eJPT - eLearnSecurity Junior Penetration Tester Scanning and Enumeration Questions and Answers

Question 1

A penetration tester runs an Nmap scan with the command `nmap -sS 192.168.1.10`. What is the primary characteristic of this type of scan?

Accepted Answer

It is a stealth scan that does not complete the TCP three-way handshake.

Answer

The `-sS` flag in Nmap specifies a TCP SYN scan, also known as a 'stealth' or 'half-open' scan. It initiates a TCP connection by sending a SYN packet but does not complete the three-way handshake, making it less likely to be logged by the target system.

Question 2

During an engagement, you suspect a misconfigured DNS server might leak information about the internal network structure. Which technique would be most effective for attempting to retrieve all DNS records from the server?

Accepted Answer

Attempting a DNS Zone Transfer (AXFR).

Answer

A DNS Zone Transfer (AXFR) is a mechanism for replicating DNS databases across a set of DNS servers. If a server is misconfigured to allow zone transfers to any client, an attacker can use this to request and receive a copy of all DNS records for a zone, revealing the internal network structure.

Question 3

A penetration tester needs to gather as much information as possible from a Windows host over SMB, including users, shares, and password policies. Which of the following tools is specifically designed for this purpose?

Accepted Answer

Enum4linux

Answer

Enum4linux is a tool specifically created to enumerate information from Windows and Samba systems over the SMB protocol. It can gather data such as user lists, group memberships, shares, and password policies.

Question 4

While scanning a target, you want to identify the specific version of the software running on an open port to search for known vulnerabilities. Which Nmap command-line option would you use to achieve this?

Accepted Answer

-sV

Answer

The `-sV` option in Nmap enables version detection. It probes open ports to determine service and version information, which is crucial for identifying potentially vulnerable software.

Question 5

A junior penetration tester is tasked with enumerating SNMP on a network device at 10.10.5.25. They discover that the default read community string is set to 'public'. What kind of information can they likely obtain?

Accepted Answer

System information such as routing tables, hostnames, and user accounts.

Answer

With a default read-only community string like 'public', an attacker can use SNMP enumeration tools (like snmpwalk or nmap's snmp scripts) to query the device's Management Information Base (MIB). This can reveal a wealth of information, including system uptime, network interfaces, user accounts, running processes, and routing tables.

eJPT - eLearnSecurity Junior Penetration Tester Practice Test

eJPT - eLearnSecurity Junior Penetration Tester Practice Test

eJPT - eLearnSecurity Junior Penetration Tester Scanning and Enumeration Questions and Answers