PT0-002 Tools and Code Analysis — 25 Questions

Question 1

During a penetration test, you are asked to identify all live hosts on a subnet. Which Nmap scan type is most likely to evade firewalls and determine if a host is up without completing the TCP handshake?

Accepted Answer

SYN scan (-sS). SYN scan (half-open) sends SYN packets and listens for SYN-ACK; it never completes the handshake, making it stealthier and useful for firewall evasion.

Answer

Ping sweep (-sn)

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Question 2

A penetration tester wants to exploit a vulnerable service on a target using a known module. Which framework provides a large database of exploit modules, payloads, and post-exploitation tools?

Accepted Answer

Metasploit Framework. The Metasploit Framework (option D) is the correct answer because it is specifically designed as a penetration testing platform that includes a vast, regularly updated database of exploit modules, payloads, and post-exploitation tools. This framework allows a tester to select a known module for a vulnerable service, configure a payload, and execute the exploit against a target, making it the standard tool for this purpose.

Answer

Burp Suite

Answer

Wireshark

Answer

Nmap

Question 3

During a web application test, a penetration tester needs to modify an HTTP request in real-time, send it repeatedly with different parameter values, and analyze the responses. Which Burp Suite tool is best suited for this task?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automated, customizable attacks that send multiple HTTP requests with varying parameter values (payloads) and analyze responses. It supports real-time modification of requests, payload positions, and response analysis, making it the ideal tool for fuzzing, brute-forcing, and parameter testing during a web application penetration test.

Answer

Repeater

Answer

Proxy

Answer

Sequencer

Question 4

After gaining initial access to a Windows domain controller, a tester wants to extract password hashes from the SAM database and domain account hashes. Which Impacket tool is designed for this purpose?

Accepted Answer

secretsdump.py. D is correct because secretsdump.py is the Impacket tool specifically designed to extract password hashes from the SAM database and domain account hashes (NTDS.dit) on a Windows domain controller. It can perform remote dump operations using techniques like DRSUAPI replication or volume shadow copy, making it the standard choice for credential harvesting in penetration testing.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

wmiexec.py

Question 5

A penetration tester has captured a WPA2 handshake. Which tool from the Aircrack-ng suite is used to crack the pre-shared key?

Accepted Answer

aircrack-ng. Aircrack-ng (option D) is the tool in the Aircrack-ng suite specifically designed to crack WPA2 pre-shared keys (PSK) by performing an offline dictionary or brute-force attack against the captured four-way handshake. It uses the handshake data (specifically the EAPOL frames) to derive the Pairwise Master Key (PMK) and verify it against candidate passphrases, making it the correct choice for this task.

Answer

airmon-ng

Answer

airodump-ng

Answer

aireplay-ng

Question 6

During a code review of a PHP web application, you encounter the following code: $result = mysql_query("SELECT * FROM users WHERE username='" . $_GET['user'] . "'");. Which vulnerability does this represent?

Accepted Answer

SQL injection. Direct concatenation of user input into SQL query without sanitization or parameterization is classic SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 7

A tester needs to brute-force SSH credentials on a target. Which tool is most appropriate for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer

Aircrack-ng

Answer

Hashcat

Answer

John the Ripper

Question 8

In a Python script for a penetration test, you need to craft a custom TCP packet with specific flags. Which library is best suited for low-level packet manipulation?

Accepted Answer

scapy. Scapy allows crafting, sending, and sniffing network packets at a low level, supporting custom TCP flags.

Answer

requests

Answer

socket

Answer

impacket

Question 9

Which tool is used for security auditing of AWS environments and can enumerate misconfigurations in IAM, S3, and other services?

Accepted Answer

Pacu. Pacu is an open-source AWS security testing framework designed for offensive security audits. It includes modules that enumerate and exploit misconfigurations in IAM policies, S3 bucket permissions, and other AWS services, making it the correct tool for this specific purpose.

Answer

CrackMapExec

Answer

Prowler

Answer

ScoutSuite

Question 10

During a reverse engineering task on a .NET binary, which tool would allow you to decompile the code into readable C# source code?

Accepted Answer

dnSpy. dnSpy is a .NET decompiler that can produce high-level source code from .NET assemblies.

Answer

IDA Pro Free

Answer

Ghidra

Answer

jadx

Question 11

A tester wants to perform an evil twin attack to capture WPA handshakes. Which tool from the Aircrack-ng suite is used to deauthenticate clients from a legitimate AP to force reconnection to the rogue AP?

Accepted Answer

aireplay-ng. aireplay-ng can send deauthentication packets to disconnect clients, facilitating handshake capture.

Answer

airmon-ng

Answer

airodump-ng

Answer

aircrack-ng

Question 12

Which PowerShell script is commonly used for post-exploitation enumeration of Active Directory, such as querying user accounts and group memberships?

Accepted Answer

PowerView. PowerView (option D) is a PowerShell script within the PowerSploit framework specifically designed for post-exploitation enumeration of Active Directory. It provides cmdlets like Get-NetUser, Get-NetGroup, and Get-NetComputer to query user accounts, group memberships, and domain trust relationships via LDAP queries, making it the correct choice for this task.

Answer

Nishang

Answer

Empire

Answer

Invoke-Mimikatz

Question 13

A penetration tester is analyzing a network capture with Wireshark. Which TWO of the following are common uses of Wireshark in a pentest?

Accepted Answer

Identifying cleartext protocols (e.g., FTP, HTTP) and extracting credentials. Wireshark captures and inspects network traffic at the packet level. It can identify cleartext protocols like FTP (port 21) and HTTP (port 80), which transmit data without encryption, allowing an attacker to extract credentials directly from the payload. This is a passive reconnaissance technique, not an active attack.

Answer

Brute-forcing SSH credentials

Answer

Performing active vulnerability scanning of hosts

Answer

Cracking WPA2 handshakes directly

Question 14

During a cloud security assessment of AWS, a tester wants to identify misconfigurations using automated tools. Which THREE tools are specifically designed for AWS security auditing?

Accepted Answer

Pacu. Pacu is an open-source AWS exploitation framework designed for offensive security testing. It automates the identification of misconfigurations, such as overly permissive IAM policies, exposed S3 buckets, and vulnerable Lambda functions, making it a correct choice for cloud security auditing.

Answer

Hashcat

Answer

CrackMapExec

Question 15

A tester is reviewing source code for security vulnerabilities. Which TWO of the following are examples of insecure coding practices that often lead to critical vulnerabilities?

Accepted Answer

Concatenating user input directly into SQL queries. Option B is correct because directly concatenating user input into SQL queries creates SQL injection vulnerabilities. An attacker can inject malicious SQL code through the input, which the database server will execute, potentially leading to data exfiltration, modification, or deletion. This is a classic insecure coding practice that bypasses any input validation if not properly sanitized.

Answer

Validating input with allowlists

Answer

Using parameterized queries for database operations

Answer

Using prepared statements in SQL

Question 16

A penetration tester wants to identify all live hosts and open ports on a network segment. Which Nmap scan type is most efficient for this purpose?

Accepted Answer

Nmap -sS. The -sS option performs a SYN stealth scan, which is fast and less likely to be logged by services, making it efficient for live host and open port discovery.

Answer

Nmap -sP

Answer

Nmap -sU

Answer

Nmap -sT

Question 17

During a web application test, a penetration tester needs to intercept and modify HTTP requests before forwarding them to the server. Which tool is best suited for this task?

Accepted Answer

Burp Suite. Burp Suite's proxy allows intercepting and modifying HTTP/S requests, making it the standard tool for web application testing.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 18

A penetration tester is performing a password cracking task against a dump of NTLM hashes obtained from a Windows domain controller. Which tool would be the most efficient for this task?

Accepted Answer

Hashcat. Hashcat is a GPU-accelerated password cracker that can crack NTLM hashes quickly, especially with a good wordlist and rules.

Answer

Hydra

Answer

John the Ripper

Answer

CrackMapExec

Question 19

A tester wants to perform a Kerberoasting attack against an Active Directory environment. Which Impacket tool would be most appropriate?

Accepted Answer

GetUserSPNs. GetUserSPNs is the correct Impacket tool for Kerberoasting because it queries Active Directory for Service Principal Names (SPNs) associated with user accounts, then requests TGS tickets for those services. These tickets can be cracked offline to recover the service account's password hash, enabling privilege escalation.

Answer

wmiexec

Answer

psexec

Answer

secretsdump

Question 20

During a wireless penetration test, a tester captures WPA2 handshakes but finds they are unable to crack the password using a dictionary attack. Which technique could improve the likelihood of cracking the password?

Accepted Answer

Use aircrack-ng with the -r option to apply rules to the wordlist. Option C is correct because using aircrack-ng with the `-r` option applies rule-based mangling to the wordlist, generating password variations (e.g., appending numbers, capitalizing letters) that are more likely to match the actual passphrase. This technique leverages common password patterns that simple dictionary attacks miss, significantly improving cracking success against WPA2 PSK.

Answer

Switch to John the Ripper with a brute-force attack

Answer

Use Wireshark to analyze the handshake for plaintext hints

Answer

Perform a deauthentication attack to force clients to reconnect and capture additional handshakes