eJPT Penetration Testing Tools & Methodologies 4

Question 1

Which command in msfconsole sets a module option value?

Accepted Answer

set

Answer

The 'set' command assigns a value to a module option (e.g., 'set RHOSTS 192.168.1.1') within msfconsole.

Question 2

What type of attack does Hydra primarily perform?

Accepted Answer

Online password brute-force attacks

Answer

Hydra is a fast, parallelized login cracker that performs brute-force and dictionary attacks against online services.

Question 3

In web application testing, what does Nikto scan for?

Accepted Answer

Known web server vulnerabilities, misconfigurations, and dangerous files

Answer

Nikto is a web server scanner that checks for outdated software, dangerous files, and common misconfigurations.

Question 4

What is the purpose of using a 'staged' payload in Metasploit?

Accepted Answer

To send a small initial stager that downloads the full payload, reducing initial size

Answer

Staged payloads use a tiny stager (stage 0) to connect back and fetch the full-featured stage 1 payload, helping bypass size restrictions.

Question 5

Which protocol does ARP spoofing attack, and what is its primary goal in a pentest?

Accepted Answer

ARP; associate the attacker's MAC with a legitimate IP to intercept traffic

Answer

ARP spoofing poisons the ARP cache so that traffic meant for a legitimate IP is sent to the attacker's machine instead.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test