CompTIA PenTest+ (PT0-003) (PT0-003) — Questions 751–777

WhatWeb is a dedicated web technology identification tool that queries the target and analyzes a vast range of indicators, including HTTP headers, meta tags, cookie names, HTML source, and JavaScript variables. Its plugin-based architecture matches thousands of known signatures and reports technologies with confidence levels, covering CMS, frameworks, libraries, and server software. This makes it the correct choice for the stated task of identifying technologies used by a website.

ROP is a technique that defeats DEP by chaining together short instruction sequences—called gadgets—that already exist in executable memory, such as in the C runtime library. Since DEP only prohibits execution from non-executable pages like the stack and heap, ROP never injects or executes new code on those pages; instead, it uses the CPU's ret instruction to jump between gadgets, building arbitrary behavior like calling VirtualProtect or system(). This makes it the correct approach when the stack is non-executable.

Return-Oriented Programming (ROP) defeats DEP because it never places or executes new code in non-executable data pages. Instead, the attacker overwrites the return address chain on the stack to sequentially invoke existing instructions, known as gadgets, each ending with a `ret` instruction. By carefully selecting and chaining gadgets, the attacker can perform arbitrary computations and call APIs, all within executable memory regions, thus evading DEP's instruction execution blocking.

A penetration test report is an objective record of observed vulnerabilities, and filtering out a known issue misrepresents the client's security posture and may misdirect remediation resources. You should explain that all findings must remain in the report regardless of the client's awareness, while offering to present the finding in a controlled manner—such as framing it with mitigation context for management. This maintains integrity while addressing the IT manager's concern about stakeholder reaction, and it upholds the professional standards outlined in the PT0-003 scope.

Configuring the scanner with valid, appropriately privileged credentials is what makes the scan authenticated and is the single most important technical setup step. Without the correct credentials, the scanner reverts to an unauthenticated posture, producing incomplete results that overlook missing patches, insecure registry entries, local privilege escalation paths, and other authentication-dependent vulnerabilities. The credentials must be stored securely, scoped to the engagement, and granted only the permissions needed to enumerate software versions and system configuration without causing unintended changes.

PrintSpoofer is a token impersonation exploit that specifically leverages SeImpersonatePrivilege by creating a malicious named pipe server and then coercing a privileged process—commonly the Print Spooler service—to connect to it. The tool captures the resulting SYSTEM token and uses ImpersonateNamedPipeClient to execute a command with elevated privileges, giving the attacker a SYSTEM shell. It is designed as a modern replacement for JuicyPotato, working reliably on fully patched Windows 10 and Server 2019 builds where older Potato exploits often fail, making it the correct choice.

A black box penetration test supplies the tester with no internal knowledge, only the public-facing scope (e.g., a domain or IP address), requiring full reconnaissance through OSINT and active scanning. This directly matches the stated condition of 'no prior knowledge' because all network topology, application behavior, and potential vulnerabilities must be uncovered from scratch, replicating an external attacker's perspective.

Gobuster is a specialized tool for brute-forcing directories, files, and DNS subdomains using user-supplied wordlists. It generates HTTP requests and evaluates response codes to identify valid paths, making it highly efficient for web application reconnaissance. The tool supports multiple modes (dir, dns, vhost), custom extensions, and threading options, giving testers precise control over enumeration depth and speed. This dedicated focus on resource discovery is exactly what the scenario requires.

BuiltWith is a technology-profile lookup service that aggregates data from its own web crawlers, DNS records, and other public repositories. By querying BuiltWith's API or website, the tester retrieves detailed information about a target's web server, JavaScript frameworks, content management system, analytics tools, and other technology components without sending any packets to the target's infrastructure. This makes it a passive reconnaissance technique because the target never sees direct traffic from the tester, even though a third party (BuiltWith) may have actively scanned the site previously.

Parameterized queries (also known as prepared statements) separate the SQL query structure from the user-supplied data by pre-compiling the SQL statement and then binding parameters as values, never as executable code. When the scanner sends an injection payload such as ' OR 1=1 --, the database treats the entire string as a literal value, not as SQL logic, so the query executes safely and returns no error or behavioral difference. The scanner may still flag the entry point because it detects the presence of the payload in the request or a generic reflection, but the application's response remains benign, producing a false positive. This is precisely the most common reason why automated vulnerability scanners report SQL injection on modern, well-coded applications.

Ghidra is a free, open-source reverse-engineering suite developed by the NSA and includes a built-in decompiler that converts machine code into approximate C pseudocode. It supports a broad range of architectures and runs natively on Linux, making it ideal for analyzing ELF binaries. The decompiler output, though not perfect, dramatically accelerates understanding of program flow and logic, which is exactly what a penetration tester needs.

PrintSpoofer exploits SeImpersonatePrivilege by coercing a privileged process to authenticate against a named pipe it controls, then impersonating the resulting token to obtain SYSTEM. It targets Windows 10 and Server 2019+, where Rotten Potato techniques fail, satisfying the scenario's requirement for a working SeImpersonate escalation path.

When a SUID root binary executes /bin/bash, the kernel sets the effective UID to 0, but Bash normally resets the effective UID to the real UID to prevent privilege abuse. Running the binary with the -p flag forces Bash into privileged mode, preventing that reset and keeping the effective UID at 0. This yields a root shell with the user's real UID unchanged, making it the standard and direct privilege-escalation technique for SUID binaries that invoke a shell. The -p option is therefore the intended method to preserve the elevated privileges.

Mode 22000 is the dedicated Hashcat format for WPA/WPA2, accepting both EAPOL and PMKID data from the four-way handshake. It replaces the older 2500 and 16800 modes and handles the PBKDF2-SHA1 key derivation to test passwords offline. When converting a .cap file with hcxpcapngtool, the resulting .hc22000 file is fed into Hashcat with -m 22000. This is the correct mode for cracking WPA2 handshakes.

Peach Fuzzer is a dedicated fuzzing framework that generates and mutates inputs against network protocol definitions, making it suited to discovering buffer overflows in protocol parsers. General-purpose scanners lack the stateful, protocol-aware mutation needed for this testing.

Cloning the target network's SSID is the essence of an evil twin attack because clients authenticate to networks by name and apparent signal strength rather than by verifying the AP's true identity. The attacker configures a rogue access point to broadcast the exact same SSID as the legitimate network, often also cloning the security type and any captive portal, so that a victim's device will associate with the attacker. Without this SSID masquerade, there is no evil twin with which to perform the subsequent steps of deauthentication and handshake capture.

WPScan is an open-source security scanner purpose-built for WordPress, included by default in distributions like Kali Linux. It enumerates the WordPress core version, installed themes and plugins, user accounts, and backup or configuration files, then cross-references findings against the WPScan API vulnerability database. This allows it to identify known vulnerabilities in plugins and themes that generic scanners often miss. Because the question asks for a tool specifically for evaluating WordPress security, WPScan is the correct answer.

-sn (Ping sweep) is the correct option because it performs host discovery only, sending minimal probes such as ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests (depending on Nmap version and privileges) to determine which hosts respond without scanning any open ports. This makes it the fastest and most efficient method for identifying live hosts across a large subnet, as it does not wait for service banners or full port scans. The -sn flag is designed exactly for this purpose, replacing the old -sP behavior in Nmap.

Listing permitted AWS regions alongside their VPC CIDR ranges directly enforces the US-only data sovereignty constraint, giving testers an unambiguous boundary for scoping. Region names alone cannot identify which subnets fall inside authorised testing limits, so pairing each approved region with its CIDR blocks prevents accidental testing of out-of-scope workloads in other territories.

Securely deleting PII not needed for reporting enforces data minimisation, reducing the retention footprint and breach risk after the engagement. Retaining only what the report requires limits the tester's liability and aligns with privacy regulations governing personal data handling.

The emergency contact is the predefined channel for urgent, time-sensitive findings, and notifying them immediately triggers their incident-response process, enables isolation of affected systems, and starts preservation of forensic evidence. This aligns with the core pen-test rule: you are to report, not remediate, and you should never assume you have the client's authority to take active defensive action. Acting promptly also covers your legal and ethical duty to prevent further harm, which is the primary reason this is the only correct choice.

The Scope and Rules of Engagement section is the formal, legally binding part of the report that enumerates authorized assets, allowed testing windows, exclusion lists, and prohibited techniques. It also specifies data handling and retention procedures to satisfy legal and compliance mandates such as GDPR or PCI-DSS. This makes it the correct section for documenting the engagement's constraints and authorization.

ROP allows the attacker to chain gadgets to call mprotect and change memory permissions on the stack to executable, then jump to shellcode placed on the stack. This bypasses NX while leveraging the known addresses from the statically linked, non-PIE binary.

The -p- flag directs Nmap to scan all 65,535 TCP ports, not just a default list, ensuring that web servers listening on unusual or non-standard ports are discovered. Coupled with -sV, Nmap performs service version detection by probing open ports and analyzing responses to identify the application and version, such as HTTP servers. This combination is the most thorough approach for the goal of identifying hosts running web services across the entire port range. Unlike OS detection or limited port scans, this directly reveals the service type.

The Wayback Machine is an archival service operated by the Internet Archive that crawls the web and stores full snapshots of websites over time, including HTML, CSS, JavaScript, and images. It allows OSINT researchers to query a URL and retrieve the exact version of a page as it appeared on a chosen date, making it the definitive resource for historical website content. Unlike certificate or network-focused search engines, it preserves the actual user-facing content rather than infrastructure metadata.

The executive summary is intended for executives and stakeholders who need a concise, non-technical overview of the assessment's most critical outcomes. A key findings summary distills the most impactful vulnerabilities, their potential business impact, and overall security posture into a format that supports rapid understanding and decision-making. It highlights issues requiring immediate executive attention without overwhelming the audience with technical jargon or exhaustive detail.