eJPT System Exploitation & Attack Techniques 5

Question 1

Which vulnerability class does SQL injection primarily exploit?

Accepted Answer

Insufficient input validation allowing manipulation of database queries

Answer

SQL injection occurs when user-supplied input is not properly sanitized and gets interpreted as SQL code, allowing attackers to manipulate database queries.

Question 2

In Metasploit, what is the `check` command used for before running an exploit?

Accepted Answer

To test if the target appears vulnerable without exploiting it

Answer

The `check` command probes the target to determine if it appears vulnerable to the exploit without actually attempting exploitation.

Question 3

What is the purpose of encoding a payload with msfvenom's `-e` option?

Accepted Answer

To obfuscate the payload and potentially evade signature-based detection

Answer

Encoding transforms the payload bytes to evade simple signature-based antivirus detection, though modern AV can often detect common encoders.

Question 4

Which post-exploitation Meterpreter command takes a screenshot of the victim's current desktop?

Accepted Answer

screenshot

Answer

The `screenshot` command in Meterpreter captures the current desktop display of the compromised system and saves it locally.

Question 5

When exploiting a Linux system with a buffer overflow, which register typically needs to be controlled to redirect execution?

Accepted Answer

EIP (or RIP on 64-bit)

Answer

Controlling EIP (Instruction Pointer, or RIP on 64-bit systems) allows the attacker to redirect program execution to arbitrary code such as shellcode.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT System Exploitation & Attack Techniques 5