eJPT Vulnerability Assessment 4

Question 1

Which command correctly runs Nmap with the vulnerability scan scripts against a target?

Accepted Answer

nmap --script vuln target

Answer

The command 'nmap --script vuln target' loads all NSE scripts in the 'vuln' category to check for known vulnerabilities on the target.

Question 2

What type of vulnerability allows an attacker to inject OS commands through a web application input field?

Accepted Answer

Command Injection

Answer

Command Injection occurs when user-supplied input is passed unsanitized to a system shell, allowing attackers to execute arbitrary OS commands.

Question 3

During an assessment, you discover an FTP service allowing anonymous login. Why is this significant?

Accepted Answer

It may expose sensitive files without requiring authentication

Answer

Anonymous FTP login allows anyone to access the FTP server without credentials, potentially exposing sensitive files or allowing unauthorized uploads.

Question 4

What is the purpose of the Metasploit 'db_nmap' command?

Accepted Answer

Run Nmap scans and automatically import results into the Metasploit database

Answer

The 'db_nmap' command runs Nmap from within Metasploit and automatically stores the scan results in the Metasploit PostgreSQL database for later use.

Question 5

Which vulnerability class is described as 'a flaw that allows attackers to redirect users to malicious sites via a trusted application'?

Accepted Answer

Open Redirect

Answer

Open Redirect vulnerabilities occur when a web application accepts user-controlled input to redirect users, enabling attackers to send victims to malicious sites.

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eJPT Vulnerability Assessment 4