eJPT Penetration Testing Tools & Methodologies 4 — Questions and Answers
Question 1: Which command in msfconsole sets a module option value?
- configure
- set (Correct answer)
- options
- define
Correct answer: set
The 'set' command assigns a value to a module option (e.g., 'set RHOSTS 192.168.1.1') within msfconsole.
Question 2: What type of attack does Hydra primarily perform?
- SQL injection
- Online password brute-force attacks (Correct answer)
- Buffer overflow exploitation
- ARP spoofing
Correct answer: Online password brute-force attacks
Hydra is a fast, parallelized login cracker that performs brute-force and dictionary attacks against online services.
Question 3: In web application testing, what does Nikto scan for?
- Open TCP ports on a network
- Known web server vulnerabilities, misconfigurations, and dangerous files (Correct answer)
- Wireless access point encryption weaknesses
- Database schema information
Correct answer: Known web server vulnerabilities, misconfigurations, and dangerous files
Nikto is a web server scanner that checks for outdated software, dangerous files, and common misconfigurations.
Question 4: What is the purpose of using a 'staged' payload in Metasploit?
- To run multiple exploits in sequence automatically
- To send a small initial stager that downloads the full payload, reducing initial size (Correct answer)
- To encrypt the payload in multiple stages
- To test the exploit without delivering a shell
Correct answer: To send a small initial stager that downloads the full payload, reducing initial size
Staged payloads use a tiny stager (stage 0) to connect back and fetch the full-featured stage 1 payload, helping bypass size restrictions.
Question 5: Which protocol does ARP spoofing attack, and what is its primary goal in a pentest?
- DNS; redirect web traffic to a malicious server
- ARP; associate the attacker's MAC with a legitimate IP to intercept traffic (Correct answer)
- DHCP; assign rogue IP addresses to clients
- ICMP; flood the network to cause denial of service
Correct answer: ARP; associate the attacker's MAC with a legitimate IP to intercept traffic
ARP spoofing poisons the ARP cache so that traffic meant for a legitimate IP is sent to the attacker's machine instead.
Question 6: What does the Metasploit 'meterpreter' provide over a basic shell?
- A graphical interface to the target system
- An advanced in-memory payload with file transfer, pivoting, and post-exploitation modules (Correct answer)
- Automatic privilege escalation
- A web-based control panel
Correct answer: An advanced in-memory payload with file transfer, pivoting, and post-exploitation modules
Meterpreter runs entirely in memory, avoids writing to disk, and provides rich post-exploitation capabilities like file operations and pivoting.
Question 7: Which Nmap script category is most useful for detecting known vulnerabilities during a scan?
- auth
- vuln (Correct answer)
- discovery
- safe
Correct answer: vuln
The 'vuln' NSE script category runs checks for known CVEs and misconfigurations against detected services.
eJPT Penetration Testing Tools & Methodologies 4
Which command in msfconsole sets a module option value?