mediumMultiple ChoiceObjective-mapped

PT0-002 Practice Question: A penetration tester has gained initial access to…

A penetration tester has gained initial access to a Linux server through a vulnerable web application. The server has a restrictive outbound firewall that only allows traffic on ports 80, 443, and 53. The tester wants to establish a reverse shell that is likely to bypass the firewall. Which of the following techniques would be most effective?

⚠ Common exam trap

Candidates often assume a reverse shell on a non-standard port (like 3389) will work because it's a common service port, but the firewall's explicit allow list (80, 443, 53) makes any other port blocked, and DNS tunneling is the only technique that leverages an allowed protocol for covert communication.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a reverse shell over DNS by encoding commands in DNS queries

DNS traffic on port 53 is typically allowed through restrictive outbound firewalls, and encoding reverse shell commands within DNS queries allows the tester to tunnel traffic over DNS, bypassing the firewall's port restrictions. Tools like dnscat2 or iodine can encapsulate TCP data in DNS requests, making the reverse shell appear as legitimate DNS traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use a reverse shell listener on TCP port 3389 and connect from the target
Why it's wrong here
TCP port 3389 is the default port for Remote Desktop Protocol (RDP), and many egress firewalls are configured to block non-essential or high-risk services like RDP, even if inbound RDP is allowed. In this scenario, the firewall only permits outbound traffic on ports 80, 443, and 53, so a reverse shell on 3389 will be dropped. Additionally, using a well-known RDP port may trigger intrusion detection alerts that look for remote administration traffic. The tester must choose a channel that matches the explicitly allowed egress rules, such as DNS.
✗
Use a bind shell on the target's port 4444 and connect directly
Why it's wrong here
A bind shell opens a listening port on the target, but outbound connectivity from the tester to that port may be blocked by firewalls on the tester's side, and inbound connections to the target are likely also restricted.
✓
Use a reverse shell over DNS by encoding commands in DNS queries
Why this is correct
A DNS reverse shell works by encoding command output and input inside DNS queries and responses, using tools like dnscat2 or iodine. Because UDP/TCP port 53 is typically allowed outbound for name resolution, this tunnel bypasses the firewall's egress restrictions without raising immediate alarms. The DNS protocol is often not deeply inspected by firewalls, allowing the attacker to encapsulate arbitrary data in query names and response records. This makes it a reliable and stealthy method when the only allowed ports are 80, 443, and 53.
✗
Use a reverse shell on TCP port 8080 and hope it is not blocked
Why it's wrong here
TCP port 8080 is commonly used for HTTP proxies and alternate web servers, but it is not part of the firewall rule set that explicitly allows only ports 80, 443, and 53. An outbound connection on port 8080 will be silently dropped by the egress filter, so the reverse shell will never reach the tester's listener. This approach relies on an assumption that the firewall might leave additional ports open, which is not supported by the stated policy. Successful pivoting requires either using an allowed port or tunneling through an allowed protocol like DNS.

Go deeper

PT0-002 Practice Question: A penetration tester has gained initial access to…

Why each option matters

Option-by-option breakdown

Related to this question