Vulnerability Discovery and Analysis practice questions

Ping sweep (-sn)

Why wrong: Ping sweep (-sn) only probes for host availability using ICMP Echo Request (and ARP on local subnets) and never transmits TCP packets. This means it cannot enumerate open TCP ports, which is the primary goal of the scan described in the question. While it quickly identifies live systems, it fails to reveal which services are running, making it insufficient for a comprehensive host/service discovery mission. Additionally, ICMP probes may be filtered by firewalls, producing incomplete results without any port state information.

TCP connect scan (-sT)

Why wrong: TCP connect scan (-sT) uses the operating system's connect() system call to perform a complete three-way handshake with every port. Because the handshake is fully completed, the target service logs a full connection event, and the scanner's real IP is left in the logs, making it significantly more detectable than a SYN scan. It is also slower because the kernel handles each connection sequentially and must wait for the full handshake to conclude. While it works without raw packet privileges, its lack of stealth and higher overhead make it unsuitable for a penetration test looking to avoid observation and quickly map many ports.

UDP scan (-sU)

Why wrong: UDP scan (-sU) is designed specifically for User Datagram Protocol ports, not TCP ports, and operates by sending UDP datagrams and analyzing responses—most commonly receiving an ICMP Port Unreachable to mark a port closed. This technique is entirely inappropriate for the TCP-based SYN scan described in the question, as it does not perform any TCP handshake or partial handshake. UDP scanning is inherently slow and unreliable, relying on ICMP feedback that is often rate-limited or blocked, and it produces no information about TCP service states. Thus, using UDP scan would fail to answer whether TCP ports are open and would introduce considerable network noise, making it the wrong tool for this stealth-oriented task.

Burp Suite

Why wrong: Burp Suite intercepts and manipulates HTTP/S traffic for web application testing, but it lacks a native repository of pre-written exploit modules and payloads for arbitrary service exploitation. The question requires a framework with a large, curated database of such modules, which is the defining feature of Metasploit. Burp Suite is tempting because its proxy and repeater tools are ideal for manual web vulnerability verification, making it the correct choice for a web application assessment rather than service-level exploitation.

Wireshark

Why wrong: Wireshark is a network protocol analyzer that captures and passively inspects packets traversing a network interface. It has no capability to craft or transmit custom exploit payloads, nor does it maintain a database of vulnerability exploits; at best it supports reconnaissance by revealing service banners, credentials, or protocol behavior, which is only a precursor to actual exploitation. Therefore, while Wireshark is valuable in the enumeration phase, it is not a tool for exploiting a vulnerable service.

Nmap

Why wrong: Nmap is a network scanning and enumeration tool used for host discovery, port scanning, and service/version detection. Although its Nmap Scripting Engine (NSE) includes some scripts that can probe for or even trigger certain vulnerabilities, Nmap lacks the broad, curated repository of full exploitation modules, payload generators, and post-exploitation tooling that define an exploitation framework. Its primary role in a penetration test is mapping the attack surface, not delivering a reliable exploit against a service.

Repeater

Why wrong: Repeater allows a tester to manually craft a single HTTP request, send it, and inspect the raw response, optionally modifying and resending it. It lacks payload iteration and automated response analysis; it is designed for precise, one-off testing, not for automated fuzzing with multiple payloads. Because the pen tester's need is to automate fuzzing across many inputs, Repeater cannot fulfill that requirement.

Proxy

Why wrong: Burp Proxy operates as an intercepting forward proxy that sits between the browser and target, capturing and modifying individual requests in real time. It enables manual manipulation of parameters on the fly but does not generate a series of varying payloads; it is a passive and interactive tool for observing and tweaking traffic, not for systematic fuzzing. While useful for reconnaissance, it does not meet the requirement for automated fuzzing.

Sequencer

Why wrong: Sequencer is a Burp tool that collects a large sample of session tokens or other values and applies statistical tests to assess their entropy and predictability. It focuses on cryptographic and session randomness analysis, not on injecting payloads into request parameters. Using Sequencer here would not perform parameter fuzzing; it would analyze token quality, rendering it irrelevant to the stated task.

psexec.py

Why wrong: PsExec is an Impacket remote administration tool that executes commands on a target system by creating a Windows service via the Service Control Manager (SVCCTL) over SMB. Its purpose is to provide an interactive shell or run arbitrary commands, not to read the SAM, NTDS.dit, or LSA secrets. Therefore, it would not be used to extract password hashes after gaining access to a domain controller.

GetUserSPNs.py

Why wrong: GetUserSPNs.py is an Impacket script designed for Kerberoasting: it queries Active Directory for user accounts with Service Principal Names (SPNs) and requests service tickets (TGS) from the Key Distribution Center. These tickets are formatted for offline password cracking, but they only expose hashes for specific service accounts, not all domain users or computer accounts. Thus, while useful for privilege escalation, it does not dump the full set of hashes that reside in NTDS.dit on a domain controller.

wmiexec.py

Why wrong: wmiexec.py uses Windows Management Instrumentation (WMI) to execute commands remotely, creating a semi-interactive shell via classes like Win32_Process and requiring an administrative account with WMI access. It operates by spawning new processes on the target but never reads the registry hive files or database files where password hashes are stored, so it cannot be used to extract credentials. It is an alternative to PsExec for remote code execution, not a hash-dumping utility.

Cross-site scripting (XSS)

Why wrong: Cross-site scripting (XSS) fundamentally targets the client-side execution context, not the database. An attacker injects malicious JavaScript or HTML into the application's output, which is then rendered by a victim's browser. Unlike SQL injection, the injected payload does not alter any server-side SQL statement; instead, it manipulates how the page is interpreted client-side. Thus, the presence of unsanitized input alone does not indicate XSS unless it reaches an output sink such as echo or innerHTML.

Path traversal

Why wrong: Path traversal, also known as directory traversal, exploits a vulnerability in file path handling rather than database queries. An attacker injects sequences like ../ to escape the intended directory and read arbitrary files from the server's filesystem. This attack focuses on server-side file operations such as file_get_contents(), include, or fopen(), where user input is used to construct a filesystem path insecurely. Since the input is processed by the filesystem layer and not the SQL query parser, it cannot be classified as SQL injection.

Command injection

Why wrong: Command injection occurs when user-controlled input is passed unfiltered to an operating system command executed via functions like exec(), system(), or shell_exec(). The attacker appends shell metacharacters such as ;, |, or && to execute arbitrary commands on the host. This vulnerability exploits the shell's command parser, not the SQL query interpreter, so the injected content is processed by the operating system rather than a database. Therefore, it is a completely different attack class from SQL injection, which targets the SQL language syntax.

Aircrack-ng

Why wrong: Aircrack-ng is a specialized suite for wireless network security testing, designed to capture packets and crack WEP and WPA-PSK keys via offline analysis. It performs no interactive authentication attempts against a live SSH service and does not support SSH as a target protocol, so it cannot brute-force credentials over the network.

Hashcat

Why wrong: Hashcat is a high-speed offline password recovery tool that operates on pre-captured hash values (e.g., /etc/shadow SHA-512, NTLM, bcrypt). It requires a hash file as input and never contacts a target service, so it cannot perform online SSH brute-force attacks where each guess is sent to the sshd daemon.

John the Ripper

Why wrong: John the Ripper is a versatile offline password cracker that works by comparing candidate hashes against a pre-computed or incremental set of password hashes. It is not designed to initiate network connections or send authentication requests to a remote SSH service, so it cannot be used for active online brute-force attacks directly.

requests

Why wrong: The `requests` library is strictly an HTTP client built atop urllib3. It operates entirely at the application layer (Layer 7), managing HTTP/1.1 semantics, session cookies, and TLS, but it exposes no control over IP or TCP header fields such as sequence numbers, window sizes, or TCP flags. Because it cannot open raw sockets or inject arbitrary packets, it is completely unsuitable for crafting low-level network probes. It would be the correct choice only for web application interaction, not packet crafting.

socket

Why wrong: The `socket` module provides the foundational interface for network communication in Python, allowing for operations like establishing connections and sending/receiving data. It is tempting because it enables low-level network interaction, including the creation of raw sockets. However, for crafting custom TCP packets with specific flags and manipulating individual header fields, `socket` requires the manual, byte-by-byte construction of entire IP and TCP headers, including checksum calculation. This makes it cumbersome for the precise packet crafting required, where a library that abstracts header creation would be more effective. It would be the correct choice for standard TCP/UDP client/server implementations or basic network I/O.

impacket

Why wrong: Impacket is a collection of Python classes focused on implementing and interacting with Windows network protocols, especially SMB, MSRPC, Kerberos, and NetBIOS. Although it contains some low-level packet-handling utilities for its own protocol implementations, its design goal is not general-purpose packet crafting. Using Impacket to forge arbitrary TCP packets would require working around its protocol-specific abstractions and would lack the intuitive, protocol-agnostic API that Scapy offers. Thus it is not the correct choice for crafting custom TCP packets in a standalone Python script.

IDA Pro Free

Why wrong: IDA Pro Free is a limited edition of the Interactive Disassembler that only supports x86/x64 machine-code disassembly and lacks the Hex-Rays decompiler. It does not understand .NET metadata or Common Intermediate Language (CIL), so it would only surface the unmanaged PE stub and native helper functions, not the actual C# assembly logic.

Ghidra

Why wrong: Ghidra is a powerful reverse-engineering framework aimed at native binaries across many processor architectures, using Sleigh disassembly for machine code. While it can decompile to C-like pseudocode, it has no built-in parser for .NET metadata or CIL instructions, so opening a .NET assembly would show the native entry-point stub rather than the managed methods. Dedicated .NET plugins exist but are not part of the standard tool.

jadx

Why wrong: jadx is exclusively tailored for Android reverse engineering, converting DEX bytecode inside APK files into Java source code. It has no capability to load PE files with .NET CLR headers, parse .NET metadata tables, or disassemble CIL, making it entirely unsuitable for a .NET binary reverse-engineering task.

airmon-ng

Why wrong: airmon-ng is a wireless tool for enabling monitor mode on a network interface and managing wireless drivers, not for injecting frames. While monitor mode is a prerequisite for capturing traffic, airmon-ng itself does not generate any packets, so it cannot force a client to disconnect. The evil twin attack relies on deauthentication to lure clients onto the rogue AP, which requires packet injection—a capability exclusive to tools like aireplay-ng.

airodump-ng

Why wrong: airodump-ng is a packet capture utility that passively collects 802.11 frames, including handshakes, beacon frames, and management traffic. It does not transmit any data, so it cannot send deauthentication frames to disconnect a client from the legitimate AP. Although airodump-ng is essential for identifying target channels and clients, the actual deauth action in an evil twin attack is performed by a separate injection tool.

aircrack-ng

Why wrong: aircrack-ng is a post-capture offline cracking tool that analyzes WPA/WPA2 handshakes to recover the pre-shared key. It operates solely on saved packet captures and has no capability to inject frames into a live wireless network. In an evil twin attack, aircrack-ng could be used after capturing the handshake, but it cannot initiate the deauth that forces the client to reconnect to the rogue AP.

Nishang

Why wrong: Nishang is an umbrella collection of many discrete PowerShell scripts for offensive tasks—keyloggers, port scanners, reverse shells, and credential harvesters—rather than a single script. It is a general-purpose toolkit, and while some of its payloads aid post-exploitation, it does not specifically target Active Directory object enumeration. For that purpose, PowerView is the dedicated AD reconnaissance script, so Nishang is not the correct answer.

Empire

Why wrong: Empire is a full-featured post-exploitation Command & Control framework with listeners, agents, and module staging, not a standalone PowerShell script. It can execute PowerView or other modules on compromised hosts, but the question asks for the script that performs Active Directory enumeration. Empire would be the umbrella platform that hosts the script, not the enumeration tool itself, making it incorrect.

Invoke-Mimikatz

Why wrong: Invoke-Mimikatz is a PowerShell script that wraps Mimikatz functionality to extract plaintext credentials, Kerberos tickets, and NTLM hashes from memory, particularly from LSASS. Its role is credential dumping and stealing authentication material, not querying Active Directory for users, groups, or permissions. Because the correct answer must describe an AD enumeration script, Invoke-Mimikatz fails the technical requirement despite being a common post-exploitation script.

Brute-forcing SSH credentials

Why wrong: Wireshark is a passive sniffer/analyzer; it captures and decodes network packets but does not generate its own authentication attempts. Brute-forcing SSH requires an active client to repeatedly try credentials against the SSH service, which is outside Wireshark's functionality. It can only observe an ongoing brute-force attack, not perform one.

Performing active vulnerability scanning of hosts

Why wrong: Active vulnerability scanning requires sending crafted probes and observing responses to identify open ports and vulnerabilities, which means generating outbound network traffic. Wireshark is strictly passive: it only captures frames already on the wire, never transmitting packets itself. Thus, it cannot function as an active scanner; it could analyze the traffic generated by a scanner like Nmap, but it cannot run the scan.

Cracking WPA2 handshakes directly

Why wrong: Wireshark can capture the WPA2 4-way handshake if it is present in the traffic, but it does not include a cracking engine to derive the passphrase. Cracking requires offline tools like aircrack-ng or hashcat that perform dictionary/rule-based attacks against the handshake's hashed key material. Wireshark's role ends at saving the handshake to a file; it cannot verify or recover the password.

Validating input with allowlists

Why wrong: Allowlist validation restricts input to a predefined set of safe values, effectively neutralizing injection attacks and malformed data. By rejecting anything outside the approved pattern, the application avoids relying on blocklists that can be bypassed with obfuscation. This is a foundational secure-coding practice and does not introduce a vulnerability.

Using parameterized queries for database operations

Why wrong: Parameterized queries separate SQL logic from data by placing placeholders in the query and supplying values at execution time, so the database treats input as data only. This prevents malicious syntax from being interpreted as executable SQL, making the code inherently resistant to injection. Consequently, using parameterized queries is a secure database access pattern, not a vulnerability.

Using prepared statements in SQL

Why wrong: Prepared statements compile the SQL query on the database server and then bind user-supplied values as parameters, ensuring those values are never parsed as SQL syntax. This server-side compilation provides a robust, DBMS-level defense against injection, and its presence in code reflects a secure implementation. However, a reviewer should still verify consistent use across the codebase, as any unwrapped query can reintroduce the vulnerability.

Nmap -sP

Why wrong: Nmap -sP (or -sn) performs host discovery only, sending ICMP echo requests, TCP SYN to port 443, and TCP ACK to port 80, then stops after determining whether a host is alive. It never initiates a TCP connect or SYN probe to enumerate open ports, so it yields only a list of live hosts, not the services or ports running on them. For a penetration test that requires identifying all live hosts and open ports, this is insufficient.

Nmap -sU

Why wrong: Nmap -sU invokes a UDP scan, which works by sending empty or protocol-specific UDP datagrams to target ports and interpreting ICMP Port Unreachable responses to mark closed ports; if no response is received, the port is classified as open|filtered. Because UDP is connectionless and many services don't reply, the scan is inherently slow, requiring timeouts and retransmissions, and it covers only UDP services, missing the TCP services that most critical applications (HTTP, SSH, RDP) rely on. It is not the ideal single-choice scan for a broad host/port enumeration during a penetration test.

Nmap -sT

Why wrong: Nmap -sT performs a full TCP connect scan, completing the three-way handshake by invoking the operating system's connect() call for every tested port. This not only takes significantly longer because each open port requires an extra RST to close the connection, but it also generates a completed connection record in the target's service logs and is easily spotted by network-based intrusion detection systems. While it can accurately identify open TCP ports, its speed and detectability make it suboptimal compared to stealthier techniques like a SYN scan.

Hydra

Why wrong: Hydra is a parallelized network login brute-force tool, not a proxy. It automates username/password guessing against services like HTTP forms, SSH, or SMB, but it has no ability to sit between a client and server to intercept and modify individual requests. While it might be used to test authentication, it cannot perform the core task of altering a web request mid-session.

Nmap

Why wrong: Nmap is a network scanner that probes hosts, ports, and services by sending crafted packets and analyzing responses. It is invaluable for reconnaissance, but it does not operate as an intercepting proxy and cannot modify HTTP request data before it reaches the server. Its function is passive or active discovery, not inline mutability of application-layer traffic.

Wireshark

Why wrong: Wireshark is a passive packet analyzer that captures frames from a network interface and decodes protocols for offline inspection. It sees traffic in real time but is not positioned in the data path and cannot alter or reinject requests before the target receives them. Its purpose is observation, not interactive manipulation of a web session.

Hydra

Why wrong: Hydra performs network authentication attacks against live services (SSH, RDP, HTTP) by trying username/password combinations. It cannot parse a captured NTLM hash file and crack it offline; it needs a target service to attack. Thus, for a password cracking task on already obtained hashes, Hydra is unsuitable.

John the Ripper

Why wrong: John the Ripper is a versatile offline hash cracker supporting many formats, including NTLM, and can run in CPU-only mode. However, its performance on NTLM hashes is typically inferior to Hashcat, which leverages GPU acceleration and optimized kernels for fast NTLM cracking. So while John would work, Hashcat is the better choice.

CrackMapExec

Why wrong: CrackMapExec (CME) is a post-exploitation framework for automating SMB, WMI, and WinRM attacks, including spraying creds and dumping SAM databases. It does not perform offline hash cracking; it uses hashes for authentication (pass-the-hash) but cannot recover the plaintext password. Therefore, it is irrelevant to a pure password cracking task.

wmiexec

Why wrong: Wmiexec provides remote execution via WMI, not Kerberoasting.

psexec

Why wrong: Psexec executes commands remotely, not Kerberoasting.

secretsdump

Why wrong: Secretsdump extracts password hashes, not SPN tickets.

Switch to John the Ripper with a brute-force attack

Why wrong: Brute-force is extremely slow for WPA2.

Use Wireshark to analyze the handshake for plaintext hints

Why wrong: Handshakes do not contain plaintext password hints.

Perform a deauthentication attack to force clients to reconnect and capture additional handshakes

Why wrong: More handshakes don't help if the password is not in the dictionary.

input('Enter name:')

Why wrong: input() simply reads a string, no execution.

open(filename, 'r')

Why wrong: File operations are not inherently dangerous.

subprocess.run(['ls'])

Why wrong: While subprocess can run commands, with hardcoded arguments it's less dangerous.

Path traversal

Why wrong: Path traversal is incorrect because it describes a file-system attack in which an attacker manipulates relative paths (e.g., ../../etc/passwd) to read or write files outside an intended directory. When decompiling with dnspy, a path traversal weakness would appear as unsanitized user input being concatenated into file paths or streams, not as deserialization calls. The decompiled code for insecure deserialization, by contrast, would show deserializer APIs like BinaryFormatter.Deserialize or JsonConvert.DeserializeObject being invoked on untrusted data, which is a completely different code pattern.

SQL injection

Why wrong: SQL injection is incorrect because that vulnerability occurs when untrusted input is incorporated into database queries, typically through string concatenation in command text, allowing an attacker to alter the query's logic or execute arbitrary SQL. In dnspy, SQL injection would appear as dynamic SQL strings and ExecuteNonQuery/ExecuteReader calls, not as deserialization of object streams. Insecure deserialization instead involves the reconstruction of .NET objects from binary or JSON data, where the risk comes from type-name resolution and gadget chains, not from malformed SQL syntax.

Hardcoded credentials

Why wrong: Hardcoded credentials are incorrect because that issue involves embedded secrets such as passwords, API keys, or connection strings in source code, which would be visible as plain string literals when decompiling. Insecure deserialization does not rely on static secrets; it arises when a deserializer (e.g., BinaryFormatter) trusts type information inside a serialized payload to instantiate arbitrary types. The dnspy result would show a Serialize/Deserialize call pattern and possibly gadget-inducing classes, not a hardcoded password field.

Invoke-Mimikatz

Why wrong: Invoke-Mimikatz is a PowerShell wrapper for Mimikatz that focuses on credential theft from memory, such as extracting plaintext passwords, NTLM hashes, and Kerberos tickets from the LSASS process. It does not query Active Directory for user or group objects, making it unsuitable for enumeration tasks. While it can be used after compromising a host to aid lateral movement, it does not provide the LDAP-based directory recon required here.

Prowler

Why wrong: Prowler is a security assessment tool for AWS, grounded in CIS benchmarks, and is used to audit cloud infrastructure for misconfigurations, such as IAM policies, S3 bucket permissions, and other AWS-specific controls. It does not interact with on-premises Windows Active Directory or perform LDAP queries. Therefore, it is irrelevant to enumerating Windows domain users and groups.

ScoutSuite

Why wrong: ScoutSuite is a multi-cloud security auditing tool that evaluates the configuration of cloud providers like AWS, Azure, and GCP. It checks for insecure cloud settings, such as open storage blobs and weak identity management, but it has no capability to query Windows domains. As a cloud-only tool, it cannot enumerate local AD users or groups, making it incorrect for this task.