eJPT Penetration Testing Tools & Methodologies 3 — Questions and Answers
Question 1: Which phase of a penetration test involves documenting vulnerabilities found and providing remediation guidance?
- Reconnaissance
- Exploitation
- Reporting (Correct answer)
- Scanning
Correct answer: Reporting
The reporting phase summarizes findings, risk ratings, and actionable remediation steps for the client.
Question 2: What is the primary function of John the Ripper?
- Network packet capture
- Password hash cracking (Correct answer)
- Web application fuzzing
- Port scanning
Correct answer: Password hash cracking
John the Ripper is a password cracking tool that supports dictionary, brute-force, and rule-based attacks against hashed passwords.
Question 3: In Metasploit, what is a 'payload'?
- The vulnerability being exploited
- The code executed on the target after exploitation (Correct answer)
- The listener on the attacker machine
- The auxiliary scanner module
Correct answer: The code executed on the target after exploitation
A payload is the shellcode or code that runs on the target system after the exploit successfully executes.
Question 4: Which tool is specifically designed for enumerating SMB shares and users on Windows systems?
- Enum4linux (Correct answer)
- Gobuster
- Sqlmap
- Dirb
Correct answer: Enum4linux
Enum4linux is a Linux-based tool that wraps Samba utilities to enumerate SMB shares, users, and policies on Windows/Samba hosts.
Question 5: What does the 'LHOST' option in Metasploit specify?
- The target host's IP address
- The attacker's IP address where the reverse shell connects back (Correct answer)
- The local database host
- The network broadcast address
Correct answer: The attacker's IP address where the reverse shell connects back
LHOST (Local Host) sets the attacker's IP address that the reverse payload will call back to after successful exploitation.
Question 6: Which Nmap scan type sends only a SYN packet and is often called a 'stealth scan'?
- -sT
- -sS (Correct answer)
- -sA
- -sN
Correct answer: -sS
The '-sS' SYN scan sends SYN packets and never completes the TCP handshake, making it less likely to appear in application logs.
Question 7: What is the goal of the 'enumeration' phase in a penetration test?
- Gaining initial access to the target
- Extracting detailed information about discovered services and users (Correct answer)
- Covering tracks after exploitation
- Writing the final report
Correct answer: Extracting detailed information about discovered services and users
Enumeration involves actively querying services to extract usernames, shares, OS versions, and other actionable details.
eJPT Penetration Testing Tools & Methodologies 3
Which phase of a penetration test involves documenting vulnerabilities found and providing remediation guidance?