ACL Vulnerability Assessment & Penetration Testing 2 — Questions and Answers
Question 1: During a penetration test, a tester discovers that a router ACL permits inbound Telnet (port 23) from any source. What is the primary security risk?
- Telnet traffic is encrypted but slow
- Telnet transmits credentials in plaintext, enabling credential interception (Correct answer)
- Telnet is blocked by most firewalls automatically
- Telnet uses a non-standard port that is hard to scan
Correct answer: Telnet transmits credentials in plaintext, enabling credential interception
Telnet sends all data, including usernames and passwords, in cleartext, making it trivial for an attacker to capture credentials via packet sniffing.
Question 2: A penetration tester uses 'nmap -sA' against a target network. What does a 'filtered' result on a port typically indicate?
- The port is open and accepting connections
- A firewall or ACL is blocking probe packets to that port (Correct answer)
- The service on that port has crashed
- The port is closed but reachable
Correct answer: A firewall or ACL is blocking probe packets to that port
A 'filtered' nmap result means a firewall, ACL, or other network device is dropping or rejecting packets before they reach the target port.
Question 3: Which ACL misconfiguration most commonly allows an attacker to perform IP spoofing attacks into a network?
- Missing egress filtering on internal traffic
- Absence of ingress filtering that blocks private IP ranges from external interfaces (Correct answer)
- Permitting ICMP echo requests
- Allowing UDP traffic on port 53
Correct answer: Absence of ingress filtering that blocks private IP ranges from external interfaces
Without ingress ACL filtering that blocks RFC 1918 private addresses and other bogon ranges on external interfaces, attackers can spoof internal IP addresses to bypass security controls.
Question 4: A vulnerability scan reveals that ACL entries allow ICMP unreachable messages outbound. Why might a penetration tester consider this a finding?
- ICMP unreachable messages have no security impact
- These messages can reveal internal network topology and ACL rule structures to an attacker (Correct answer)
- ICMP is always blocked by default in Cisco ACLs
- Outbound ICMP only affects performance, not security
Correct answer: These messages can reveal internal network topology and ACL rule structures to an attacker
ICMP unreachable messages returned to external hosts can reveal which ports/protocols are filtered versus closed, helping attackers map the network's ACL ruleset.
Question 5: During ACL review, a tester finds the rule 'permit ip any any' at the end of an extended ACL. What is the security implication?
- The rule is redundant because ACLs deny all by default
- The rule overrides all previous deny statements, allowing all traffic through (Correct answer)
- The rule only applies to TCP traffic
- The rule improves performance by reducing ACL processing
Correct answer: The rule overrides all previous deny statements, allowing all traffic through
A 'permit ip any any' at the end of an ACL negates the implicit deny-all, allowing any traffic not matched by earlier rules to pass through unchecked.
Question 6: What technique do penetration testers use to bypass ACLs that block standard scanning ports by sending packets with specific TCP flags?
- SYN flood attacks
- ACK scanning or FIN scanning to probe through stateless ACLs (Correct answer)
- DNS tunneling to exfiltrate data
- ARP poisoning to redirect traffic
Correct answer: ACK scanning or FIN scanning to probe through stateless ACLs
ACK and FIN scans exploit stateless ACLs that only filter SYN packets, since these ACLs may permit non-SYN packets that appear to belong to established connections.
Question 7: A penetration tester discovers that a network ACL permits outbound traffic to TCP port 4444. What common threat does this suggest?
- Normal web browsing traffic
- A potential Metasploit reverse shell channel or malware command-and-control (Correct answer)
- Standard database replication traffic
- VPN tunnel establishment traffic
Correct answer: A potential Metasploit reverse shell channel or malware command-and-control
TCP port 4444 is the default listener port for Metasploit's Meterpreter reverse shells, and its presence in egress ACLs may indicate malware or unauthorized remote access.
ACL Vulnerability Assessment & Penetration Testing 2
During a penetration test, a tester discovers that a router ACL permits inbound Telnet (port 23) from any source.
What is the primary security risk?