eJPT Penetration Testing Tools & Methodologies 2 — Questions and Answers
Question 1: Which Metasploit command searches for modules related to a specific vulnerability or service?
- use
- search (Correct answer)
- show exploits
- info
Correct answer: search
The 'search' command in msfconsole lets you find modules by keyword, CVE, or platform.
Question 2: What does the Nmap flag '-sU' perform?
- SYN scan
- UDP scan (Correct answer)
- Service version detection
- OS fingerprinting
Correct answer: UDP scan
The '-sU' flag instructs Nmap to perform a UDP port scan instead of the default TCP scan.
Question 3: In a penetration test, what is 'pivoting'?
- Escalating privileges on a compromised host
- Using a compromised host to attack other internal systems (Correct answer)
- Clearing logs after exploitation
- Switching between different exploit modules
Correct answer: Using a compromised host to attack other internal systems
Pivoting uses a compromised machine as a relay to reach and attack other network segments not directly accessible.
Question 4: Which tool is commonly used for capturing and analyzing network packets during a penetration test?
- Burp Suite
- Wireshark (Correct answer)
- Hydra
- Nikto
Correct answer: Wireshark
Wireshark is a network protocol analyzer used to capture and inspect packets in real time.
Question 5: What is the purpose of a 'bind shell' in post-exploitation?
- The attacker's machine listens and the target connects outbound
- The target machine opens a listener and the attacker connects to it (Correct answer)
- A shell spawned inside a browser sandbox
- A reverse shell tunneled over HTTPS
Correct answer: The target machine opens a listener and the attacker connects to it
A bind shell opens a listening port on the target, allowing the attacker to connect inbound to gain shell access.
Question 6: Which Nmap option is used to detect the operating system of a target host?
- -sV
- -O (Correct answer)
- -A
- -Pn
Correct answer: -O
The '-O' flag enables Nmap's OS detection engine, which fingerprints the target's operating system.
Question 7: What does SQLmap's '--dbs' flag do?
- Dumps all table data
- Enumerates available databases (Correct answer)
- Tests for blind SQL injection only
- Sets the database type manually
Correct answer: Enumerates available databases
The '--dbs' flag tells SQLmap to enumerate and list all databases accessible on the target server.
eJPT Penetration Testing Tools & Methodologies 2
Which Metasploit command searches for modules related to a specific vulnerability or service?