PT0-002 Vulnerability Discovery and Analysis Practice Test 2 — 15 Questions

Question 1

A tester wants to perform a Kerberoasting attack against an Active Directory environment. Which Impacket tool would be most appropriate?

Accepted Answer

GetUserSPNs. GetUserSPNs is the correct Impacket tool for Kerberoasting because it queries Active Directory for Service Principal Names (SPNs) associated with user accounts, then requests TGS tickets for those services. These tickets can be cracked offline to recover the service account's password hash, enabling privilege escalation.

Answer

wmiexec

Answer

psexec

Answer

secretsdump

Question 2

During a wireless penetration test, a tester captures WPA2 handshakes but finds they are unable to crack the password using a dictionary attack. Which technique could improve the likelihood of cracking the password?

Accepted Answer

Use aircrack-ng with the -r option to apply rules to the wordlist. Using aircrack-ng with the `-r` option applies rule-based mangling to the wordlist, generating password variations (e.g., appending numbers, capitalizing letters) that are more likely to match the actual passphrase. This technique leverages common password patterns that simple dictionary attacks miss, significantly improving cracking success against WPA2 PSK.

Answer

Switch to John the Ripper with a brute-force attack

Answer

Use Wireshark to analyze the handshake for plaintext hints

Answer

Perform a deauthentication attack to force clients to reconnect and capture additional handshakes

Question 3

A penetration tester is reviewing a Python script used for a custom exploit. Which of the following code snippets contains a dangerous function that could lead to remote code execution?

Accepted Answer

eval(user_input). The `eval()` function in Python interprets and executes the string passed to it as a Python expression. If an attacker can control the `user_input` string, they can inject arbitrary Python code, leading to remote code execution (RCE). This is a classic dangerous function in Python that should never be used with untrusted input.

Answer

input('Enter name:')

Answer

open(filename, 'r')

Answer

subprocess.run(['ls'])

Question 4

A tester decompiles a .NET application using dnSpy and finds a function that loads a serialized object from a file. Which vulnerability is most likely present?

Accepted Answer

Insecure deserialization. The function loads a serialized object from a file, which is a classic indicator of insecure deserialization. In .NET, deserializing untrusted data without validation can allow an attacker to execute arbitrary code or manipulate application logic, as the runtime reconstructs objects from the serialized stream. dnSpy decompilation revealing this pattern directly points to the risk of insecure deserialization.

Answer

Path traversal

Answer

SQL injection

Answer

Hardcoded credentials

Question 5

A tester needs to enumerate Windows domain users and groups from a compromised system. Which PowerShell script would be most useful?

Accepted Answer

PowerView. PowerView is a PowerShell tool specifically designed for Windows domain enumeration, allowing testers to query Active Directory for users, groups, computers, and permissions via LDAP. It leverages the Active Directory Services Interface (ADSI) to gather detailed information without requiring additional privileges beyond those already obtained on the compromised system.

Answer

Invoke-Mimikatz

Answer

Prowler

Answer

ScoutSuite

Question 6

Which tool would be best for capturing and analyzing network packets to troubleshoot a web application?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is designed specifically for deep packet inspection, allowing you to capture live network traffic and analyze individual packets at multiple OSI layers. For troubleshooting a web application, you can filter HTTP/HTTPS requests and responses, examine TCP handshakes, and identify latency or payload issues, which is essential for diagnosing performance or functional problems.

Answer

Nmap

Answer

Burp Suite

Answer

Aircrack-ng

Question 7

A penetration tester wants to exploit a Windows system using a known vulnerability and gain a meterpreter session. Which tool is most appropriate?

Accepted Answer

Metasploit Framework. Metasploit Framework (B) is the most appropriate tool because it provides a comprehensive exploit development and execution environment, including pre-built modules for known Windows vulnerabilities and seamless integration with Meterpreter payloads. Unlike the other options, Metasploit is specifically designed to deliver a Meterpreter session after exploitation, handling payload generation, staging, and post-exploitation tasks natively.

Answer

CrackMapExec

Answer

Impacket

Answer

Hydra

Question 8

During a source code review of a PHP application, the tester finds the following line: $query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'"; Which vulnerability is present?

Accepted Answer

SQL injection. Concatenating user input directly into an SQL query without sanitization leads to SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 9

A tester needs to perform an online brute-force attack against an SSH service. Which tool is most suitable?

Accepted Answer

Hydra. Hydra is a fast online brute-force tool that supports many protocols including SSH.

Answer

Hashcat

Answer

John the Ripper

Answer

Aircrack-ng

Question 10

A penetration tester is conducting a wireless assessment and wants to capture WPA handshakes for offline cracking. Which two tools from the Aircrack-ng suite would be used? (Choose two.)

Accepted Answer

airodump-ng. Airodump-ng captures packets and handshakes, while aireplay-ng can deauthenticate clients to force handshake capture. Option C is a duplicate of A and thus not a separate tool. Airmon-ng manages monitor mode but does not capture handshakes; aircrack-ng cracks handshakes offline but does not capture them.

Answer

airmon-ng

Answer

airodump-ng

Answer

aircrack-ng

Question 11

A tester has compromised a Linux server and wants to maintain persistence. Which three actions would be typical for post-exploitation? (Choose three.)

Accepted Answer

Install a web shell in the web root directory. Persistence techniques allow a tester to regain access to a compromised system. Installing a web shell (B) provides immediate access via a web interface. Creating a new user with root privileges (D) creates a backdoor account that can be used for future access. Adding an SSH public key (E) enables passwordless SSH access to the root account. While changing the root password (A) can also provide access, it is often not considered a primary persistence technique because it can alert the administrator and is less stealthy. Disabling SELinux (C) is a defense evasion technique, not persistence.

Answer

Change the root password to a known value

Answer

Disable SELinux

Question 12

A penetration tester is reviewing code for insecure deserialization vulnerabilities. Which two languages are commonly associated with this vulnerability? (Choose two.)

Accepted Answer

Java. Java and .NET deserialization vulnerabilities are well-known and have been exploited in many frameworks.

Answer

Ruby

Answer

Python

Answer

PHP

Question 13

A penetration tester has been given a target IP address and needs to quickly determine which services are running on the target. Which Nmap option should the tester use to perform a SYN scan with service version detection and default NSE scripts?

Accepted Answer

nmap -sS -sV -sC 192.168.1.10. The -sS flag initiates a SYN stealth scan, -sV enables service version detection by probing open ports to determine application and version information, and -sC runs the default set of NSE scripts for common enumeration tasks. Together, these three options fulfill the requirement to quickly identify running services with version details and additional script-based reconnaissance, all while using a half-open TCP scan to minimize log generation.

Answer

nmap -sT -sV -sC 192.168.1.10

Answer

nmap -A 192.168.1.10

Answer

nmap -sS -O 192.168.1.10

Question 14

During a web application penetration test, the tester captures a login request in Burp Suite and wants to automate a brute-force attack against the password field. Which Burp Suite tool is specifically designed for this purpose?

Accepted Answer

Intruder. Intruder is the correct tool because it is specifically designed for automated customized attacks, including brute-force attacks, against web application parameters. It allows the tester to define a payload position (e.g., the password field in a login request) and iterate through a list of candidate passwords, automatically resending the request with each payload value and analyzing the responses.

Answer

Scanner

Answer

Sequencer

Answer

Repeater

Question 15

A penetration tester needs to perform a Kerberoasting attack against a Windows Active Directory environment. Which tool from the Impacket suite should the tester use to request service tickets and extract TGS hashes for offline cracking?

Accepted Answer

GetUserSPNs.py. GetUserSPNs.py in the Impacket suite is used to find and request service principal names (SPNs) and retrieve TGS hashes for Kerberoasting.

Answer

wmiexec.py

Answer

secretsdump.py

Answer

psexec.py