Attacks and Exploits practice questions

Metasploit's hashdump module

Why wrong: Metasploit's hashdump module is a post-exploitation tool, not a credential-capture mechanism. It requires the attacker to already have administrative or SYSTEM-level access to a compromised Windows machine because it reads the local SAM database through low-level API calls. In an unauthenticated internal assessment, where the goal is to capture credentials from network traffic, hashdump is irrelevant because it provides no way to intercept or trigger an authentication challenge over the wire.

Hashcat with a wordlist attack

Why wrong: Hashcat is an offline password-cracking utility that operates on hash files that have already been obtained, such as NTLMv2 captures from Responder or NTDS.dit dumps. It does not have any network capture capabilities, so it cannot interact with LLMNR, NBT-NS, mDNS, or any other live protocol. Without a previously acquired hash, running a wordlist attack against an empty or nonexistent input is impossible, making it a post-capture step rather than a method for initially acquiring credentials.

Bettercap with ARP spoofing

Why wrong: Bettercap with ARP spoofing places the attacker in line for network traffic by poisoning the ARP cache of the target and gateway, but simply rerouting packets does not elicit an NTLMv2 challenge-response. To capture hashes, the redirected traffic must include SMB authentication attempts, and modern defenses like SMB signing or Kerberos can thwart passive extraction. Unlike Responder, ARP spoofing does not actively impersonate a name-query request to force a client to authenticate; it can be detected via ARP monitoring and is not a reliable way to just grab NTLM hashes in an internal assessment.

DOM-based XSS

Why wrong: DOM-based XSS is incorrect because the vulnerability occurs entirely client-side in the browser's JavaScript environment, where attacker-controlled data flows from a source like location.search or document.referrer to a sink such as innerHTML or document.write, never being included in the server's HTTP response. Since the parameter value is found echoed directly in the server response, the attack vector is not a DOM manipulation issue, but a server-side reflection of input.

Stored XSS

Why wrong: Stored XSS is incorrect because the payload would need to be persisted on the server, for example in a database, message board, or log file, and then delivered to other users when that stored data is later retrieved and rendered. In this case, the tester's parameter is reflected immediately in the current response without any indication that it is saved server-side or displayed to other users later, which is the defining characteristic of reflected, not stored, XSS.

SQL injection

Why wrong: SQL injection is incorrect because it targets the database layer by injecting malicious SQL syntax into queries, typically resulting in authentication bypass, data leakage, or database errors. The direct echo of the parameter into the HTML response demonstrates a lack of output encoding in the web application layer, not a flaw in SQL query construction, and there is no evidence that the parameter influences a database query or generates database-driven responses.

AlwaysInstallElevated

Why wrong: AlwaysInstallElevated is a Windows registry setting that, when enabled, allows non-privileged users to run MSI packages with elevated (SYSTEM) privileges. This is a valid privilege escalation technique if the user can craft or modify a Windows Installer package, but it does not involve modifying or exploiting the executable path of an existing Windows service. The scenario specifically targets a service running with SYSTEM, so the exploitation vector must be tied to the service's binary path or its loading behavior, not to a separate MSI installation policy.

Token impersonation

Why wrong: Token impersonation is a post-exploitation technique where an attacker uses a stolen or duplicated access token to impersonate a privileged user, often after abusing SeImpersonatePrivilege or exploiting a service to capture a token. It requires an existing token to steal or an interactive service that passes tokens, so it does not directly explain how an attacker would gain code execution by manipulating a service's path. In the context of a vulnerable service binary path, the attacker plants a malicious executable in a directory that the OS will attempt to run due to an unquoted path, which is different from leveraging an already available token.

DLL hijacking

Why wrong: DLL hijacking involves placing a malicious DLL into a location where a legitimate executable will load it, typically by exploiting the Windows DLL search order (e.g., placing a file in the current directory or a system directory). This technique requires the attacker to identify a DLL that the service imports and to have the ability to write to a directory searched by the executable, but it does not rely on the service path being unquoted. Because the scenario explicitly involves a service running with SYSTEM, the most direct exploitation is to replace the service binary or insert a binary into the unquoted path search order, not to hijack a DLL load, which is a separate and more complex attack vector.

Hashcat

Why wrong: Hashcat is a powerful, GPU-accelerated offline password recovery tool that cracks NTLM, NTLMv2, and many other hash types by comparing candidate plaintexts' computed hashes. It does not have any network protocol implementation to submit a known hash for authentication, so it cannot perform pass-the-hash. In a pass-the-hash scenario, you already have the hash and simply need to present it as a credential via SMB or other services, which is a direct authentication action rather than a cracking attempt.

Responder

Why wrong: Responder is a network poisoning tool that passively listens for LLMNR, NBT-NS, and mDNS broadcasts, then spoofs responses to capture NTLMv2 hashes from clients attempting authentication. It does not replay or use those hashes to authenticate to other systems; its job ends at gathering the hash material for a separate offline cracking step. Pass-the-hash tools like pth-winexe take a captured hash and actively forge an authentication request to a target service, which is a fundamentally different post-exploitation action.

John the Ripper

Why wrong: John the Ripper is an offline password cracker that operates on hash dump files and attempts to recover the original plaintext through modes like wordlists, rules, and brute force. It does not interface with any network authentication protocol, so it cannot submit a captured NTLM hash as a credential to a remote service or share. Unlike pass-the-hash, which immediately allows lateral movement using the hash, John seeks to discover the password itself, a step that is often irrelevant when the hash alone is sufficient.

Error-based SQL injection

Why wrong: Error-based SQL injection is incorrect here because it leverages verbose database error messages to extract or infer data directly in the application's response. For example, MySQL's `extractvalue` or `updatexml` functions can cause a syntax error that echoes the subquery result, while MSSQL's `CONVERT` can cast an integer to expose data in the error text. This technique produces immediate, visible error output rather than relying on measurable delays in response time, so it would not be the correct classification when a timeout or sleep is observed.

Boolean-based blind SQL injection

Why wrong: Boolean-based blind SQL injection is wrong for this scenario because it infers data by sending predicates that alter the HTTP response content or status code, such as `AND 1=1` versus `AND 1=2`, then comparing the resulting page markup or 200/404 outcomes. It does not use any database timing primitives like `SLEEP` or `WAITFOR DELAY`; instead, it relies on observable differences in the application's normal versus altered behavior. Since the detection here is predicated on response latency, not response differentials, this option does not fit.

UNION-based SQL injection

Why wrong: UNION-based SQL injection is not the correct answer because it is a non-blind technique that appends a `UNION SELECT` statement to the original query, requiring the attacker to match the exact number and data types of the original result set. The injected rows are rendered directly into the HTTP response, allowing immediate retrieval of database content without any timing mechanism. Given that the tester observed a time delay rather than unexpected data appearing in the response, this option is incompatible with the observed behavior.

Exploit-DB

Why wrong: Exploit-DB is a large, publicly searchable archive of exploits, shellcode, and proof-of-concepts, useful after you've identified a specific vulnerable service or kernel. For a sudo misconfiguration, however, you're not looking for a remote exploit—you're looking for a trusted binary that has an escape sequence to run commands as root. GTFOBins is the dedicated resource for that, cataloging such binaries in a structured way, whereas Exploit-DB would only help if the binary itself had a known CVE, which is a different attack vector.

HackTricks

Why wrong: HackTricks is a broad pentesting wiki covering enumeration, web attacks, active directory, and privilege escalation techniques, but its Linux privesc section is a general checklist rather than a binary-specific lookup table. It often points users to GTFOBins for sudo misuse, but it does not itself index each binary's exact sudo exploit commands. In a time-sensitive engagement, going straight to GTFOBins is more efficient for this specific misconfiguration question.

Metasploit

Why wrong: Metasploit is an exploit development and delivery framework that can launch remote exploits or generate payloads, but a sudo misconfiguration is a local configuration flaw, not a remotely exploitable memory corruption. To leverage it, you need a way to invoke the allowed binary with arguments that spawn a shell—a technique that GTFOBins enumerates. While Metasploit might have a post-exploitation module for sudo, it is not a reference to look up which binaries are abusable; that's GTFOBins' role.

192.168.1.1

Why wrong: 192.168.1.1 is an RFC1918 private address that commonly serves as the default gateway on SOHO routers. It is not the cloud metadata service, which uses a reserved link-local IPv4 address. A tester targeting this IP would be probing the local router's administrative interface, not retrieving instance metadata, so it would not yield IAM credentials or cloud configurations.

127.0.0.1

Why wrong: 127.0.0.1 is the loopback address that refers to the local machine's own TCP/IP stack, allowing a process to communicate with another process on the same host. While it is also non-routable like the metadata IP, accessing it will only reach services bound to localhost, such as a database or debugging endpoint, not the cloud metadata provider. The metadata service listens on a distinct link-local address, so conflating loopback with the metadata service would cause a tester to miss valid cloud credentials.

10.0.0.1

Why wrong: The cloud metadata service for major providers such as AWS, GCP, and Azure is accessed at 169.254.169.254, not 10.0.0.1. The 10.0.0.1 address is typically the default gateway for a virtual network’s subnet, so a tester might mistakenly target it when thinking of internal routing rather than the link-local metadata endpoint. In a scenario requiring exploitation of a local network gateway or router interface, 10.0.0.1 would be correct.

DLL hijacking

Why wrong: DLL hijacking is a code execution technique that places a malicious DLL in a directory an application searches before its legitimate system path, causing the application to load the attacker's code. For this to succeed, the attacker must have write access to that directory, but on modern Windows, system directories are protected and a low-privilege shell rarely has the necessary permissions. Even when DLL hijacking works, it typically only grants the privileges of the vulnerable application, which is often not SYSTEM, making it an unreliable path to full administrative control. Therefore, DLL hijacking is not the correct privilege escalation method here.

Kerberoasting

Why wrong: Kerberoasting is an Active Directory attack that targets service accounts by requesting Ticket-Granting Service (TGS) tickets for Service Principal Names (SPNs) and then cracking the encrypted ticket data offline to recover the password. This technique does not directly escalate privileges on the local Windows host; instead, it yields a domain service account credential that may or may not have local administrative rights, and it requires time and successful password cracking. Since the tester is operating from a low-privilege shell on a single Windows machine, Kerberoasting is not a plausible next step unless the machine is domain-joined and the attacker can request tickets, but it does not provide immediate SYSTEM access.

AlwaysInstallElevated

Why wrong: AlwaysInstallElevated is a privilege escalation technique that relies on a specific Windows Installer policy where the AlwaysInstallElevated registry keys are configured for both the computer and the current user, allowing any user to install MSI packages with SYSTEM privileges. This misconfiguration is relatively rare in hardened environments; if the policy is not enabled, the technique fails immediately because the user cannot override the default install permissions. Even when enabled, the attacker must craft or run an MSI file, and the escalation depends on the presence of specific registry values, which is not assumed from a low-privilege shell, so it is not the correct choice.

-m 22000

Why wrong: Hashcat mode 22000 is specifically designed for WPA-PBKDF2-PMKID and EAPOL hashes, which are captured from Wi-Fi handshakes, not from Windows authentication attempts. Since NTLM hashes are derived from the MD4 of the user's password in UTF-16LE format, using mode 22000 would force the tool to attempt cracking a WPA-style key derivation against NTLM data, producing false negatives or parsing errors. This mode is completely irrelevant to the password hash format obtained in a typical Active Directory compromise.

-m 13100

Why wrong: Mode 13100 in Hashcat targets Kerberos TGS-REP hashes (etype 23), which are obtained through Kerberoasting attacks against service principal names (SPNs). These hashes are created by encrypting a service ticket with the service account's NTLM hash, but the resulting structure is fundamentally different from a standalone NTLM hash that you would extract from a SAM database or LSASS dump. Attempting to crack NTLM hashes with mode 13100 would fail because the input format for TGS-REP hashes includes the Kerberos ticket fields, not the raw 32-hex-character NTLM digest.

-m 0

Why wrong: Hashcat mode 0 is intended for raw MD5 hashes, such as those generated by simple web application password storage or Unix crypt implementations that use plain MD5. NTLM hashes are not MD5; they are computed using the MD4 algorithm (specifically, MD4 of the password encoded as UTF-16LE), which is a distinct cryptographic hash function. Supplying NTLM hashes to mode 0 would cause Hashcat to treat them as 32-hex-character MD5 digests, and the resulting crack attempts would never produce valid passwords because the underlying hash algorithm and encoding are wrong.

Key confusion attack

Why wrong: Key confusion attack (also known as algorithm confusion) occurs when an attacker forces the server to verify an RS256-signed token using HMAC-SHA256 with the server's public key as the shared secret. This works because the public key is often publicly available, and the server may not enforce the expected asymmetric algorithm. It is distinct from alg:none because it still requires a signature, whereas alg:none removes signature verification entirely.

Algorithm substitution attack

Why wrong: Algorithm substitution attack is a broader brute-force or downgrade technique where the attacker changes the algorithm parameter to a weaker or symmetric one (e.g., swapping RS256 to HS256) to forge a valid signature. While 'alg:none' is technically a form of algorithm manipulation, security literature typically distinguishes it as a specific signature bypass, not an algorithm substitution, because substitution still requires signing with a known key or guessed secret. In contrast, alg:none eliminates the need for any key material altogether.

Timing attack

Why wrong: Timing attack is a side-channel technique that measures variations in how long a server takes to process requests, such as during password comparison or HMAC verification. It is unrelated to JWT structure or the alg header; it exploits implementation-specific timing differences to leak secrets like HMAC keys. Since the JWT attack described involves modifying the token's alg field to 'none', timing analysis offers no advantage and does not bypass signature checks.

Responder

Why wrong: Responder is an LLMNR/NBT-NS/mDNS poisoning tool that forces Windows and other hosts to authenticate to an attacker, then captures password hashes or performs relay attacks; it is not a tunneling tool and provides no SOCKS proxy capability. Deploying it on a compromised Linux host would poison local link-local name resolution, creating network noise and likely triggering EDR alerts, while doing nothing to route application traffic from the attacker back through the host for pivoting.

nmap

Why wrong: Nmap is a network discovery and port scanning utility that identifies open ports, running services, and operating systems; while it can enumerate lateral movement targets on the internal segment after a foothold, it does not implement a SOCKS5 proxy or any channel for bidirectional data forwarding. Running `nmap -sV` against internal hosts tells you what to pivot to, but the actual tunnel must be created by a separate tool such as chisel or ssh.

netcat

Why wrong: Netcat (or ncat) is a raw TCP/UDP connection utility commonly used for reverse shells, port listening, and file transfer; despite having a `-L` listen/relay option on some versions, it does not natively speak the SOCKS5 protocol and cannot provide dynamic proxy functionality that browsers or proxychains can consume. Its connections are one-to-one and lack sub-protocol negotiation, so even a listener-forwarded endpoint would not appear as a SOCKS port to applications.

The database must be MySQL

Why wrong: UNION-based SQL injection is not tied to any specific database engine. The UNION operator is part of standard SQL and is implemented across MySQL, Oracle, Microsoft SQL Server, PostgreSQL, SQLite, and others. While each DBMS has its own syntax for additional features (e.g., information schema queries), the core UNION operation works identically in all of them. Therefore, assuming the database must be MySQL is a false prerequisite.

The application must use GET parameters

Why wrong: The injection point can be located in any HTTP request component—GET parameters, POST data, cookies, or custom headers—and the HTTP method itself does not affect how UNION injection behaves. What matters is that user-controlled input is concatenated into a SQL query without proper sanitization. A GET parameter is simply one common vector, not a requirement. UNION injection can just as easily be performed through a POST body or a cookie value.

The application must display error messages

Why wrong: UNION injection extracts data by including a second SELECT query whose results are appended to the original query's result set. This technique does not rely on the application displaying database error messages; in fact, it usually requires the application to return the combined result rows normally. Error messages are only necessary for error-based injection, which is a different approach. Column count and data type matching are what enable successful UNION injection, independent of error visibility.

Enumerate domain admins

Why wrong: Enumerating Domain Admins is not a required step in Kerberoasting; the attack targets accounts with Service Principal Names (SPNs) regardless of group membership. While identifying Domain Admins could help prioritize which TGS tickets to crack, the actual Kerberoasting workflow only requires discovering SPN-linked accounts and requesting their tickets. Spending time on admin enumeration adds noise and may trigger detections without advancing the ticket extraction.

Perform a relay attack

Why wrong: Performing a relay attack is unrelated to Kerberoasting; NTLM relay captures authentication messages (e.g., SMB, HTTP) and forwards them to a target server to authenticate or execute commands. Kerberoasting instead pulls Kerberos TGS tickets encrypted with a service account's NTLM hash and cracks them offline. Relaying requires an active network position and targeted service, whereas Kerberoasting works with a single set of valid credentials and no further network interaction.

Capture NTLMv2 hashes using Responder

Why wrong: Capturing NTLMv2 hashes with Responder is a different attack vector; Responder poisons LLMNR/NBT-NS to intercept network authentication attempts and collects NTLMv2 challenge-response hashes. Kerberoasting does not rely on network poisoning or challenge-response; it extracts Kerberos TGS tickets that are encrypted with the service account's NTLM hash. These hash types require separate cracking modes, and Responder's output cannot be directly substituted for TGS tickets in a Kerberoasting workflow.

<script>alert(1)</script>

Why wrong: The <script>alert(1)</script> payload is a classic cross-site scripting (XSS) probe that executes JavaScript in the victim's browser. It does not interact with the server's XML parser, so it cannot detect XML external entity injection. This attack targets client-side rendering and reflected/stored input, not server-side XML processing.

'; DROP TABLE users; --

Why wrong: The input '; DROP TABLE users; -- is a SQL injection attempt that tries to terminate the current SQL statement and execute a destructive command on the database. It is unrelated to XML parsing; it targets the database layer, not the XML parser. Using this payload would not reveal XXE vulnerabilities because it doesn't involve document type declarations or entity resolution.

../../etc/passwd

Why wrong: This payload attempts a path traversal attack by using ../ sequences to navigate outside the web root to access /etc/passwd on the filesystem. It exploits the web server's file handling logic, not the XML parser's entity resolution. It is a different vulnerability class from XXE and would not trigger an external entity fetch.

ARP spoofing

Why wrong: ARP spoofing is a Layer 2 man-in-the-middle (MITM) technique that works by sending forged Address Resolution Protocol replies to poison a victim's ARP cache, redirecting network traffic to the attacker's machine for interception or sniffing. This attack interferes with the data flow between two hosts but does not provide a mechanism for authenticated remote execution or credential reuse against a target system. In a lateral movement context, ARP spoofing is not a viable method because it focuses on network-level manipulation rather than leveraging Windows administrative protocols or services to run commands on another host. Thus, it is incorrect for this scenario.

SSH with captured credentials

Why wrong: SSH with captured credentials is typically a remote administration method used for Unix/Linux systems rather than a native Windows lateral movement technique. While modern Windows can host OpenSSH, the default Windows infrastructure relies on SMB, WinRM, WMI, and RPC for remote execution, and SSH is rarely enabled or configured in typical enterprise Windows environments. Furthermore, using SSH does not leverage the domain-joined Windows services commonly abused for lateral movement, and although it can execute commands, captured credentials in a Windows landscape are more directly used with tools like PsExec or WinRM. Therefore, it is not the intended method for lateral movement in this Windows-focused scenario.

ntlmrelayx

Why wrong: ntlmrelayx is a tool for relaying captured NTLM authentication attempts to other services, often used after poisoning has occurred, but it does not itself listen for LLMNR/NBT-NS queries or spoof responses. It requires already captured hashes or authentication requests, so it cannot satisfy the stem's requirement to poison those protocols. Instead, it is a post-exploitation or relay tool that leverages credentials obtained via other means.

Bettercap

Why wrong: Bettercap is a comprehensive network attack framework that primarily performs ARP spoofing, DNS hijacking, and HTTP/HTTPS interception at the data-link and network layers. While it can perform some name resolution poisoning in certain modules, its core functionality is not focused on LLMNR/NBT-NS spoofing; it targets layer 2/3 traffic redirection rather than the Windows-specific name resolution protocols described in the stem. Thus, it would not directly capture NTLMv2 hashes via LLMNR/NBT-NS poisoning.

Hashcat

Why wrong: Hashcat is a password recovery tool that uses GPU-accelerated brute-force, dictionary, and rule-based attacks to crack password hashes locally. It has no ability to listen on a network, send spoofed responses, or intercept authentication challenges; it operates purely on pre-acquired hash values. Therefore, it cannot be used to capture or poison LLMNR/NBT-NS traffic, and is only relevant after a hash has already been obtained by a tool like Responder.

John the Ripper

Why wrong: John the Ripper is a dedicated password/hash cracking tool that works offline against captured NTLM or Net-NTLMv2 hashes; it has no built-in capability to authenticate to a remote Windows host or execute commands on the target. While it can break weak passwords, it does not perform pass-the-hash attacks, which require substituting a hash as a credential in an active network authentication session.

Metasploit

Why wrong: Metasploit does contain modules such as exploit/windows/smb/psexec_psh that can authenticate with an NTLM hash, but it is a broad exploitation framework rather than a purpose-built lateral movement utility. Using it for pass-the-hash often requires session management, payload generation, and target-by-target invocation, whereas the attacker in this scenario simply needs to execute commands across multiple hosts quickly; CrackMapExec is more streamlined and is the go-to tool for this exact task.

pth-winexe

Why wrong: pth-winexe is a tool from the Samba suite that can indeed perform pass-the-hash operations by launching winexe to execute commands over SMB using an NTLM hash. However, it is less commonly used in modern penetration testing because it lacks the multi-host automation, protocol diversity (SMB/WMI/WinRM), and built-in post-exploitation helpers that CrackMapExec provides; pth-winexe is also older and not as actively maintained, making CME the more comprehensive and efficient choice for lateral movement.

127.0.0.1

Why wrong: 127.0.0.1 is the IPv4 loopback address, which always points to the local host itself rather than to any external infrastructure. Penetration testers use it to probe services listening on the same machine, such as a database or admin panel, but it is not the cloud provider's instance metadata service. The metadata service uses a distinct link-local address, so an SSRF request targeting 127.0.0.1 would not retrieve IAM credentials or user-data.

192.168.1.254

Why wrong: 192.168.1.254 is a commonly used private IP address for home or small-office router management interfaces, falling within the RFC 1918 192.168.0.0/16 range. It has no special meaning to cloud platforms, and it is not reachable as a metadata service from a public cloud instance. While it could be an internal target in a network scan, choosing it as the metadata endpoint would be based on a false association with typical consumer gateway IP conventions.

10.0.0.1

Why wrong: 10.0.0.1 is a private IPv4 address in the 10.0.0.0/8 RFC 1918 block, frequently used as the default gateway in cloud VPC subnets and corporate networks. It is not a link-local address and is not reserved for metadata services; cloud metadata is only reachable at the 169.254.0.0/16 link-local range. Additionally, many cloud environments have no metadata listener on 10.0.0.1, so a request there would fail or hit an unrelated internal service.

Out-of-band SQL injection

Why wrong: Out-of-band SQL injection uses a separate communication channel (e.g., DNS) to exfiltrate data, which still creates output outside the original query, not fully meeting the requirement.

Error-based SQL injection

Why wrong: Error-based SQL injection relies on database error messages to retrieve data, which is still a form of output from the original query context.

UNION-based SQL injection

Why wrong: UNION-based SQL injection combines results from multiple SELECT statements into the original query output, thereby returning data in the original query, which contradicts the requirement.

-m 13100

Why wrong: Hashcat mode 13100 is intended for Kerberos 5 TGS-REP tickets, commonly used in Kerberoasting attacks against Active Directory service accounts. A TGS ticket contains a ciphertext that, when cracked offline, reveals the service account's password, but the hash format is entirely distinct from a Windows NTLM hash. Since the tester captured NTLM hashes, this mode would fail to parse the input and is therefore incorrect.

-m 0

Why wrong: Hashcat mode 0 corresponds to raw MD5, a generic message digest algorithm that produces a 128-bit hash used in many contexts such as legacy Unix passwords or simple file integrity. NTLM hashes, however, are based on MD4 (a different algorithm) and are stored in a specific hexadecimal representation that does not conform to MD5's format. Choosing mode 0 would attempt an MD5 attack against data that is not MD5, so it is the wrong choice for cracking Windows NTLM hashes.

-m 22000

Why wrong: Hashcat mode 22000 is used for WPA-PBKDF2-PMKID, which targets Wi-Fi Protected Access handshake captures, typically from wireless network reconnaissance. This mode processes the PMKID or EAPOL handshake from 802.11 frames, not any form of Windows authentication material. An NTLM hash is a plaintext-derived digest with a completely different structure; therefore using mode 22000 would be incorrect for this task.