PT0-002 Attacks and Exploits Practice Test 2 — 15 Questions

Question 1

During an internal penetration test, a tester wants to capture NTLMv2 hashes by poisoning LLMNR and NBT-NS traffic. Which tool should the tester use?

Accepted Answer

Responder. Responder is specifically designed to respond to LLMNR and NBT-NS queries and capture NetNTLM hashes.

Answer

ntlmrelayx

Answer

Bettercap

Answer

Hashcat

Question 2

A penetration tester has successfully compromised a Windows machine and wants to perform lateral movement to another machine using captured NTLM hashes. Which tool would allow the tester to pass the hash and execute commands remotely?

Accepted Answer

CrackMapExec. CrackMapExec is a popular tool for pass-the-hash and executing commands via SMB or other protocols.

Answer

John the Ripper

Answer

Metasploit

Answer

pth-winexe

Question 3

During a penetration test, a tester identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). The tester attempts to access the AWS metadata endpoint to retrieve temporary credentials. Which IP address is commonly used for the cloud metadata endpoint?

Accepted Answer

169.254.169.254. The AWS metadata endpoint is available at 169.254.169.254 for all cloud providers.

Answer

127.0.0.1

Answer

192.168.1.254

Answer

10.0.0.1

Question 4

A penetration tester is exploiting a SQL injection vulnerability in a login page. The tester wants to extract data from another table without returning data in the original query. Which SQL injection technique should the tester use?

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection is the correct technique because it allows data extraction without returning data in the original query output. The tester injects conditional time delays (e.g., IF condition WAIT FOR DELAY) to infer information bit by bit based on response timing. UNION-based SQL injection combines query results into the original output, violating the requirement. Error-based SQL injection returns data in error messages, which is a form of output. Out-of-band SQL injection uses a separate channel, but the stem implies no output at all, making time-based the best fit.

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Question 5

A tester wants to crack NTLM hashes captured from a Windows domain. Which hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode 1000 corresponds to NTLM hashes.

Answer

-m 13100

Answer

-m 0

Answer

-m 22000

Question 6

During a Linux privilege escalation attempt, a tester finds a binary with the SUID bit set that is not on the GTFOBins list. The binary executes /bin/bash with the effective UID of root. What is the most likely way to exploit this?

Accepted Answer

Run the binary with the -p flag. When an SUID binary executes /bin/bash, bash will drop the effective UID unless the -p (privileged) flag is used. Running the binary with '-p' preserves the effective UID, granting a root shell. Simply running the binary may result in a shell with the original user's privileges.

Answer

Use GTFOBins to find a suitable exploit

Answer

Perform a buffer overflow on the binary

Answer

Modify the PATH to include a fake binary

Question 7

A penetration tester is assessing a web application that uses JSON Web Tokens (JWT) for authentication. The tester discovers that the server does not validate the signature algorithm properly. Which attack should the tester attempt to forge a valid token?

Accepted Answer

Use 'alg:none'. If the server accepts 'none' algorithm, the token can be forged without a signature.

Answer

Brute-force the secret key

Answer

KID injection

Answer

Algorithm confusion attack

Question 8

Which Metasploit command is used to interact with an established session on a compromised host?

Accepted Answer

sessions. The sessions command lists and interacts with active sessions.

Answer

use

Answer

exploit

Answer

run

Question 9

A tester is performing a Cross-Site Request Forgery (CSRF) attack on a web application that uses SameSite cookies. Which SameSite attribute value is most likely to prevent the attack?

Accepted Answer

SameSite=Strict. SameSite=Lax prevents CSRF for state-changing requests from cross-site, while Strict is even more restrictive. None allows third-party cookies.

Answer

SameSite=None

Answer

SameSite=Secure

Answer

SameSite=Lax

Question 10

A penetration tester has gained access to a Linux server and wants to move laterally to a Windows server. The tester captured a hash of a domain user. Which tool can be used to authenticate to the Windows server using the hash?

Accepted Answer

evil-winrm. evil-winrm supports pass-the-hash authentication over WinRM, allowing lateral movement.

Answer

Ligolo-ng

Answer

SSH

Answer

Chisel

Question 11

A tester is performing a Kerberoasting attack. After requesting TGS tickets, which hashcat mode should be used to crack them?

Accepted Answer

-m 13100. Kerberoast tickets are TGS-REP hashes, mode 13100.

Answer

-m 1000

Answer

-m 18200

Answer

-m 5500

Question 12

A penetration tester is conducting an internal network assessment. The tester wants to perform a man-in-the-middle attack to capture credentials. Which TWO tools can be used for ARP spoofing?

Accepted Answer

Ettercap. Bettercap and Ettercap are both capable of ARP spoofing.

Answer

Responder

Answer

Nmap

Answer

Hashcat

Question 13

During a post-exploitation phase, a tester needs to establish persistence on a Windows target. Which THREE methods are commonly used for persistence on Windows?

Accepted Answer

Registry Run keys. Scheduled tasks, registry Run keys, and WMI subscriptions are common persistence mechanisms. Pass-the-hash is lateral movement, and cron jobs are Linux-specific.

Answer

Pass-the-hash

Answer

Cron jobs

Question 14

A penetration tester is exploiting a web application and discovers an XML External Entity (XXE) vulnerability. Which TWO attacks can be performed using XXE?

Accepted Answer

Server-Side Request Forgery (SSRF). XXE can be used to read local files via external entities and also to perform SSRF by making the server request internal resources.

Answer

Remote code execution

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 15

A penetration tester is conducting a network attack and wants to intercept traffic between two hosts on the same local network by spoofing ARP responses. Which tool is specifically designed for this purpose?

Accepted Answer

Bettercap. Bettercap is a powerful tool that includes ARP spoofing capabilities for man-in-the-middle attacks on local networks.

Answer

Responder

Answer

Hashcat

Answer

John the Ripper