Attacks & Exploits Flashcards

A tester discovers a web application that generates PDF files by passing user input to a headless browser. The tester injects an iframe pointing to an internal IP. What vulnerability is this?

Answer: Server-Side Request Forgery (SSRF)

SSRF via PDF generation occurs when user-controlled HTML/URLs are processed server-side, allowing attackers to reach internal network resources.

An attacker exploits a race condition between a privilege check and file operation in a SUID program. What classic vulnerability type does this represent?

Answer: Time-of-check to time-of-use (TOCTOU)

TOCTOU (Time-of-Check to Time-of-Use) exploits the window between a security check and the subsequent use of the checked resource.

During a red team engagement, an operator uses Cobalt Strike's sleep command combined with jitter. What is the primary purpose of this technique?

Answer: Evade network-based anomaly detection

Sleep with jitter adds randomized delays to beacon check-ins, making traffic patterns irregular and harder to detect via network behavioral analysis.

A tester finds a stored XSS vulnerability in an admin panel's user comment field. An attacker submits a payload that creates a new admin account when an admin views the comment. This is an example of:

Answer: XSS-driven CSRF attack

Combining stored XSS with CSRF allows the attacker's script to perform authenticated actions on behalf of the admin victim viewing the malicious comment.

Which technique allows an attacker to move laterally using a compromised account's NTLM hash without cracking it to plaintext?

Answer: Pass-the-hash

Pass-the-hash uses a captured NTLM hash directly for authentication against SMB, WMI, or other NTLM-supporting services without needing the plaintext password.

A tester identifies a PostgreSQL database and injects a COPY TO/FROM PROGRAM statement. What capability does this provide?

Answer: OS command execution via the database

PostgreSQL's COPY TO/FROM PROGRAM allows superusers to execute OS commands by passing shell commands to the PROGRAM keyword.

During wireless testing, a tester captures a 4-way WPA2 handshake and runs it through hashcat with a wordlist. What is being attacked?

Answer: The Pre-Shared Key (PSK) via offline dictionary attack

Capturing a WPA2 4-way handshake enables an offline dictionary attack against the PSK, since the handshake contains data derived from the password.