Attacks & Exploits Flashcards

A penetration tester abuses GenericWrite permissions on an Active Directory user account to set a Service Principal Name (SPN) and then request a TGS ticket. What attack is this?

Answer: Kerberoasting via targeted SPN setting

Targeted Kerberoasting involves using GenericWrite or similar permissions to set an SPN on a target account, then requesting and cracking the resulting TGS ticket.

An attacker sends crafted ICMP packets with a source IP of the victim's address to a large number of hosts that reply to the victim. What DoS technique is this?

Answer: Smurf attack

A Smurf attack sends ICMP echo requests with a spoofed source IP to broadcast addresses, causing all hosts to reply to the victim and overwhelming it.

A tester uploads a file named 'shell.php%00.jpg' to bypass a file extension whitelist. What technique is being used?

Answer: Null byte injection

Null byte injection (%00) terminates string processing in older PHP versions or C-based functions, causing the server to treat the filename as 'shell.php' and ignore '.jpg'.

During a cloud pentest on AWS, a tester queries 169.254.169.254 from a compromised EC2 instance. What is the tester attempting to retrieve?

Answer: IAM instance profile credentials

The AWS Instance Metadata Service (IMDS) at 169.254.169.254 exposes IAM role credentials attached to the EC2 instance, which can be used for privilege escalation.

A tester exploits a web application by injecting template syntax like {{7*7}} into a user-supplied input field and receives '49' in the response. What vulnerability was discovered?

Answer: Server-Side Template Injection (SSTI)

Server-Side Template Injection (SSTI) occurs when user input is embedded in a server-side template, allowing code execution within the template engine's context.

A red team operator uses a signed binary (living off the land) to download and execute a payload, evading application whitelisting. Which category of technique does this represent?

Answer: LOLBin (Living Off the Land Binary) abuse

LOLBin abuse leverages trusted, pre-installed system binaries like certutil, mshta, or regsvr32 to execute malicious code while evading whitelisting controls.

A tester discovers that a web application constructs an OS command using unsanitized user input and executes it via shell_exec(). The tester appends '; cat /etc/passwd' to the input. What is this attack?

Answer: OS command injection

OS command injection occurs when unsanitized user input is passed to a shell command, allowing attackers to append additional commands using shell metacharacters.