PT0-002 Vulnerability Discovery and Analysis — 30 Questions

Question 1

During a penetration test, you are asked to identify all live hosts on a subnet. Which Nmap scan type is most likely to evade firewalls and determine if a host is up without completing the TCP handshake?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN scan (-sS). SYN scan (half-open) sends SYN packets and listens for SYN-ACK; it never completes the handshake, making it stealthier and useful for firewall evasion.

Answer

Ping sweep (-sn)

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Question 2

A penetration tester wants to exploit a vulnerable service on a target using a known module. Which framework provides a large database of exploit modules, payloads, and post-exploitation tools?

Accepted Answer

Metasploit Framework. The Metasploit Framework (option D) is the correct answer because it is specifically designed as a penetration testing platform that includes a vast, regularly updated database of exploit modules, payloads, and post-exploitation tools. This framework allows a tester to select a known module for a vulnerable service, configure a payload, and execute the exploit against a target, making it the standard tool for this purpose.

Answer

Burp Suite

Answer

Wireshark

Answer

Nmap

Question 3

During a web application test, a penetration tester needs to modify an HTTP request in real-time, send it repeatedly with different parameter values, and analyze the responses. Which Burp Suite tool is best suited for this task?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automated, customizable attacks that send multiple HTTP requests with varying parameter values (payloads) and analyze responses. It supports real-time modification of requests, payload positions, and response analysis, making it the ideal tool for fuzzing, brute-forcing, and parameter testing during a web application penetration test.

Answer

Repeater

Answer

Proxy

Answer

Sequencer

Question 4

After gaining initial access to a Windows domain controller, a tester wants to extract password hashes from the SAM database and domain account hashes. Which Impacket tool is designed for this purpose?

Accepted Answer

secretsdump.py. D is correct because secretsdump.py is the Impacket tool specifically designed to extract password hashes from the SAM database and domain account hashes (NTDS.dit) on a Windows domain controller. It can perform remote dump operations using techniques like DRSUAPI replication or volume shadow copy, making it the standard choice for credential harvesting in penetration testing.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

wmiexec.py

Question 5

During a code review of a PHP web application, you encounter the following code: $result = mysql_query("SELECT * FROM users WHERE username='" . $_GET['user'] . "'");. Which vulnerability does this represent?

Accepted Answer

SQL injection. Direct concatenation of user input into SQL query without sanitization or parameterization is classic SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 6

A tester needs to brute-force SSH credentials on a target. Which tool is most appropriate for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer

Aircrack-ng

Answer

Hashcat

Answer

John the Ripper

Question 7

In a Python script for a penetration test, you need to craft a custom TCP packet with specific flags. Which library is best suited for low-level packet manipulation?

Accepted Answer

scapy. Scapy allows crafting, sending, and sniffing network packets at a low level, supporting custom TCP flags.

Answer

requests

Answer

socket

Answer

impacket

Question 8

During a reverse engineering task on a .NET binary, which tool would allow you to decompile the code into readable C# source code?

Accepted Answer

dnSpy. dnSpy is a .NET decompiler that can produce high-level source code from .NET assemblies.

Answer

IDA Pro Free

Answer

Ghidra

Answer

jadx

Question 9

A tester wants to perform an evil twin attack to capture WPA handshakes. Which tool from the Aircrack-ng suite is used to deauthenticate clients from a legitimate AP to force reconnection to the rogue AP?

Accepted Answer

aireplay-ng. aireplay-ng can send deauthentication packets to disconnect clients, facilitating handshake capture.

Answer

airmon-ng

Answer

airodump-ng

Answer

aircrack-ng

Question 10

Which PowerShell script is commonly used for post-exploitation enumeration of Active Directory, such as querying user accounts and group memberships?

Accepted Answer

PowerView. PowerView (option D) is a PowerShell script within the PowerSploit framework specifically designed for post-exploitation enumeration of Active Directory. It provides cmdlets like Get-NetUser, Get-NetGroup, and Get-NetComputer to query user accounts, group memberships, and domain trust relationships via LDAP queries, making it the correct choice for this task.

Answer

Nishang

Answer

Empire

Answer

Invoke-Mimikatz

Question 11

A penetration tester is analyzing a network capture with Wireshark. Which TWO of the following are common uses of Wireshark in a pentest?

Accepted Answer

Identifying cleartext protocols (e.g., FTP, HTTP) and extracting credentials. Wireshark captures and inspects network traffic at the packet level. It can identify cleartext protocols like FTP (port 21) and HTTP (port 80), which transmit data without encryption, allowing an attacker to extract credentials directly from the payload. This is a passive reconnaissance technique, not an active attack.

Answer

Brute-forcing SSH credentials

Answer

Performing active vulnerability scanning of hosts

Answer

Cracking WPA2 handshakes directly

Question 12

A tester is reviewing source code for security vulnerabilities. Which TWO of the following are examples of insecure coding practices that often lead to critical vulnerabilities?

Accepted Answer

Concatenating user input directly into SQL queries. Directly concatenating user input into SQL queries creates SQL injection vulnerabilities. An attacker can inject malicious SQL code through the input, which the database server will execute, potentially leading to data exfiltration, modification, or deletion. This is a classic insecure coding practice that bypasses any input validation if not properly sanitized.

Answer

Validating input with allowlists

Answer

Using parameterized queries for database operations

Answer

Using prepared statements in SQL

Question 13

A penetration tester wants to identify all live hosts and open ports on a network segment. Which Nmap scan type is most efficient for this purpose?

Accepted Answer

Nmap -sS. The -sS option performs a SYN stealth scan, which is fast and less likely to be logged by services, making it efficient for live host and open port discovery.

Answer

Nmap -sP

Answer

Nmap -sU

Answer

Nmap -sT

Question 14

During a web application test, a penetration tester needs to intercept and modify HTTP requests before forwarding them to the server. Which tool is best suited for this task?

Accepted Answer

Burp Suite. Burp Suite's proxy allows intercepting and modifying HTTP/S requests, making it the standard tool for web application testing.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 15

A penetration tester is performing a password cracking task against a dump of NTLM hashes obtained from a Windows domain controller. Which tool would be the most efficient for this task?

Accepted Answer

Hashcat. Hashcat is a GPU-accelerated password cracker that can crack NTLM hashes quickly, especially with a good wordlist and rules.

Answer

Hydra

Answer

John the Ripper

Answer

CrackMapExec

Question 16

A tester wants to perform a Kerberoasting attack against an Active Directory environment. Which Impacket tool would be most appropriate?

Accepted Answer

GetUserSPNs. GetUserSPNs is the correct Impacket tool for Kerberoasting because it queries Active Directory for Service Principal Names (SPNs) associated with user accounts, then requests TGS tickets for those services. These tickets can be cracked offline to recover the service account's password hash, enabling privilege escalation.

Answer

wmiexec

Answer

psexec

Answer

secretsdump

Question 17

During a wireless penetration test, a tester captures WPA2 handshakes but finds they are unable to crack the password using a dictionary attack. Which technique could improve the likelihood of cracking the password?

Accepted Answer

Use aircrack-ng with the -r option to apply rules to the wordlist. Using aircrack-ng with the `-r` option applies rule-based mangling to the wordlist, generating password variations (e.g., appending numbers, capitalizing letters) that are more likely to match the actual passphrase. This technique leverages common password patterns that simple dictionary attacks miss, significantly improving cracking success against WPA2 PSK.

Answer

Switch to John the Ripper with a brute-force attack

Answer

Use Wireshark to analyze the handshake for plaintext hints

Answer

Perform a deauthentication attack to force clients to reconnect and capture additional handshakes

Question 18

A penetration tester is reviewing a Python script used for a custom exploit. Which of the following code snippets contains a dangerous function that could lead to remote code execution?

Accepted Answer

eval(user_input). The `eval()` function in Python interprets and executes the string passed to it as a Python expression. If an attacker can control the `user_input` string, they can inject arbitrary Python code, leading to remote code execution (RCE). This is a classic dangerous function in Python that should never be used with untrusted input.

Answer

input('Enter name:')

Answer

open(filename, 'r')

Answer

subprocess.run(['ls'])

Question 19

A tester decompiles a .NET application using dnSpy and finds a function that loads a serialized object from a file. Which vulnerability is most likely present?

Accepted Answer

Insecure deserialization. The function loads a serialized object from a file, which is a classic indicator of insecure deserialization. In .NET, deserializing untrusted data without validation can allow an attacker to execute arbitrary code or manipulate application logic, as the runtime reconstructs objects from the serialized stream. dnSpy decompilation revealing this pattern directly points to the risk of insecure deserialization.

Answer

Path traversal

Answer

SQL injection

Answer

Hardcoded credentials

Question 20

A tester needs to enumerate Windows domain users and groups from a compromised system. Which PowerShell script would be most useful?

Accepted Answer

PowerView. PowerView is a PowerShell tool specifically designed for Windows domain enumeration, allowing testers to query Active Directory for users, groups, computers, and permissions via LDAP. It leverages the Active Directory Services Interface (ADSI) to gather detailed information without requiring additional privileges beyond those already obtained on the compromised system.

Answer

Invoke-Mimikatz

Answer

Prowler

Answer

ScoutSuite