PT0-002 Tools and Code Analysis — 50 Questions

Question 1

A penetration tester wrote a Python script to automate HTTP request fuzzing. The script uses the 'requests' library to send payloads and checks for reflected content in the response. The tester wants to analyze the script for potential improvements. Which of the following code changes would MOST directly reduce false positives in detecting reflection?

Accepted Answer

Convert the response to lowercase before checking for reflection. Option A directly reduces false positives by normalizing the case of the response before checking for reflected content. HTTP responses may contain the payload in different cases (e.g., 'Test' vs 'test'), and without case-insensitive matching, the script would miss reflections that differ only in case, incorrectly reporting a false negative. Converting to lowercase ensures that any case variation of the reflected payload is detected, thereby reducing false positives from case-sensitive mismatches.

Answer

Add a random delay between requests

Answer

Remove the User-Agent header from requests

Answer

Use a session object to maintain cookies

Question 2

A penetration tester is analyzing a PowerShell script used for post-exploitation on a Windows domain. The script contains the following line: Invoke-Command -ComputerName $target -ScriptBlock { get-process -Name "explorer" }. What is the primary purpose of this command?

Accepted Answer

To check if a user is logged in on the remote system. The `Get-Process -Name 'explorer'` command retrieves the Explorer process, which runs only when a user is interactively logged into the Windows desktop. If the command returns a process object, it confirms a user session is active on the remote system. This is a common post-exploitation technique to verify user presence before executing further actions like keylogging or token theft.

Answer

To start the Explorer process on a remote system

Answer

To enumerate running processes on the remote system

Answer

To execute a script block locally on the remote system

Question 3

A penetration tester wants to identify live hosts on a large internal network. Which Nmap option would be the FASTEST for initial host discovery?

Accepted Answer

-sn (Ping sweep). The -sn option performs a ping sweep, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. It does not perform port scanning, making it the fastest method for initial host discovery on a large internal network because it only checks for host availability without enumerating services.

Answer

-sV (Version detection)

Answer

-sS (SYN stealth scan)

Answer

-A (Aggressive scan)

Question 4

A penetration tester writes a Python script to test an API for vulnerabilities. The script sends requests with multiple payloads and checks if the response contains an error message indicating a potential injection. Which of the following code snippets would BEST reduce false positives by verifying that the injected parameter is processed?

Accepted Answer

Compare the response of the injected request to the response of a benign request with the same parameter structure. Option D is correct because comparing the response of an injected request to a benign request with the same parameter structure directly confirms that the injected parameter was processed and caused a different application behavior, thereby reducing false positives. This technique, often called differential analysis, isolates the effect of the injection from normal variations in the API response, such as dynamic content or session tokens. It is more reliable than checking for specific error messages or status codes, which may be suppressed or generic.

Answer

Check if the response status code is 500 for each payload

Answer

Compare the response time of the injected request to a baseline without injection

Answer

Check if the response contains a specific error message that is only triggered when the injection is successful

Question 5

A penetration tester is reviewing a Python script that uses the `requests` library to send HTTP POST requests to a login endpoint. The script attempts to bypass authentication by sending SQL injection payloads in the username field. Which of the following code changes would MOST effectively help the tester identify successful injections by reducing false negatives?

Accepted Answer

Parsing the response for specific error messages such as 'SQL syntax' or 'mysql_fetch_array'. Option B is correct because parsing the HTTP response for database-specific error messages (e.g., 'SQL syntax', 'mysql_fetch_array') directly indicates that the SQL injection payload triggered a detectable database error, confirming a successful injection. This reduces false negatives by catching cases where the login fails but the injection still executes, rather than relying solely on authentication bypass (which may not occur if the injection is blind or the query structure differs).

Answer

Using a `requests.Session` object to maintain cookies across requests

Answer

Implementing a random delay between requests to avoid rate limiting

Answer

Adding a function to automatically resend each payload multiple times

Question 6

A penetration tester writes a Python script to test for directory traversal vulnerabilities in a web application. The script uses the requests library to send a payload like '../../etc/passwd' and checks if the response contains the string 'root:'. However, the tester notices many false negatives because the application requires URL encoding of the dots and slashes. Which code modification would BEST improve the detection rate?

Accepted Answer

URL-encode the payload using urllib.parse.quote(). Option B is correct because the penetration tester's script is failing to detect directory traversal vulnerabilities due to the web application requiring URL-encoded characters. By using `urllib.parse.quote()` to URL-encode the dots and slashes in the payload (e.g., `%2e%2e%2f` for `../`), the request matches the application's expected input format, reducing false negatives. This directly addresses the root cause—encoding—rather than adding more payloads or changing the detection method.

Answer

Increase the number of payloads in the list

Answer

Check the HTTP status code instead of response content

Answer

Use raw sockets to send HTTP requests manually

Question 7

A penetration tester wants to enumerate SMB shares, user lists, and operating system information from a Windows target without authenticating. Which of the following tools is BEST suited for this task?

Accepted Answer

enum4linux. enum4linux is a Perl wrapper around tools like smbclient, nmblookup, and nbtscan, specifically designed to extract SMB shares, user lists, and OS information from Windows targets without authentication by leveraging null sessions and SMB RPC calls (e.g., via MSRPC over SMB). It automates the enumeration of these details using the Server Message Block (SMB) protocol, making it the best choice for unauthenticated reconnaissance.

Answer

smbclient

Answer

nmblookup

Answer

nbtscan

Question 8

A penetration tester is reviewing a Python script that attempts to exploit a command injection vulnerability. The script uses the 'subprocess' module with the 'shell=True' argument. Which of the following code changes would be MOST effective to reduce the risk of unintended consequences when executing system commands?

Accepted Answer

Avoid using shell=True and pass the command as a list of arguments. Option C is correct because setting `shell=True` in Python's `subprocess` module causes the command string to be interpreted by the system shell, which introduces command injection risks if any part of the string is user-controlled. By passing the command as a list of arguments (e.g., `['ls', '-l', filename]`) and omitting `shell=True`, the subprocess module directly executes the binary without shell interpretation, eliminating shell metacharacter injection. This is the most effective mitigation as it avoids shell parsing entirely, which is the root cause of the vulnerability.

Answer

Replace subprocess with os.system()

Answer

Use the 'shlex.quote()' function to sanitize user input before passing to subprocess

Answer

Use the 'exec()' function to run the command

Question 9

A penetration tester is writing a Bash script to automate enumeration of a Linux system after gaining a shell. The script needs to extract user information from the /etc/passwd file. Which command would be most efficient for listing only the usernames?

Accepted Answer

cat /etc/passwd | cut -d: -f1. Option A is correct because the `cut` command with `-d: -f1` splits each line of /etc/passwd on the colon delimiter and extracts the first field, which is the username. This is the most efficient and purpose-built approach for parsing colon-delimited files in Linux, avoiding unnecessary overhead from other tools.

Answer

cat /etc/passwd | awk '{print $1}'

Answer

cat /etc/passwd | head

Answer

grep 'user' /etc/passwd

Question 10

A penetration tester is analyzing a Python script that uses the Impacket library to perform an SMB relay attack. The script is failing to capture NTLM hashes from target machines. Which part of the script is MOST likely misconfigured?

Accepted Answer

The listener IP address. In an SMB relay attack using Impacket, the listener IP address must be set to the attacker's IP address where the relayed authentication is received. If the listener IP is misconfigured (e.g., set to the target's IP or left as localhost), the relay server will not receive the forwarded NTLM hashes, causing the capture to fail. This is a common configuration error when using Impacket's 'smbrelayx' or similar scripts.

Answer

The target IP address

Answer

The SMB version negotiation

Answer

The authentication method (NTLMv1 vs NTLMv2)

Question 11

A penetration tester is using Burp Suite to test a web application. The tester notices that the application relies on client-side JavaScript validation to restrict input. To bypass this validation and test for server-side vulnerabilities, which Burp Suite feature is MOST useful for automatically modifying requests before they are sent to the server?

Accepted Answer

Proxy (with Match and Replace rules). The Proxy's Match and Replace rules allow the tester to automatically modify HTTP requests in transit, such as stripping or altering client-side validation parameters (e.g., maxlength, pattern attributes) before they reach the server. This bypasses client-side JavaScript restrictions because the modifications occur after the browser's validation but before the request is forwarded to the server, enabling direct testing of server-side input handling.

Answer

Intruder

Answer

Repeater

Answer

Decoder

Question 12

A penetration tester is writing a Bash script to enumerate users from the /etc/passwd file on a compromised Linux system. Which command will efficiently print only the usernames?

Accepted Answer

cut -d: -f1 /etc/passwd. Option A is correct because the `cut` command with `-d:` sets the field delimiter to colon (the separator in /etc/passwd) and `-f1` extracts the first field, which is the username. This is the most efficient and straightforward method for this specific task, as it directly isolates the username column without pattern matching or processing overhead.

Answer

awk -F: '{print $1}' /etc/passwd

Answer

grep -o '^[^:]*' /etc/passwd

Answer

sed 's/:.*//' /etc/passwd

Question 13

A penetration tester is analyzing a Python script that uses the 'paramiko' library to automate SSH key-based authentication across multiple servers. The script fails with 'AuthenticationException' for some servers that the tester is certain have the correct private key configured. Which of the following is the most likely cause of this failure?

Accepted Answer

The SSH server host key is not in the known_hosts file.. The 'paramiko' library in Python handles SSH key-based authentication by first verifying the server's host key against the known_hosts file. If the host key is missing or mismatched, paramiko raises an AuthenticationException before even attempting client key authentication, even if the private key is correct. This is because paramiko enforces host key verification by default to prevent man-in-the-middle attacks, and a failure at this stage blocks the authentication process entirely.

Answer

The servers are running a different SSH version.

Answer

The public key is not in the server's authorized_keys file.

Answer

The username specified is incorrect.

Question 14

A penetration tester is writing a return-oriented programming (ROP) exploit for a Linux binary to bypass Data Execution Prevention (DEP). The binary has DEP enabled, but the tester identifies a gadget in a dynamically linked library that is not affected by ASLR. Which condition must be true for the ROP chain to succeed?

Accepted Answer

The library must be loaded at a fixed address. Option A is correct because for a ROP chain to succeed when DEP is enabled, the attacker needs to control the execution flow by chaining together gadgets (small instruction sequences ending with a return) that reside in executable memory regions. If a dynamically linked library is not affected by ASLR, it means it is loaded at a fixed, predictable address, allowing the tester to reliably use gadgets from that library without needing to bypass ASLR for that specific module. This fixed address ensures the ROP chain's addresses are valid across runs, which is essential for the exploit to work.

Answer

The stack must be executable

Answer

The binary must be compiled with stack canaries

Answer

The exploit must bypass ASLR for the main binary

Question 15

A penetration tester is using Burp Suite to intercept and modify HTTP traffic. When browsing to an HTTPS site, the tester observes that the requests are encrypted and not being intercepted by Burp. Which configuration step is most likely missing?

Accepted Answer

The Burp CA certificate has not been installed in the browser's trust store. Burp Suite intercepts HTTPS traffic by acting as a man-in-the-middle, which requires the browser to trust Burp's self-signed CA certificate. Without installing the Burp CA certificate in the browser's trust store, the browser will refuse to establish a TLS connection through the proxy, leaving requests encrypted end-to-end and invisible to Burp.

Answer

The proxy listener is not configured to listen on the correct port

Answer

The browser's proxy settings are not configured to use Burp

Answer

The target site is not in Burp's scope

Question 16

A penetration tester wants to quickly capture and analyze network packets during an internal test to identify unencrypted protocols. Which command-line tool is commonly used for packet capture on Linux?

Accepted Answer

tcpdump. tcpdump is the standard command-line packet capture tool on Linux, allowing the tester to capture raw network packets and filter them by protocol (e.g., HTTP, FTP, Telnet) to identify unencrypted traffic. It uses libpcap to capture packets at the network interface level, making it ideal for quickly analyzing plaintext protocols during an internal penetration test.

Answer

nslookup

Answer

nmap

Answer

netcat

Question 17

A penetration tester is using an Nmap NSE script to enumerate SMB shares on a target Windows server. The script runs without errors but returns no shares, even though the server has shares configured. Which is the MOST likely cause?

Accepted Answer

The script requires administrative credentials. The Nmap SMB enumeration scripts (e.g., smb-enum-shares.nse) by default attempt to connect as a guest or anonymous user. On modern Windows servers, especially those with default security configurations, anonymous access to SMB shares is disabled. The script requires valid administrative credentials to list all shares, as the SMB protocol restricts share enumeration to authenticated users with appropriate privileges.

Answer

The target is running Windows 10 with SMB signing enabled

Answer

The script is not being run with the correct arguments

Answer

The target is blocking ICMP traffic

Question 18

A penetration tester has obtained a dump of NTLM password hashes from a Windows Domain Controller. The tester wants to crack these hashes as quickly as possible using GPU acceleration. Which tool is the BEST choice for this task?

Accepted Answer

Hashcat. Hashcat (Option B) is the best choice because it is specifically designed for GPU-accelerated password cracking, supporting NTLM hashes with the -m 1000 mode. It leverages OpenCL or CUDA to parallelize cracking across thousands of GPU cores, making it significantly faster than CPU-based tools for large hash dumps. John the Ripper can use GPUs but requires additional configuration and is generally slower for NTLM hashes, while Ophcrack is limited to LM hashes and cannot handle NTLM hashes at all.

Answer

John the Ripper

Answer

Ophcrack

Answer

THC-Hydra

Question 19

A penetration tester is writing a Bash script to automate the extraction of password hashes from a Windows system after gaining SYSTEM-level access. The script uses 'reg.exe' to save the SAM and SYSTEM hives. Which command should the tester include in the script to export the SAM hive to a file?

Accepted Answer

reg save HKLM\SAM sam.hive. The correct command is 'reg save HKLM\SAM sam.hive' because 'reg save' creates a binary copy of the specified registry hive, which is necessary for offline extraction of password hashes. The SAM hive contains the hashed credentials, and saving it as a file allows tools like 'samdump2' or 'secretsdump.py' to parse the hashes. The other options either export in a non-binary format or use a non-existent command.

Answer

reg export HKLM\SAM sam.hive

Answer

reg backup HKLM\SAM sam.hive

Answer

reg copy HKLM\SAM sam.hive

Question 20

A penetration tester wants to quickly identify the listening services on a target Linux server without performing a full port scan. The tester has obtained an unauthenticated shell as a low-privileged user. Which built-in command is most likely available on a modern Linux distribution to list all listening TCP sockets?

Accepted Answer

ss -tlnp. Option B is correct because `ss -tlnp` is the modern replacement for `netstat` on Linux distributions that have deprecated `netstat` (e.g., RHEL 7+, Ubuntu 16.04+). It uses the `netlink` interface to read socket information directly from the kernel, making it faster and more reliable than parsing `/proc/net/tcp`. The flags `-t` (TCP), `-l` (listening), `-n` (numeric addresses/ports), and `-p` (show process) precisely list all listening TCP sockets without requiring root privileges for basic socket listing.

Answer

netstat -tlnp

Answer

lsof -i

Answer

ifconfig -a