PT0-002 Attacks and Exploits Practice Test 4 — 15 Questions

Question 1

During a web application test, the tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester modifies the JWT header to set the algorithm to 'none' and removes the signature. The server accepts the token. What type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

JWT algorithm confusion (alg:none). Setting the JWT algorithm to 'none' exploits a misconfiguration where the server does not enforce signature verification, leading to JWT algorithm confusion.

Answer

JWT injection

Answer

JWT session stealing

Answer

JWT secret brute-force

Question 2

A penetration tester needs to escalate privileges on a Linux system and finds that the user can run a script with sudo that has a vulnerable argument. Which resource should the tester consult to find exploitation techniques for common sudo misconfigurations?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be exploited to bypass local security restrictions, including sudo misconfigurations.

Answer

Exploit-DB

Answer

Metasploit

Answer

CVE Details

Question 3

A penetration tester obtains a meterpreter session on a Windows target. Which command would the tester use to check the current user's privileges and potentially escalate privileges if SeImpersonatePrivilege is enabled?

Accepted Answer

getsystem. The 'getsystem' command in meterpreter attempts to escalate privileges using various techniques, including token impersonation if SeImpersonatePrivilege is available.

Answer

sysinfo

Answer

getuid

Answer

hashdump

Question 4

During a penetration test, a tester wants to crack NTLM hashes captured from a Windows domain. Which hashcat mode should the tester use for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 13100

Answer

-m 22000

Answer

-m 0

Question 5

A penetration tester is performing a web application test and wants to exploit a SQL injection vulnerability to extract data from a database. The tester knows that the application returns results in the HTTP response. Which type of SQL injection is being used?

Accepted Answer

UNION-based. UNION-based SQL injection returns results directly in the application's output.

Answer

Blind boolean-based

Answer

Blind time-based

Answer

Out-of-band

Question 6

A penetration tester discovers a web application that fetches URLs from user input without proper validation. The tester targets the internal cloud metadata endpoint at 169.254.169.254 to retrieve instance credentials. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when the server makes requests to internal resources based on user input, and the cloud metadata endpoint is a common target.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 7

A penetration tester wants to use Metasploit to exploit a remote service. After selecting an exploit module, which command is used to set the remote host IP address?

Accepted Answer

set RHOSTS. In Metasploit, 'set RHOSTS' is used to specify the target IP address.

Answer

set LHOST

Answer

set TARGET

Answer

set LPORT

Question 8

During a Windows privilege escalation attempt, a tester finds that the SeImpersonatePrivilege is enabled for the current user. Which tool can be used to escalate privileges to SYSTEM using this privilege?

Accepted Answer

PrintSpoofer. PrintSpoofer is a tool that exploits SeImpersonatePrivilege to impersonate SYSTEM tokens.

Answer

Mimikatz

Answer

Windows-Exploit-Suggester

Answer

PowerUp

Question 9

A penetration tester is performing an ARP spoofing attack using Bettercap to intercept traffic between a client and the gateway. What is the primary goal of this attack?

Accepted Answer

To intercept and manipulate network traffic. ARP spoofing allows the attacker to intercept traffic, enabling man-in-the-middle attacks to capture or modify data.

Answer

To perform a denial-of-service attack

Answer

To bypass firewall rules

Answer

To crack wireless passwords

Question 10

A tester finds a Linux binary with the SUID bit set that is owned by root and can be executed by any user. The binary is known to have a vulnerability that allows arbitrary code execution. Which command does the tester use to find all SUID binaries on the system?

Accepted Answer

find / -perm /4000. The 'find / -perm /4000' command locates files with the SUID bit set (4000 permission).

Answer

ls -la /bin/su

Answer

find / -perm /2000

Answer

find / -type f -perm 0777

Question 11

A penetration tester has compromised a Linux server and wants to establish persistence. Which TWO of the following methods are commonly used for persistence on Linux?

Accepted Answer

Adding an SSH public key to authorized_keys. Cron jobs and SSH authorized_keys are standard persistence techniques on Linux.

Answer

Registry Run keys

Answer

WMI subscriptions

Answer

Creating a new service

Question 12

A penetration tester is assessing an Active Directory environment and wants to perform Kerberoasting to obtain service account passwords. Which TWO conditions are required for a successful Kerberoasting attack?

Accepted Answer

The attacker must be able to request TGS tickets from the domain controller. A domain account with a Service Principal Name (SPN) and the ability to request a TGS ticket are required for Kerberoasting.

Answer

The service account password must be weak

Answer

The domain must be using NTLM authentication

Answer

The attacker must have domain admin privileges

Question 13

A penetration tester is performing a network attack and wants to intercept traffic between two hosts on the same local network. Which technique should the tester use to redirect traffic through their machine?

Accepted Answer

ARP spoofing. ARP spoofing allows an attacker to associate their MAC address with the IP address of another host, intercepting traffic intended for that host.

Answer

DNS poisoning

Answer

LLMNR poisoning

Answer

SSL stripping

Question 14

During a penetration test, the tester captured an NTLM hash using Responder and wants to pass the hash to gain access to a remote Windows system. Which tool would be most appropriate to perform a pass-the-hash attack?

Accepted Answer

pth-winexe. pth-winexe allows authenticating to Windows systems using an NTLM hash without the plaintext password.

Answer

John the Ripper

Answer

CrackMapExec

Answer

Hashcat

Question 15

A penetration tester is performing a SQL injection test on a web application. The tester sends the payload ' OR '1'='1 and receives the same response as with a normal request. However, when sending ' OR '1'='2, the response differs. Which type of SQL injection is most likely present?

Accepted Answer

Blind SQL injection (boolean-based). A difference in responses between a true condition and a false condition indicates blind SQL injection, specifically boolean-based blind.

Answer

Time-based blind SQL injection

Answer

Error-based SQL injection

Answer

UNION-based SQL injection