PT0-002 Tools and Code Analysis Practice Test 4 — 15 Questions

Question 1

A penetration tester is reviewing a Bash script that contains the following command: 'openssl s_client -connect target:443 -servername target 2>/dev/null | openssl x509 -noout -text'. What is the primary purpose of this command?

Accepted Answer

Extract the SSL certificate in text form.. The command uses `openssl s_client` to establish a TLS connection to `target:443` and then pipes the certificate output to `openssl x509 -noout -text`, which decodes and prints the certificate in human-readable text form. The primary purpose is to retrieve and display the SSL/TLS certificate details (e.g., issuer, subject, validity dates, SANs) for inspection, not to attack or test cipher suites.

Answer

Perform a man-in-the-middle attack.

Answer

Test for weak cipher suites.

Answer

Verify the certificate's revocation status.

Question 2

A penetration tester is analyzing a Python script used during a test. The script contains the following code: 'import requests; r = requests.get('http://target', headers={'User-Agent': 'Mozilla/5.0'}); print(r.text)'. What is the primary purpose of setting the User-Agent header in this script?

Accepted Answer

To mimic a legitimate browser to evade detection by web application firewalls.. Setting the User-Agent header to 'Mozilla/5.0' makes the HTTP request appear to originate from a standard web browser rather than a Python script. This helps evade detection by web application firewalls (WAFs) and other security controls that may block or flag requests with non-browser User-Agent strings, which are common indicators of automated or malicious traffic.

Answer

To bypass IP-based rate limiting.

Answer

To authenticate to the web server.

Answer

To enable SSL/TLS encryption.

Question 3

A penetration tester is analyzing a Bash script that automates a password spraying attack. The script contains the following loop: 'for user in $(cat users.txt); do for pass in $(cat passwords.txt); do curl -s -o /dev/null -w "%{http_code}" --data "user=$user&pass=$pass" http://target/login; done; done'. The script runs but the output is a continuous stream of HTTP status codes that are hard to interpret. Which improvement would most effectively help the tester identify a successful login?

Accepted Answer

Add a conditional statement that checks if the HTTP status code is 302 (redirect) or 200, and if so, prints the successful credentials.. Option C is correct because the script currently outputs a raw stream of HTTP status codes with no context. Adding a conditional to check for 302 (redirect, often indicating a successful login) or 200 (OK) and printing the corresponding credentials allows the tester to immediately identify which user/password pair succeeded, turning an unreadable output into actionable intelligence.

Answer

Add a delay with 'sleep 1' between requests to avoid rate limiting.

Answer

Pipe the output to 'grep -v 200' to exclude any responses that are not 200 OK.

Answer

Use 'curl -v' to see the full response headers.

Question 4

A penetration tester is analyzing a Python script that uses the 'scapy' library. The script contains the line: `packet = IP(dst='10.0.0.1')/TCP(dport=80, flags='S')`. The tester then uses `sr1(packet, timeout=2)`. What is the primary purpose of this code?

Accepted Answer

Perform a TCP SYN scan to determine if port 80 is open. The code constructs an IP packet with destination 10.0.0.1 and a TCP segment with destination port 80 and the SYN flag set (flags='S'). The sr1() function sends this packet and waits for a response (up to 2 seconds). This is the classic technique for a TCP SYN scan: if a SYN-ACK is received, the port is open; if an RST is received, the port is closed. The primary purpose is therefore to probe whether port 80 on the target is open.

Answer

Perform a DNS resolution for the target IP

Answer

Send a TCP ACK packet to test firewall rules

Answer

Complete a full TCP three-way handshake

Question 5

A penetration tester is analyzing a Ruby script that uses the 'metasploit-framework' gem. The script includes a line: `Msf::Simple::Framework.create` and then calls `run_single('use exploit/multi/handler')`. What is the primary purpose of this script?

Accepted Answer

Set up a Metasploit payload handler to catch reverse shells. The script uses `Msf::Simple::Framework.create` to instantiate a Metasploit Framework instance and then calls `run_single('use exploit/multi/handler')` to load the multi/handler module. This module is specifically designed to listen for incoming connections from payloads (e.g., reverse shells) that have been executed on a target, making the script's primary purpose to set up a handler to catch reverse shells.

Answer

Automate a port scan across multiple targets

Answer

Create a Metasploit resource script for automated attacks

Answer

Load and execute a local exploit against a specified target

Question 6

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP requests with a custom header that mimics a mobile device. The script also uses 'beautifulsoup4' to parse the response and extract specific data. Which task is this script most likely performing?

Accepted Answer

Web scraping to gather publicly available information.. The script uses the 'requests' library to send HTTP requests with a custom header mimicking a mobile device, and 'beautifulsoup4' to parse the HTML response and extract data. This combination is specifically designed for web scraping, where the custom header helps avoid bot detection by making the request appear to come from a mobile browser, and BeautifulSoup extracts targeted information from the page structure.

Answer

Fuzzing for SQL injection.

Answer

Performing a brute-force attack on a login form.

Answer

Testing for directory traversal vulnerabilities.

Question 7

A penetration tester is analyzing a PowerShell script that uses the 'Invoke-Command' cmdlet to execute commands on remote machines, and 'Set-Service' to change service startup types. What attack is this script most likely performing?

Accepted Answer

Remote service modification for persistence.. The script uses Invoke-Command to execute commands on remote machines and Set-Service to change service startup types. This combination is commonly used to modify a service to start automatically or to create a new service that runs malicious code, establishing persistence on a remote system. The attack does not involve lateral movement via PsExec (which uses SMB and service control manager differently) nor credential dumping (which requires tools like Mimikatz or direct memory access).

Answer

Lateral movement via PsExec.

Answer

Credential dumping.

Answer

Data exfiltration.

Question 8

A penetration tester is analyzing a Python script that uses the 'socket' module to create a TCP connection to a target IP and port. The script then sends a payload (e.g., 'GET / HTTP/1.0

') and waits for a response. Which tool function is this script most likely performing?

Accepted Answer

Banner grabbing. The script creates a TCP connection, sends an HTTP GET request, and waits for a response. This is the classic behavior of banner grabbing, where the goal is to retrieve the service banner (e.g., HTTP server version) from the target. The 'socket' module is used to manually craft the connection and payload, which is a low-level technique for service identification, not for scanning multiple ports or assessing vulnerabilities.

Answer

Port scanning

Answer

Vulnerability scanning

Answer

Password cracking

Question 9

A penetration tester is reviewing a Bash script that uses 'nmap' with the '-sC' and '-sV' flags. The script runs the scan and saves the output to a text file. Later, the tester uses 'grep' to extract lines containing 'open'. What is the primary purpose of this script?

Accepted Answer

Identify all open ports and services running on them. The '-sC' flag runs default NSE scripts (which perform service enumeration and basic checks), and '-sV' enables version detection. Together, they identify open ports and the services/versions running on them. The subsequent 'grep' for 'open' extracts lines showing open ports, confirming the primary purpose is to enumerate open ports and their associated services.

Answer

Perform a vulnerability scan using NSE scripts

Answer

Detect the operating system of the target

Answer

Perform a stealthy SYN scan

Question 10

A penetration tester is analyzing a Python script that uses the 'scapy' library to craft custom network packets. The relevant code is: ```python from scapy.all import * packet = IP(dst="192.168.1.1")/TCP(dport=80, flags="S") response = sr1(packet, timeout=2) if response.haslayer(TCP): print(response.getlayer(TCP).flags) ``` What is the primary goal of this script?

Accepted Answer

To perform a SYN scan and determine if port 80 is open. The script uses Scapy to craft a TCP SYN packet (flags='S') to port 80 and sends it with sr1(), which waits for a single response. If a TCP layer is present in the reply, it prints the flags. This is the classic behavior of a SYN scan (half-open scan): it sends a SYN and analyzes the response to determine if the port is open (SYN-ACK) or closed (RST), without completing the handshake. Option B correctly identifies this as a SYN scan to check if port 80 is open.

Answer

To perform a TCP connect scan by completing the three-way handshake

Answer

To send an HTTP GET request and capture the web page

Answer

To perform a UDP scan on port 80

Question 11

A penetration tester is analyzing a PowerShell script used during an internal test. The script contains the following code block: ```powershell $cred = Get-Credential $session = New-PSSession -ComputerName 'Server01' -Credential $cred Invoke-Command -Session $session -ScriptBlock { Get-ChildItem C:\Secrets.txt } Remove-PSSession $session ``` What is the primary purpose of this script?

Accepted Answer

To achieve lateral movement and access a file on a remote server. The script uses Get-Credential to obtain user credentials, creates a remote PowerShell session (PSSession) to Server01 via New-PSSession, and then executes Get-ChildItem C:\Secrets.txt on that remote server using Invoke-Command. This is the classic pattern for lateral movement: authenticating to a remote host and accessing a file stored there, not performing any local privilege escalation or password brute-forcing.

Answer

To perform a local privilege escalation using stored credentials

Answer

To brute-force the password of the user account via 'Get-Credential'

Answer

To execute a script from the remote server using the ScriptBlock

Question 12

A Python proof-of-concept sends repeated login attempts but does not preserve cookies between requests. The application sets a CSRF token in a session cookie. What change is most likely required for accurate testing?

Accepted Answer

Use a requests.Session object and refresh the CSRF token before each attempt.. The correct answer is A because the proof-of-concept fails to maintain session state across requests, which is essential for handling CSRF tokens that are typically tied to a session. Using a `requests.Session` object automatically persists cookies (including the session cookie containing the CSRF token) across requests, and refreshing the CSRF token before each attempt ensures the token is valid for each login attempt, mimicking real browser behavior.

Answer

Remove all headers from the requests.

Answer

Increase the payload length only.

Answer

Disable TLS certificate verification as the main fix.

Question 13

A penetration tester is analyzing a Bash script used for post-exploitation enumeration. The script contains the line: `cat /etc/shadow | awk -F: '{print $1, $2}'`. What is the primary purpose of this command?

Accepted Answer

Display all usernames and their associated password hashes. The command `cat /etc/shadow | awk -F: '{print $1, $2}'` reads the shadow file, which stores user account information including password hashes. The `-F:` sets the field separator to colon, and `{print $1, $2}` outputs the first field (username) and second field (password hash). This is a common post-exploitation technique to extract password hashes for offline cracking.

Answer

Show the number of users in the system

Answer

Extract the usernames and home directories

Answer

List the account expiration dates

Question 14

Drag and drop the steps to perform a vulnerability scan using Nessus into the correct order.

Question 15

Drag and drop the steps to perform a social engineering campaign using a phishing email with a malicious attachment into the correct order.