which technique can be used to forward traffic from the tester's machine through the compromised host to reach internal services?

Accepted Answer

SSH local port forwarding (-L). SSH local port forwarding (-L) allows the tester to access internal services via the compromised host.

Answer

SSH dynamic port forwarding (-D)

Answer

Netcat

Answer

SSH remote port forwarding (-R)

Question 8

A penetration tester needs to perform Kerberoasting against an Active Directory domain. Which step is required after requesting TGS tickets?

Accepted Answer

Crack the TGS hashes offline. After requesting TGS tickets for service accounts, the tester must crack the hashes offline using a tool like Hashcat.

Answer

Perform SMB relay

Answer

Request TGT ticket

Answer

Extract NTLM hashes from LSASS

Question 9

During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. AWS metadata is accessible at 169.254.169.254, a link-local address.

Answer

10.0.0.1

Answer

127.0.0.1

Answer

192.168.1.1

Question 10

A tester exploits an XXE vulnerability to read local files. Which of the following is a typical XXE payload to read /etc/passwd?

Accepted Answer

<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]>. XXE uses an external entity with file:// to read local files.

Answer

' OR 1=1--

Answer

<?php system('cat /etc/passwd'); ?>

Answer

Question 11

After compromising a host, a tester wants to maintain persistence on a Windows system by executing a payload each time a user logs in. Which registry key is commonly used for this?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run execute programs at user logon.

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Question 12

A tester is using Hashcat to crack NTLM hashes. They want to try all possible passwords consisting of exactly 8 lowercase letters. Which attack mode and mask should they use?

Accepted Answer

-a 3 -m 1000 ?l?l?l?l?l?l?l?l. Brute-force mode (-a 3) with mask ?l?l?l?l?l?l?l?l tries all 8-letter lowercase combinations.

Answer

-a 6 -m 1000 ?l?l?l?l?l?l?l?l

Answer

-a 3 -m 0 ?l?l?l?l?l?l?l?l

Answer

-a 0 -m 1000 dictionary.txt

Question 13

A penetration tester is performing a web application assessment. Which of the following are common techniques to identify and exploit IDOR vulnerabilities? (Select TWO.)

Accepted Answer

Enumerate sequential IDs in URLs. IDOR involves manipulating object references; enumeration of IDs and modifying parameter values are common techniques.

Answer

Perform a man-in-the-middle attack

Answer

Use SQL injection to bypass authentication

Answer

Inject malicious scripts into input fields

Question 14

During a Linux privilege escalation attempt, a tester checks for misconfigurations that could allow running commands as root. Which of the following are potential vectors? (Select THREE.)

Accepted Answer

Sudo misconfigurations. SUID/SGID binaries, sudo misconfigurations, and writable cron scripts are common escalation vectors.

Answer

Unquoted service paths

Answer

DLL hijacking

Question 15

A penetration tester has gained a foothold in a Windows domain and wants to perform lateral movement. Which of the following tools or techniques can be used? (Select THREE.)

Accepted Answer

Evil-WinRM. PsExec, WinRM, and Evil-WinRM are common lateral movement tools in Windows environments.

Answer

Chisel

Answer

SSH