Attacks & Exploits Flashcards

A tester discovers a web server running PHP with the allow_url_include directive enabled. An attacker supplies a remote URL as a file parameter. What attack is possible?

Answer: Remote File Inclusion (RFI)

Remote File Inclusion (RFI) allows attackers to include and execute remote files when the server fetches and processes URLs passed as parameters.

An attacker on a switched network sends gratuitous ARP replies mapping the default gateway's IP to their own MAC address. What is the goal?

Answer: ARP cache poisoning for MitM

ARP cache poisoning redirects network traffic through the attacker's machine by associating the gateway's IP with the attacker's MAC address.

During a Windows pentest, a tester extracts the NTDS.dit file from a domain controller. What is the purpose of obtaining this file?

Answer: To extract all domain password hashes

NTDS.dit is the Active Directory database that stores all domain user account password hashes, making it a primary credential harvesting target.

A tester submits XML input containing a DOCTYPE declaration that references an external entity pointing to /etc/passwd. Which vulnerability is being tested?

Answer: XXE injection

XXE (XML External Entity) injection exploits XML parsers that process external entity references, potentially exposing local files or internal services.

A tester sets up a rogue Wi-Fi access point with the same SSID as a corporate network to capture client credentials. What is this attack called?

Answer: Evil twin attack

An evil twin attack creates a fraudulent access point mimicking a legitimate network to intercept client traffic and capture credentials.

Which technique involves an attacker injecting shellcode into a running process's memory by exploiting a buffer that resides on the heap rather than the stack?

Answer: Heap spray

Heap spray fills large portions of heap memory with NOP sleds and shellcode to increase the probability of hitting injected code during exploitation.

A penetration tester uses BloodHound to analyze Active Directory relationships. What primary attack path does BloodHound help identify?

Answer: Attack paths to Domain Admin via ACL abuse and group memberships

BloodHound maps Active Directory relationships and identifies attack paths to privileged accounts through misconfigurations, ACLs, and group memberships.