PT0-002 Attacks and Exploits Practice Test 7 — 15 Questions

Question 1

A penetration tester is performing a web application test and wants to exploit a SQL injection vulnerability to extract data from a database. The tester knows that the application returns results in the HTTP response. Which type of SQL injection is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

UNION-based. UNION-based SQL injection returns results directly in the application's output.

Answer

Blind boolean-based

Answer

Blind time-based

Answer

Out-of-band

Question 2

A penetration tester discovers a web application that fetches URLs from user input without proper validation. The tester targets the internal cloud metadata endpoint at 169.254.169.254 to retrieve instance credentials. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when the server makes requests to internal resources based on user input, and the cloud metadata endpoint is a common target.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 3

A penetration tester wants to use Metasploit to exploit a remote service. After selecting an exploit module, which command is used to set the remote host IP address?

Accepted Answer

set RHOSTS. In Metasploit, 'set RHOSTS' is used to specify the target IP address.

Answer

set LHOST

Answer

set TARGET

Answer

set LPORT

Question 4

During a Windows privilege escalation attempt, a tester finds that the SeImpersonatePrivilege is enabled for the current user. Which tool can be used to escalate privileges to SYSTEM using this privilege?

Accepted Answer

PrintSpoofer. PrintSpoofer is a tool that exploits SeImpersonatePrivilege to impersonate SYSTEM tokens.

Answer

Mimikatz

Answer

Windows-Exploit-Suggester

Answer

PowerUp

Question 5

A penetration tester is performing an ARP spoofing attack using Bettercap to intercept traffic between a client and the gateway. What is the primary goal of this attack?

Accepted Answer

To intercept and manipulate network traffic. ARP spoofing allows the attacker to intercept traffic, enabling man-in-the-middle attacks to capture or modify data.

Answer

To perform a denial-of-service attack

Answer

To bypass firewall rules

Answer

To crack wireless passwords

Question 6

During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?

Accepted Answer

Chisel. Chisel (A) is correct because it is a fast TCP/UDP tunneling tool written in Go that can run a server on the compromised host and a client locally, creating a SOCKS5 proxy for pivoting into internal networks. Ligolo-ng (D) is correct because it provides a TUN-based reverse tunneling agent that establishes a SOCKS proxy and routes traffic to internal segments without needing a full VPN, making it ideal for pivoting during penetration tests. SSH with the -D flag (E) is correct because it opens a dynamic SOCKS proxy on a local port, allowing the tester to tunnel traffic through the compromised host if SSH access is available. Netcat (B) is not marked correct because, while it can create basic TCP relays, it does not natively provide a SOCKS proxy or full tunneling capability for pivoting. Nmap (C) is not marked correct because it is a port scanner and does not include SOCKS proxy or tunneling features for pivoting.

Answer

Netcat

Answer

Nmap

Question 7

A penetration tester is performing a network attack and wants to intercept traffic between two hosts on the same local network. Which technique should the tester use to redirect traffic through their machine?

Accepted Answer

ARP spoofing. ARP spoofing allows an attacker to associate their MAC address with the IP address of another host, intercepting traffic intended for that host.

Answer

DNS poisoning

Answer

LLMNR poisoning

Answer

SSL stripping

Question 8

During a web application penetration test, the tester discovers a JWT token in the Authorization header. The token uses the 'none' algorithm. What attack should the tester attempt?

Accepted Answer

JWT algorithm confusion attack (alg:none). If the server accepts the 'none' algorithm, the tester can forge tokens by setting the algorithm to 'none' and removing the signature.

Answer

JWT timing attack

Answer

JWT kid injection

Answer

JWT brute-force of the secret

Question 9

A tester has exploited a Linux system and gained a low-privilege shell. The tester runs 'sudo -l' and sees that the current user can run /usr/bin/find as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

GTFOBins technique for find. The find command can be used to execute other commands via its -exec parameter, allowing privilege escalation.

Answer

SUID binary exploitation

Answer

PATH manipulation

Answer

Kernel exploit

Question 10

A penetration tester is performing an NTLM relay attack against a Windows network. The tester uses ntlmrelayx to relay captured NTLM authentication attempts to a target server. What must be true for this attack to succeed?

Accepted Answer

SMB signing must be disabled or not enforced. SMB signing must be disabled or not enforced on the target server, otherwise the relayed authentication will be rejected.

Answer

LLMNR must be enabled

Answer

The relayed hash must be crackable

Answer

The target server must have SMB signing enabled

Question 11

After gaining a foothold on a Windows server, a tester wants to laterally move to another machine. The tester has obtained NTLM hashes and wants to execute commands remotely. Which tool is specifically designed for remote command execution using hashes via WMI?

Accepted Answer

wmiexec. wmiexec.py (from Impacket) allows executing commands via WMI using NTLM hashes.

Answer

evil-winrm

Answer

psexec

Answer

CrackMapExec

Question 12

A penetration tester wants to crack NTLM hashes captured during an internal test. Which hashcat mode should the tester use for NTLM hashes?

Accepted Answer

1000. Hashcat mode 1000 is specifically for NTLM hashes.

Answer

0

Answer

22000

Answer

13100

Question 13

A tester is performing a web application test and discovers a parameter that seems to reflect input in the response. The tester attempts a reflected XSS payload but the application filters script tags. Which XSS variant should the tester try next?

Accepted Answer

Reflected XSS with event handlers. If script tags are filtered, HTML event handlers like onerror can still execute JavaScript.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 14

During a penetration test, the tester gains a Meterpreter session on a Windows target and wants to escalate privileges to SYSTEM. The current user has the SeImpersonatePrivilege token. Which tool should the tester use to exploit this privilege?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits the SeImpersonatePrivilege to impersonate SYSTEM tokens.

Answer

Windows-Exploit-Suggester

Answer

whoami /priv

Answer

Mimikatz

Question 15

A tester is performing a Kerberoasting attack. After requesting TGS tickets for accounts with SPNs, what is the next step to obtain plaintext credentials?

Accepted Answer

Crack the TGS tickets using Hashcat or John the Ripper. Kerberoasting involves cracking the TGS tickets offline to recover the service account password.

Answer

Pass-the-ticket to access services

Answer

Relay the TGS tickets to another server

Answer

Use the TGS tickets for silver ticket attacks