PenTest+ Post-Exploitation & Pivoting Flashcards

What is 'pivoting' in the context of penetration testing?

Answer: Using a compromised host as a relay to reach other network segments

Pivoting uses a compromised host as a relay to route traffic through it and reach otherwise inaccessible internal network segments.

Which Metasploit post-exploitation module is used to add routes through a Meterpreter session for pivoting?

Answer: post/multi/manage/autoroute

The autoroute post module adds network routes through an active Meterpreter session, enabling traffic to be proxied through the compromised host.

How is SSH port forwarding used for pivoting during a penetration test?

Answer: To forward traffic through an SSH connection and reach internal hosts not directly accessible

SSH local (-L) and remote (-R) port forwarding tunnels traffic through an SSH connection, allowing access to internal services behind firewalls.

Which Metasploit auxiliary module creates a SOCKS proxy through an active Meterpreter session?

Answer: auxiliary/server/socks_proxy

The socks_proxy auxiliary module creates a local SOCKS listener that routes all traffic through the Meterpreter session for seamless pivoting.

What is 'double pivoting' in penetration testing?

Answer: Chaining two compromised hosts to reach a third, deeper network segment

Double pivoting chains two compromised hosts sequentially, routing traffic through the first pivot to reach the second, which then provides access to an even deeper network.

Why is DNS tunneling commonly used for data exfiltration during penetration tests?

Answer: DNS queries are rarely blocked by firewalls and can carry encoded data on port 53

DNS tunneling encodes data within DNS queries and responses, exploiting the fact that port 53 UDP/TCP is almost universally allowed through firewalls.