11 questions · Attacks and Exploits · All types, answers revealed
During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?
This is the link-local address for cloud metadata.
Why this answer
AWS metadata is accessible at 169.254.169.254, a link-local address.
During a web application test, you find a feature that allows users to export data as PDF. The PDF generation uses user input without sanitization. You inject an XML external entity that reads /etc/passwd and the content appears in the PDF. Which vulnerability is present?
XXE uses external entities to read files.
Why this answer
XXE (XML External Entity) allows reading files via XML entities when the parser is vulnerable.
During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)
Time-based blind uses delays to infer data.
Why this answer
UNION-based and blind time-based are common SQL injection techniques for data extraction.
In a web application test, you find a parameter that directly references internal object IDs (e.g., user_id=123) and changing the ID allows access to another user's data. This vulnerability is known as:
IDOR allows unauthorized access to objects by modifying reference values.
Why this answer
IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references without proper access control checks.
A tester is performing an SQL injection attack on a login form. The tester inputs a single quote (') and receives a database error. The application returns different responses for true and false conditions. Which type of SQL injection is most likely occurring?
Blind SQL injection uses conditional responses to infer information.
Why this answer
Blind SQL injection occurs when no error messages are shown, but the application behaves differently based on true/false conditions. Error-based injection shows database errors. UNION-based requires visible output.
Time-based uses delays.
During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?
Chisel is a fast TCP/UDP tunnel over HTTP.
Why this answer
SSH dynamic port forwarding (-D), chisel, and ligolo-ng are all tools for creating SOCKS proxies or tunnels for pivoting.
A penetration tester uses Hashcat to crack NTLM hashes captured during a pass-the-hash attack. Which Hashcat mode should the tester use for NTLM hashes?
Mode 1000 is for NTLM.
Why this answer
Hashcat mode -m 1000 is for NTLM hashes. Other modes correspond to different hash types.
A penetration tester wants to perform a pass-the-hash attack against a Windows system. Which tool can be used to authenticate using the NTLM hash instead of a password?
CrackMapExec can use NTLM hashes for authentication via pass-the-hash.
Why this answer
CrackMapExec supports pass-the-hash authentication with NTLM hashes.
A penetration tester is performing a web application test and identifies a potential SQL injection vulnerability. Which TWO methods can the tester use to confirm the vulnerability and extract data?
Uses time delays to infer data.
Why this answer
UNION-based and blind time-based are classic SQL injection techniques. XSS and command injection are different attacks. XXE is also different.
During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?
PrintSpoofer leverages SeImpersonatePrivilege to get SYSTEM.
Why this answer
PrintSpoofer exploits SeImpersonatePrivilege to escalate to SYSTEM.
During a Windows privilege escalation attempt, the tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool is commonly used to exploit this privilege to gain SYSTEM?
PrintSpoofer leverages SeImpersonatePrivilege to escalate to SYSTEM.
Why this answer
PrintSpoofer exploits SeImpersonatePrivilege to impersonate SYSTEM and spawn a shell.
Ready to test yourself?
Try a timed practice session using only Attacks and Exploits questions.