Attacks & Exploits Flashcards

A penetration tester uses a script to send thousands of login attempts against a web application using a list of common username/password pairs. Which attack technique is being performed?

Answer: Credential stuffing

Credential stuffing uses previously breached username/password pairs to attempt logins across multiple services.

During a pentest, a tester discovers that a web application reflects user-supplied input in error messages without sanitization. Which vulnerability class does this represent?

Answer: Reflected XSS

Reflected XSS occurs when user-supplied input is immediately returned by the server in a response without proper sanitization.

A tester intercepts a JWT token and modifies the algorithm field from RS256 to none, then submits it without a signature. What vulnerability is being exploited?

Answer: JWT none algorithm vulnerability

The JWT 'none' algorithm vulnerability allows an attacker to remove the signature when the server accepts unsigned tokens with alg=none.

An attacker sends an email appearing to come from an executive asking an employee to wire funds immediately. Which social engineering technique is this?

Answer: Business Email Compromise (BEC)

Business Email Compromise (BEC) involves impersonating executives or vendors to trick employees into transferring money or sensitive data.

A tester gains code execution via a deserialization flaw in a Java application. Which tool is most commonly used to generate Java deserialization payloads?

Answer: ysoserial

ysoserial is the standard tool for generating Java deserialization exploit payloads targeting various Java libraries.

During an assessment, a tester finds a Linux SUID binary that calls system() with a relative path. Which privilege escalation technique applies?

Answer: PATH variable hijacking

PATH variable hijacking exploits SUID binaries that call system commands using relative paths by placing a malicious binary earlier in the PATH.

A penetration tester uses Responder to capture NTLMv2 hashes on a network. What type of attack does Responder perform to collect these hashes?

Answer: LLMNR/NBT-NS poisoning

Responder performs LLMNR and NBT-NS poisoning to intercept name resolution requests and capture NTLMv2 authentication hashes.