PT0-002 Attacks and Exploits Practice Test 8 — 15 Questions

Question 1

A penetration tester is conducting a web application test and discovers an XML External Entity (XXE) vulnerability. Which of the following attacks can the tester perform using XXE? (Choose THREE.)

Accepted Answer

Read sensitive files from the server. XXE can be used to read files, perform SSRF, and cause denial of service via entity expansion.

Answer

SQL injection through entity values

Answer

Remote code execution

Question 2

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR and NBT-NS responses on the internal network. Which tool is most commonly used for this type of attack?

Accepted Answer

Responder. Responder is a widely used tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

ntlmrelayx

Answer

Bettercap

Answer

Hashcat

Question 3

A penetration tester has gained a low-privilege shell on a Windows server and discovers the user has the SeImpersonatePrivilege. Which tool could the tester use to escalate privileges to SYSTEM?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to escalate privileges on Windows.

Answer

Mimikatz

Answer

SharpHound

Answer

PowerUp

Question 4

During a web application test, the tester discovers a parameter that reflects user input in the response without proper encoding. The tester crafts a payload that executes JavaScript when another user views the page. Which type of XSS is this, and what is a primary risk?

Accepted Answer

Reflected XSS; risk of session hijacking. Reflected XSS executes in the victim's browser when the malicious link is clicked, allowing session hijacking.

Answer

Stored XSS; risk of data theft from database

Answer

Blind XSS; risk of internal network scanning

Answer

DOM-based XSS; risk of client-side logic bypass

Question 5

A penetration tester needs to crack NTLM hashes obtained from a Windows domain. The hashes are in the format used by Windows. Which hashcat mode should the tester use?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 6

A penetration tester wants to perform a pass-the-hash attack against a Windows system using a captured NTLM hash. Which tool can be used to authenticate and execute commands remotely?

Accepted Answer

pth-winexe. pth-winexe allows pass-the-hash authentication to Windows systems.

Answer

evil-winrm

Answer

Responder

Answer

Hashcat

Question 7

During an internal penetration test, the tester wants to relay captured NTLM authentication to a server to gain access. Which tool from the Impacket suite is specifically designed for NTLM relay attacks?

Accepted Answer

ntlmrelayx. ntlmrelayx is the Impacket tool for relaying NTLM authentication.

Answer

CrackMapExec

Answer

Metasploit

Answer

Responder

Question 8

A tester wants to crack a password hash using a wordlist combined with rules to generate variations. Which hashcat attack mode should be used?

Accepted Answer

-a 0 with -r. Mode 0 with rule files applies rules to a wordlist.

Answer

-a 3

Answer

-a 6

Answer

-a 1

Question 9

After compromising a Windows workstation, the tester wants to extract password hashes from the local SAM database. Which Metasploit meterpreter command should be used?

Accepted Answer

hashdump. hashdump dumps the SAM database hashes.

Answer

getsystem

Answer

getuid

Answer

shell

Question 10

A penetration tester is conducting a web application test and discovers an XML External Entity (XXE) vulnerability. Which of the following attacks can the tester perform using XXE? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Accessing the AWS metadata endpoint at 169.254.169.254. SSRF can access internal services like cloud metadata endpoints and perform internal port scans.

Answer

Crafting a JavaScript payload for XSS

Answer

Injecting SQL queries into the URL

Answer

Forcing the server to send a POST request

Question 11

A penetration tester has gained initial access to a Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for persistence on Linux systems?

Accepted Answer

Installing an SSH authorized_key for the attacker. Cron jobs, SSH authorized_keys, and systemd services are common persistence mechanisms.

Answer

Using schtasks to create a scheduled task

Answer

Modifying the Windows Registry Run key

Question 12

A penetration tester runs the following command: `hashcat -m 1000 -a 0 hashes.txt rockyou.txt`. What type of attack is being performed?

Accepted Answer

Dictionary attack. The command uses mode 1000 (NTLM) and attack mode 0 (dictionary) with rockyou.txt wordlist. This is a dictionary attack.

Answer

Brute-force attack

Answer

Hybrid attack

Answer

Rule-based attack

Question 13

During a penetration test, a tester captures NTLM hashes using Responder. Which of the following techniques would allow the tester to authenticate to a remote server without cracking the password?

Accepted Answer

Pass-the-hash. Pass-the-hash uses captured NTLM hashes to authenticate directly, bypassing the need to crack the password.

Answer

LLMNR poisoning

Answer

Kerberoasting

Answer

Rainbow table attack

Question 14

A penetration tester is performing a web application test and discovers that the application reflects user input in the response without proper sanitization. However, the tester notices that the input is handled client-side via JavaScript. Which type of XSS is this?

Accepted Answer

DOM-based XSS. DOM-based XSS occurs when the vulnerability exists in client-side JavaScript rather than server-side reflection.

Answer

Stored XSS

Answer

Reflected XSS

Answer

Blind XSS

Question 15

A tester is exploiting a Linux system and finds a binary with the SUID bit set owned by root. The binary executes other commands. Which technique would allow privilege escalation to root?

Accepted Answer

PATH manipulation. If a SUID binary executes commands (e.g., via system() or exec()), it may be exploited to run arbitrary commands as root, especially if the path is not absolute.

Answer

DLL hijacking

Answer

Kernel exploit

Answer

Token impersonation