OSCP - Offensive Security Certified Professional — Questions and Answers

Question 1: How do you list all running cron jobs for all users on a Linux system as root?

ps aux | grep cron
cat /etc/cron.d/*
ls -la /var/spool/cron/crontabs/ && cat /etc/cron* (Correct answer)
crontab -l

Correct answer: ls -la /var/spool/cron/crontabs/ && cat /etc/cron*

Cron jobs per user live in /var/spool/cron/crontabs/ and system-wide jobs are in /etc/cron*, so both locations must be checked.

Question 2: File for creating cron jobs.

/etc/fstab
/var/log
/etc/mtab
/etc/crontab (Correct answer)

Correct answer: /etc/crontab

The `/etc/crontab` file is a system-wide configuration file used to schedule cron jobs, which are automated tasks that run at specified intervals. This file defines the commands to be executed and their respective schedules, allowing system administrators to automate routine maintenance, backups, and other operations without manual intervention. It's a central point for managing recurring system tasks.

Question 3: During post-exploitation on Linux, which directory often contains bash history files for multiple users that may reveal credentials or internal commands?

/var/log/auth.log
/home/*/.bash_history and /root/.bash_history (Correct answer)
/var/spool/mail/
/etc/profile.d/

Correct answer: /home/*/.bash_history and /root/.bash_history

Bash history files in each user's home directory often capture previously entered commands including passwords typed as arguments and internal hostnames.

Question 4: Which one provides details on the command

mkdir
man (Correct answer)
su
rm

Correct answer: man

The `man` command (short for 'manual') is used in Linux to display the manual pages for commands, utilities, and functions. It provides comprehensive documentation, including a description of the command, its syntax, options, and examples. This makes `man` an invaluable tool for users to understand how to effectively use various command-line tools and system functions.

Question 5: In Kali Linux, what does the 'crunch' tool generate and how is it used in OSCP scenarios?

Generates network packet captures for analysis
Generates custom wordlists based on character sets and length parameters (Correct answer)
Generates exploit shellcode patterns
Generates SSL certificates for MITM attacks

Correct answer: Generates custom wordlists based on character sets and length parameters

Crunch creates custom wordlists by specifying minimum/maximum length and character sets, useful for targeted password attacks when password policy is known.

Question 6: What commands can read the content of a file?

Touch
Sudo
Whoami
Cat (Correct answer)

Correct answer: Cat

The `cat` command (short for concatenate) is a standard Unix/Linux utility primarily used to display the content of files on the standard output. It can also be used to combine multiple files or create new ones. The other options like `whoami`, `touch`, and `sudo` serve different purposes, such as identifying the current user, creating empty files, or executing commands with elevated privileges, respectively.

Question 7: Which HTTP method is most commonly exploited to upload a malicious web shell to a vulnerable web server?

OPTIONS
PUT (Correct answer)
GET
DELETE

Correct answer: PUT

The HTTP PUT method allows clients to upload files to a server; if misconfigured, attackers can upload a web shell granting remote code execution.

Question 8: When testing badchars, you send \x01 through \xff in the payload. In the debugger's stack dump, \x0a is missing and \x0b appears as \x00. What can you conclude?

0x0b is a bad character; 0x0a may be fine since it is absent
Both 0x0a and 0x0b are bad characters (Correct answer)
Only 0x0a is a bad character
Neither is bad — the debugger view is truncated

Correct answer: Both 0x0a and 0x0b are bad characters

A missing byte means it was stripped (bad), and a corrupted subsequent byte indicates the bad char caused corruption — both must be excluded.

Question 9: Which Nmap timing template (-T) value provides the most aggressive scan speed?

-T5 (Correct answer)
-T4
-T3
-T2

Correct answer: -T5

The -T5 'insane' timing template is the most aggressive, sending packets as fast as possible at the risk of missing results due to network congestion.

Question 10: A root process executes a bash script that uses 'eval' on user-controlled input. What vulnerability does this create?

Race condition
Arbitrary command execution via command injection (Correct answer)
Directory traversal
Integer overflow

Correct answer: Arbitrary command execution via command injection

eval executes its argument as a shell command; if that argument includes attacker-controlled data, the attacker can inject arbitrary commands that run at the script's privilege level.

Question 11: Which command finds SUID binaries on a Linux system that could be leveraged for privilege escalation?

ls -la /usr/bin | grep s
find / -perm -u=s -type f 2>/dev/null (Correct answer)
chmod u+s /bin/bash
ps aux | grep suid

Correct answer: find / -perm -u=s -type f 2>/dev/null

The find command with -perm -u=s locates all files with the SUID bit set, which run as the file owner regardless of who executes them.

Question 12: What is the difference between online and offline password attacks?

Online attacks require internet access; offline attacks work on a local network
Online attacks target web applications; offline attacks target desktop apps
Online attacks guess passwords against live services; offline attacks crack captured hashes without network interaction (Correct answer)
Online attacks use wordlists; offline attacks use brute force only

Correct answer: Online attacks guess passwords against live services; offline attacks crack captured hashes without network interaction

Online attacks authenticate against live services (SSH, FTP, RDP) and are rate-limited and detectable, while offline attacks crack captured password hashes locally without network interaction.

Question 13: Which service typically runs on port 3306 and is a common target for enumeration in OSCP labs?

PostgreSQL
Microsoft SQL Server
MySQL/MariaDB (Correct answer)
Oracle Database

Correct answer: MySQL/MariaDB

Port 3306 is the default port for MySQL and MariaDB database servers, which are frequently found in OSCP lab environments.

Question 14: What Windows command displays all locally stored credentials and cached tokens?

cmdkey /list (Correct answer)
net user /all
whoami /priv
systeminfo /creds

Correct answer: cmdkey /list

The 'cmdkey /list' command displays all credentials stored in the Windows Credential Manager, which may include domain accounts, RDP credentials, or service account passwords.

Question 15: What is an 'unquoted service path' vulnerability in Windows?

A service with a default password that is not changed
A service that does not encrypt its network communications
A service with its binary path not enclosed in quotes, allowing path hijacking if the path contains spaces (Correct answer)
A service running without any authentication

Correct answer: A service with its binary path not enclosed in quotes, allowing path hijacking if the path contains spaces

When a Windows service's binary path contains spaces and is not enclosed in quotes, Windows tries multiple path interpretations, allowing an attacker to place a malicious executable in an intermediate path.

Question 16: Which command would an attacker use to enumerate writable directories in the PATH that could enable a path hijacking attack?

env | grep PATH
echo $PATH | tr ':' '\n' | xargs ls -ld (Correct answer)
find / -name PATH
which env

Correct answer: echo $PATH | tr ':' '\n' | xargs ls -ld

Splitting $PATH and checking directory permissions reveals writable entries where a malicious binary can be placed to hijack script execution.

Question 17: What command in GDB is used to examine 20 words of memory at the ESP register to verify shellcode placement?

info registers esp 20
display/20x $esp
x/20x $esp (Correct answer)
dump memory /tmp/stack.bin $esp $esp+80

Correct answer: x/20x $esp

The 'x' (examine) command with format specifier x/20x $esp shows 20 hex words starting at ESP, allowing verification of stack contents.

Question 18: What are NTLMv2 challenge-response hashes and how are they typically cracked in OSCP?

They are base64-encoded and can be decoded directly
They are captured during authentication challenges (via Responder) and cracked offline with hashcat using module 5600 (Correct answer)
They require a live connection to crack via pass-the-hash
They are stored in the SAM database and cracked with secretsdump.py

Correct answer: They are captured during authentication challenges (via Responder) and cracked offline with hashcat using module 5600

NTLMv2 hashes are challenge-response authentication tokens captured from network traffic or via tools like Responder, and are cracked offline using hashcat module 5600 (NetNTLMv2).

Question 19: What tool provides an automated network and service enumeration report, similar to running multiple tools in sequence?

AutoRecon (Correct answer)
Nikto --Format
Metasploit db_autopwn
SQLmap --crawl

Correct answer: AutoRecon

AutoRecon is a multi-threaded network reconnaissance tool that automatically runs multiple scanning tools and organizes results into a structured directory.

Question 20: In Windows x86 exploitation, a POP POP RET gadget is used in SEH overwrites because it accomplishes what?

It slides execution through the NOP sled to shellcode
It pops shellcode off the stack into EIP directly
It removes two stack values then returns to the address stored in ESP, which points to nSEH (Correct answer)
It disables the SafeSEH check by corrupting the SEH validation table

Correct answer: It removes two stack values then returns to the address stored in ESP, which points to nSEH

POP POP RET adjusts ESP past the exception record pointers so that RET loads the nSEH address into EIP.

Question 21: What does an attacker gain when they successfully exploit an XML External Entity (XXE) vulnerability?

Remote code execution via SQL
The ability to modify CSS on the page
Access to cleartext passwords in memory
Ability to read arbitrary local files or perform SSRF (Correct answer)

Correct answer: Ability to read arbitrary local files or perform SSRF

XXE vulnerabilities allow attackers to define external XML entities that reference local files or internal URLs, enabling file disclosure or Server-Side Request Forgery.

Question 22: Which protocol and port combination indicates an LDAP service that might be enumerated for Active Directory information?

TCP 445
UDP 161
UDP 137
TCP 389 (Correct answer)

Correct answer: TCP 389

LDAP (Lightweight Directory Access Protocol) runs on TCP port 389 and is used by Active Directory for directory queries, making it a valuable enumeration target.

Question 23: What is John the Ripper's primary use case versus hashcat in an OSCP context?

John cracks passwords online; hashcat only works offline
John supports more protocols; hashcat only supports common algorithms
John handles only Linux hashes; hashcat handles only Windows hashes
John is CPU-based and good for auto-detecting hash types; hashcat is GPU-accelerated and faster for bulk cracking (Correct answer)

Correct answer: John is CPU-based and good for auto-detecting hash types; hashcat is GPU-accelerated and faster for bulk cracking

John the Ripper auto-detects hash formats and is CPU-based making it versatile for quick analysis, while hashcat leverages GPU acceleration for much faster bulk password cracking.

Question 24: How many different kinds of buffer-overflow attacks exist?

4
2 (Correct answer)
5
3

Correct answer: 2

There are primarily two main types of buffer-overflow attacks: stack-based buffer overflows and heap-based buffer overflows. Stack-based overflows target data stored on the call stack, while heap-based overflows exploit vulnerabilities in data allocated on the heap memory. Both types can lead to severe security vulnerabilities if exploited successfully.

Question 25: Which Windows registry key stores hashed credentials for locally cached domain accounts?

HKLM\SAM\SAM\Domains\Account
HKCU\Software\Microsoft\Windows\CurrentVersion\Authentication
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
HKLM\SECURITY\Cache (Correct answer)

Correct answer: HKLM\SECURITY\Cache

The HKLM\SECURITY\Cache registry key stores NL$Cache entries, which are MS-Cache v2 hashes of domain user credentials cached for offline login.

Question 26: Return-Oriented Programming (ROP) is used to bypass DEP. What are ROP gadgets?

Heap spray payloads that pivot execution to a non-DEP region
Short sequences of existing executable instructions ending in a RET, chained via the stack (Correct answer)
NOP slides encoded to avoid DEP page permission checks
Shellcode stubs stored in the .text section of the target binary

Correct answer: Short sequences of existing executable instructions ending in a RET, chained via the stack

ROP chains existing code (gadgets: instruction sequences ending in RET) already marked executable to perform arbitrary operations without injecting new code.

Question 27: Which Nmap output format is most useful for importing results into other tools during OSCP?

-oX (XML) (Correct answer)
-oG (grepable)
-oS (script kiddie)
-oN (normal)

Correct answer: -oX (XML)

The -oX XML output format is the most versatile for importing into tools like Metasploit, OpenVAS, and other security platforms that parse XML.

Question 28: What tool can dump Windows NTLM password hashes from the SAM database when running as SYSTEM?

CrackMapExec
Responder
Hydra
Mimikatz (Correct answer)

Correct answer: Mimikatz

Mimikatz's 'lsadump::sam' or 'sekurlsa::logonpasswords' commands can extract NTLM hashes and plaintext credentials from the SAM database and LSASS memory when run with SYSTEM privileges.

Question 29: Where .so (Library file, stands for "shared object") are stored (basically like Windows .dll files).

/lib (Correct answer)
/etc
/bin
/boot

Correct answer: /lib

In the Linux file system hierarchy, the `/lib` directory (or `/usr/lib` for non-essential libraries) is where shared libraries, often ending with the `.so` extension (shared object), are stored. These files are analogous to `.dll` files in Windows and contain code that can be used by multiple programs, allowing for efficient resource sharing and modularity across the system.

Question 30: Mike wants to replicate his files, but he also doesn't want them to be overwritten. What instruction should he issue?

cp -m
cp -a
cp
cp -i (Correct answer)

Correct answer: cp -i

The `cp` command is used to copy files and directories. The `-i` option stands for 'interactive', which prompts the user for confirmation before overwriting an existing file. This ensures that Mike's files will not be overwritten without his explicit consent, fulfilling his requirement to replicate files without overwriting them.

Question 31: What is a Kerberoasting attack and what does it target?

Brute-forcing Kerberos login passwords at the domain controller
Requesting service tickets for SPN-registered accounts and cracking the ticket's embedded hash offline (Correct answer)
Forging Kerberos tickets using a stolen krbtgt hash
Intercepting Kerberos AS-REQ packets from client machines

Correct answer: Requesting service tickets for SPN-registered accounts and cracking the ticket's embedded hash offline

Kerberoasting requests TGS service tickets for accounts with SPNs registered, which are encrypted with the service account's password hash, allowing offline cracking of the hash without requiring high privileges.

Question 32: What does the command 'sudo -l' reveal during a Linux privilege escalation assessment?

All users with sudo access
The sudo version installed
Failed sudo attempts
Commands the current user can run with elevated privileges (Correct answer)

Correct answer: Commands the current user can run with elevated privileges

sudo -l lists the specific commands the current user is allowed to run as root or other users without a password, often revealing escalation paths.

Question 33: In Kali Linux, which command updates the package database AND upgrades all installed packages in a single step?

apt-get upgrade
apt-get update
apt-get dist-upgrade
apt-get update && apt-get upgrade (Correct answer)

Correct answer: apt-get update && apt-get upgrade

Running apt-get update refreshes the package list, then apt-get upgrade installs newer versions; both must be chained to accomplish both tasks.

Question 34: In a Local File Inclusion (LFI) vulnerability, which of the following payloads is used to traverse directories and read /etc/passwd?

;cat /etc/passwd
<?php include('/etc/passwd'); ?>
../../../etc/passwd (Correct answer)
SELECT /etc/passwd

Correct answer: ../../../etc/passwd

Path traversal sequences (../) are used in LFI to navigate up the directory tree and access files outside the web root such as /etc/passwd.

Question 35: When enumerating NFS shares during OSCP, which command shows available exports on a target?

rpcinfo --list <target>
showmount -e <target> (Correct answer)
nfsstat -m <target>
mount -t nfs <target>:/

Correct answer: showmount -e <target>

The 'showmount -e' command queries the NFS server and displays its list of exported directories along with any access restrictions.

Question 36: In Kali Linux, what is the function of 'responder' during an internal network engagement?

Responds to ICMP ping requests
Intercepts and responds to HTTP requests
Responds to ARP requests to build a network map
Poisons LLMNR/NBT-NS/mDNS requests to capture NTLMv2 hashes (Correct answer)

Correct answer: Poisons LLMNR/NBT-NS/mDNS requests to capture NTLMv2 hashes

Responder listens for LLMNR, NBT-NS, and mDNS broadcast queries and responds to them, tricking hosts into authenticating and capturing NTLMv2 credential hashes.

Question 37: What does ASLR (Address Space Layout Randomization) do that complicates standard buffer overflow exploitation?

It randomizes base addresses of the stack, heap, and libraries each run, making hardcoded addresses unreliable (Correct answer)
It encrypts the stack so shellcode cannot execute
It marks all memory pages as non-executable by default
It inserts stack canaries before every function return

Correct answer: It randomizes base addresses of the stack, heap, and libraries each run, making hardcoded addresses unreliable

ASLR randomizes memory layout on each execution, so a hardcoded JMP ESP or shellcode address will be invalid on the next run.

Question 38: Which command would you use with Nmap to enumerate SNMP services running on UDP port 161?

nmap -sV -p 161 --script=http-info <target>
nmap -sU -p 161 --script=snmp-info <target> (Correct answer)
nmap -sS -p 161 --script=ftp-anon <target>
nmap -sT -p 161 --script=snmp-brute <target>

Correct answer: nmap -sU -p 161 --script=snmp-info <target>

SNMP runs on UDP port 161, so you must use -sU for a UDP scan combined with the snmp-info script to enumerate SNMP information.

Question 39: Which directory you are in can be determined

whoami
--help
man
pwd (Correct answer)

Correct answer: pwd

The `pwd` command (short for 'print working directory') is used in Linux to display the full path of the current directory you are in. This command is fundamental for navigating the file system and understanding your current location within the directory hierarchy. It helps users orient themselves and ensures commands are executed in the intended location.

Question 40: A penetration tester finds that /etc/sudoers contains 'user ALL=(ALL) NOPASSWD: /usr/bin/vim'. How can this be exploited for privilege escalation?

Run 'sudo vim' then use ':!/bin/bash' to spawn a root shell (Correct answer)
Edit /etc/passwd directly using vim
Create a symlink from /usr/bin/vim to /bin/bash
Inject a cron job via vim's vimrc

Correct answer: Run 'sudo vim' then use ':!/bin/bash' to spawn a root shell

Vim's shell escape ':!/bin/bash' spawns a shell that inherits vim's permissions, so running vim via sudo produces a root shell.

Question 41: Which Kali Linux meta-package installs the top 10 most popular penetration testing tools?

kali-tools-top10 (Correct answer)
kali-linux-default
kali-linux-full
kali-linux-large

Correct answer: kali-tools-top10

The kali-tools-top10 meta-package installs the 10 most widely used tools included in Kali's curated top-10 list.

Question 42: You run msf-pattern_offset with the 4 bytes found in EIP (41306241) and get offset 1978. Your exploit buffer should look like which of the following?

'A' * 1974 + EIP + shellcode
'A' * 1978 + EIP + shellcode (Correct answer)
'A' * 1982 + EIP + shellcode
'A' * 1978 + shellcode + EIP

Correct answer: 'A' * 1978 + EIP + shellcode

1978 A's fill the buffer up to EIP, the next 4 bytes overwrite EIP with your chosen address, then the shellcode follows in the remaining buffer.

Question 43: What is a rainbow table attack and why is it less effective against salted hashes?

A precomputed table of hash-to-plaintext mappings; salting adds random data making each hash unique and invalidating precomputed tables (Correct answer)
A GPU-accelerated brute-force attack; salting slows GPU computations
A network-based attack; salting hides the hash from network sniffers
A dictionary attack using colorful wordlists; salting encrypts the wordlist

Correct answer: A precomputed table of hash-to-plaintext mappings; salting adds random data making each hash unique and invalidating precomputed tables

Rainbow tables are precomputed hash-to-password lookup tables; adding a unique salt to each password before hashing means the same password produces different hashes, making precomputed tables useless.

Question 44: What Nmap script category is most useful for initial service version detection during OSCP enumeration?

--script=auth
--script=vuln
--script=exploit
--script=default (Correct answer)

Correct answer: --script=default

The 'default' script category runs commonly useful scripts that are safe, reliable, and provide helpful service information without being intrusive.

Question 45: When testing for reflected XSS, which of the following payloads is a basic proof-of-concept?

../../../../etc/passwd
' OR 1=1--
<script>alert(1)</script> (Correct answer)
SLEEP(5)

Correct answer: <script>alert(1)</script>

The classic XSS PoC payload <script>alert(1)</script> tests whether user input is reflected unsanitized in the page and executes JavaScript in the browser.

Question 46: What Nmap script can identify anonymous FTP login on a target?

--script=ftp-anon (Correct answer)
--script=ftp-bounce
--script=ftp-brute
--script=ftp-vsftpd-backdoor

Correct answer: --script=ftp-anon

The ftp-anon script checks if an FTP server allows anonymous logins, which can be a significant misconfiguration exposing files without authentication.

Question 47: When crafting a buffer overflow exploit in Python, what struct.pack format is used to convert an integer address like 0x0049BF4A into little-endian bytes?

struct.pack('!I', 0x0049BF4A)
struct.pack('<I', 0x0049BF4A) (Correct answer)
struct.pack('=I', 0x0049BF4A)
struct.pack('>I', 0x0049BF4A)

Correct answer: struct.pack('<I', 0x0049BF4A)

'<I' specifies little-endian unsigned int, which is required for x86 architecture where the least significant byte is stored at the lowest address.

Question 48: Which Nmap scan type sends TCP SYN packets and is often called a 'half-open' scan?

-sS (SYN scan) (Correct answer)
-sT (TCP connect scan)
-sU (UDP scan)
-sA (ACK scan)

Correct answer: -sS (SYN scan)

The -sS SYN scan sends a SYN packet and listens for a SYN-ACK without completing the three-way handshake, making it stealthier than a full connect scan.

Question 49: What does the SLEEP() function in a SQL injection payload help an attacker determine?

The database version
The number of columns in a query
Whether the injection point exists via time delay (Correct answer)
The table names in the database

Correct answer: Whether the injection point exists via time delay

SLEEP() is used in time-based blind SQLi to confirm a vulnerable injection point by causing a measurable delay in the server's response.

Question 50: During an OSCP lab, you find port 111 open on a Linux target. What service is most likely running?

HTTP proxy
Portmapper/RPC (Correct answer)
DNS resolver
LDAP directory

Correct answer: Portmapper/RPC

Port 111 is used by the Portmapper (rpcbind) service, which maps RPC program numbers to network port numbers and is commonly found on Linux/Unix systems.

Question 51: Which command in Kali Linux sets a file's SUID bit to make it execute with the owner's privileges?

chown root filename
chmod +x filename
chmod 777 filename
chmod u+s filename (Correct answer)

Correct answer: chmod u+s filename

chmod u+s sets the SUID bit on a file, causing it to run with the file owner's effective privileges — a key privilege escalation vector.

Question 52: Which Burp Suite tool is best suited for fuzzing parameters with multiple payloads to find injection points?

Decoder
Proxy
Repeater
Intruder (Correct answer)

Correct answer: Intruder

Burp Intruder automates customized attacks by fuzzing parameters with payload lists, making it ideal for finding injection vulnerabilities across multiple positions.

Question 53: What hashcat command cracks an NTLM hash using the rockyou wordlist?

hashcat -mode ntlm -list rockyou.txt hashes.txt
hashcat -a 3 -m 0 hashes.txt ?a?a?a?a
hashcat --ntlm -w rockyou.txt -o cracked.txt
hashcat -a 0 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt (Correct answer)

Correct answer: hashcat -a 0 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

The command uses -a 0 for wordlist attack mode, -m 1000 which is the hashcat module number for NTLM hashes, then specifies the hash file and wordlist.

Question 54: Which Kali Linux tool is specifically designed for brute-forcing web application login forms over HTTP?

hydra with http-post-form module (Correct answer)
ncrack -p 80
john --wordlist
medusa -M ssh

Correct answer: hydra with http-post-form module

Hydra's http-post-form module allows specifying the form URL, parameters, and failure string to brute-force web login forms.

Question 55: Linux file system that is virtualized and gives you access to the kernel's perspective

/var
/proc (Correct answer)
/dev
/sbin

Correct answer: /proc

The `/proc` file system in Linux is a virtual file system that provides a dynamic interface to the kernel's internal data structures and processes. It doesn't contain traditional files but rather real-time system information, including details about running processes, kernel parameters, and hardware. This allows users and programs to access the kernel's perspective and monitor system status.

Question 56: Which tool is used to perform DNS zone transfer attacks during OSCP reconnaissance?

nslookup -type=A
host -t MX
dig axfr (Correct answer)
whois -d

Correct answer: dig axfr

The command 'dig axfr @<nameserver> <domain>' requests a full DNS zone transfer, which can reveal all DNS records if the server is misconfigured.

Question 57: What does the Nmap -A flag enable?

OS detection, version detection, script scanning, and traceroute (Correct answer)
Aggressive brute-force mode
Anonymous login detection only
All UDP ports scan

Correct answer: OS detection, version detection, script scanning, and traceroute

The -A flag enables aggressive mode, which combines OS detection (-O), version scanning (-sV), script scanning (-sC), and traceroute in a single flag.

Question 58: What Kali Linux command would you use to recursively search all files in /etc for the string 'password'?

grep -r 'password' /etc (Correct answer)
locate password /etc
cat /etc/* | grep password
find /etc -name 'password'

Correct answer: grep -r 'password' /etc

grep -r recursively searches file contents for the specified string within the given directory, making it ideal for credential hunting during post-exploitation.

Question 59: What tool is best suited for enumerating SMB shares on a Windows target during an OSCP engagement?

gobuster
wfuzz
enum4linux (Correct answer)
dirb

Correct answer: enum4linux

Enum4linux is a tool for enumerating information from Windows and Samba systems, including shares, users, groups, and password policies.

Question 60: Which Linux capability, if assigned to a binary, allows it to bypass file permission checks and is dangerous from a security perspective?

cap_sys_time
cap_dac_override (Correct answer)
cap_net_raw
cap_audit_write

Correct answer: cap_dac_override

cap_dac_override allows a process to bypass discretionary access control (DAC) file read/write/execute permission checks, enabling access to any file.

Question 61: Which msfvenom encoder is commonly used when 0x00, 0x0a, and 0x0d are bad characters and encoding is required?

x64/xor_dynamic
x86/alpha_mixed
x86/shikata_ga_nai (Correct answer)
x86/call4_dword_xor

Correct answer: x86/shikata_ga_nai

x86/shikata_ga_nai is a polymorphic XOR encoder that avoids null bytes and other common bad characters by default.

Question 62: A fuzzer sends increasingly large strings to a vulnerable service and it crashes when the buffer is 1100 bytes. What is the correct next step?

Send 2200 bytes to confirm the overflow is repeatable
Send a cyclic pattern of 1100 bytes to find the exact EIP offset (Correct answer)
Immediately generate shellcode and attempt exploitation
Use GDB to find the JMP ESP address

Correct answer: Send a cyclic pattern of 1100 bytes to find the exact EIP offset

After identifying the crash size, a unique cyclic pattern (e.g., from msf-pattern_create) of that length is sent to determine the exact EIP offset.

Question 63: Which vulnerability occurs when user-supplied input is reflected in a web page without proper sanitization and executes in a victim's browser?

SQL Injection
Cross-Site Scripting (XSS) (Correct answer)
Directory Traversal
CSRF

Correct answer: Cross-Site Scripting (XSS)

XSS allows attackers to inject malicious scripts into web pages viewed by other users, potentially stealing cookies or performing actions on their behalf.

Question 64: What is the purpose of the 'rpcinfo -p <target>' command during enumeration?

Scan all open UDP ports
Perform a remote password reset via RPC
List all running processes on the target
Enumerate all RPC services and their port numbers on the target (Correct answer)

Correct answer: Enumerate all RPC services and their port numbers on the target

The 'rpcinfo -p' command queries the portmapper and lists all registered RPC programs, their versions, protocol, and the ports they are listening on.

Question 65: What is the significance of a binary with both SUID bit and 'cap_setuid' capability set on Linux?

It can only be run by root
It requires a password to execute
It runs in a sandbox
It can change its effective UID to any user including root, providing two independent escalation paths (Correct answer)

Correct answer: It can change its effective UID to any user including root, providing two independent escalation paths

SUID runs the binary as its owner's UID, while cap_setuid allows explicit UID changes; either alone provides privilege escalation potential if the binary is exploitable.

Question 66: What tool would you use to brute-force directory and file names on a web server during OSCP?

enum4linux
responder
bloodhound
gobuster (Correct answer)

Correct answer: gobuster

Gobuster is a tool used to brute-force URIs (directories and files), DNS subdomains, and virtual host names using wordlists.

Question 67: What does the 'badchars' identification step accomplish in a buffer overflow exploit?

It determines the exact offset to EIP
It generates the final payload with msfvenom
It finds characters that corrupt or truncate shellcode in memory (Correct answer)
It locates the JMP ESP instruction address

Correct answer: It finds characters that corrupt or truncate shellcode in memory

Bad characters are bytes that get modified, dropped, or cause early string termination, which would break shellcode execution.

Question 68: What type of hash does Windows use by default for local account authentication in modern systems?

SHA-256
bcrypt
NTLM (NT hash) (Correct answer)
MD5

Correct answer: NTLM (NT hash)

Modern Windows systems use NTLM hashes (specifically the NT hash, which is MD4 of the Unicode password) for local authentication stored in the SAM database.

Question 69: What does the acronym 'OSINT' stand for in the context of OSCP reconnaissance?

Offensive System Integrated Network Testing
Open Source Intelligence (Correct answer)
Operational Security Intrusion Network Tool
Online System Information and Tracking

Correct answer: Open Source Intelligence

OSINT (Open Source Intelligence) refers to collecting information from publicly available sources like websites, social media, WHOIS records, and DNS data.

Question 70: An attacker has a low-privilege shell. Which file, if world-readable, would allow them to crack user password hashes offline?

/etc/sudoers
/etc/group
/etc/shadow (Correct answer)
/etc/passwd

Correct answer: /etc/shadow

/etc/shadow contains hashed passwords and is normally readable only by root, making it a high-value target for privilege escalation.

Question 71: Which Nmap flag combination is commonly recommended for a comprehensive initial OSCP scan?

-sV -sC -p- -T4 (Correct answer)
-sN -sX -sF
-sT -O -F
-sU -sV --open

Correct answer: -sV -sC -p- -T4

The combination -sV -sC -p- -T4 scans all 65535 ports with service version detection and default scripts at an aggressive timing template.

Question 72: During a web application assessment, you notice the URL contains 'page=about'. Which vulnerability should you immediately test for?

CSRF
XSS
SQL Injection
Local File Inclusion (LFI) (Correct answer)

Correct answer: Local File Inclusion (LFI)

A URL parameter that specifies a file or page name is a classic indicator of a potential LFI vulnerability, where user input directly controls file includes.

Question 73: What is DLL hijacking in the context of Windows privilege escalation?

Placing a malicious DLL in a directory searched before the legitimate DLL location (Correct answer)
Modifying system DLL files in System32
Replacing Windows Update DLLs with backdoored versions
Injecting shellcode into a running DLL in memory

Correct answer: Placing a malicious DLL in a directory searched before the legitimate DLL location

DLL hijacking exploits Windows's DLL search order by placing a malicious DLL with the correct name in a directory that is searched before the legitimate DLL's directory.

Question 74: What does the command 'updatedb' do in Kali Linux and why is it relevant to OSCP engagements?

Synchronizes NTP time database
Updates the APT database
Updates the Metasploit database
Rebuilds the locate command's file index database (Correct answer)

Correct answer: Rebuilds the locate command's file index database

updatedb rebuilds the database used by the locate command, enabling fast file searches which is useful for quickly finding exploit scripts or config files.

Question 75: What is a Linux 'shared object injection' (LD_PRELOAD) attack?

Loading a malicious shared library before the standard ones to override functions in a privileged binary (Correct answer)
Injecting shellcode into a shared memory segment
Exploiting a buffer overflow in a shared library
Modifying the /etc/ld.so.conf to redirect library paths

Correct answer: Loading a malicious shared library before the standard ones to override functions in a privileged binary

LD_PRELOAD forces the dynamic linker to load a specified shared library first, allowing an attacker to override libc functions in any binary that respects this variable.

Question 76: What is the Kali Linux command to start the PostgreSQL database service required by Metasploit?

systemctl start metasploit
msfdb init
Both commands are needed — service postgresql start then msfdb init (Correct answer)
service postgresql start

Correct answer: Both commands are needed — service postgresql start then msfdb init

PostgreSQL must first be started with 'service postgresql start', then 'msfdb init' initializes and connects the Metasploit database.

OSCP - Offensive Security Certified Professional

The OSCP (PEN-200) is a hands-on penetration testing certification by OffSec requiring candidates to compromise target machines in a 23h45m practical exam worth 100 points. This practice test covers the core knowledge domains underlying the PEN-200 curriculum.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds