eJPT Attacks and Exploits 3 — Questions and Answers
Question 1: Which tool is commonly used to perform a man-in-the-middle attack on a local network by poisoning ARP tables?
- Nmap
- Arpspoof / ettercap (Correct answer)
- Hydra
- Nikto
Correct answer: Arpspoof / ettercap
Tools like arpspoof (from dsniff) and ettercap are specifically designed to poison ARP caches and perform MITM attacks on LAN segments.
Question 2: What is a cross-site scripting (XSS) attack primarily used to steal?
- Database records
- Session cookies (Correct answer)
- SSH private keys
- Password hashes
Correct answer: Session cookies
XSS attacks inject malicious scripts into web pages viewed by other users, most commonly to steal session cookies and hijack authenticated sessions.
Question 3: In the context of eJPT, what does 'pivoting' refer to?
- Changing the exploit module mid-attack
- Using a compromised host to attack other systems on internal networks (Correct answer)
- Rotating between different user accounts
- Switching from TCP to UDP protocols
Correct answer: Using a compromised host to attack other systems on internal networks
Pivoting uses a compromised machine as a relay to reach and attack systems on network segments that are not directly accessible to the attacker.
Question 4: Which Nmap script category is most useful for detecting known vulnerabilities on open services?
- discovery
- safe
- vuln (Correct answer)
- brute
Correct answer: vuln
The `vuln` NSE script category includes scripts that check for specific known vulnerabilities on detected services.
Question 5: What is the Metasploit command to set up a listener that catches reverse shell connections?
- use exploit/multi/handler (Correct answer)
- use auxiliary/server/listener
- use payload/reverse_tcp
- use exploit/generic/shell_reverse
Correct answer: use exploit/multi/handler
`exploit/multi/handler` is the generic Metasploit listener used to catch incoming connections from reverse shell payloads.
Question 6: Which type of XSS attack stores the malicious script on the server and executes it for every visitor?
- Reflected XSS
- DOM-based XSS
- Stored (Persistent) XSS (Correct answer)
- Self-XSS
Correct answer: Stored (Persistent) XSS
Stored XSS saves the malicious payload in the server's database and delivers it to every user who views the affected page.
Question 7: What does the Metasploit `sessions -i <id>` command do?
- Initiates a new exploit against a session ID
- Lists all active sessions with details
- Interacts with (connects to) an existing session (Correct answer)
- Kills the specified session
Correct answer: Interacts with (connects to) an existing session
`sessions -i <id>` interacts with an existing Meterpreter or shell session, bringing it to the foreground for command input.
eJPT Attacks and Exploits 3
Which tool is commonly used to perform a man-in-the-middle attack on a local network by poisoning ARP tables?