PenTest+ PenTest+ Post-Exploitation & Pivoting 2 — Questions and Answers
Question 1: What is 'pivoting' in the context of penetration testing?
- Switching the attack tool mid-engagement
- Using a compromised host as a relay to reach other network segments (Correct answer)
- Rotating encryption keys on captured data
- Alternating between different user accounts
Correct answer: Using a compromised host as a relay to reach other network segments
Pivoting uses a compromised host as a relay to route traffic through it and reach otherwise inaccessible internal network segments.
Question 2: Which Metasploit post-exploitation module is used to add routes through a Meterpreter session for pivoting?
- auxiliary/scanner/portscan/tcp
- post/multi/manage/autoroute (Correct answer)
- exploit/multi/handler
- auxiliary/gather/enum_dns
Correct answer: post/multi/manage/autoroute
The autoroute post module adds network routes through an active Meterpreter session, enabling traffic to be proxied through the compromised host.
Question 3: How is SSH port forwarding used for pivoting during a penetration test?
- To brute-force SSH credentials on internal hosts
- To forward traffic through an SSH connection and reach internal hosts not directly accessible (Correct answer)
- To bypass SSL certificate validation on internal servers
- To encrypt all captured network traffic
Correct answer: To forward traffic through an SSH connection and reach internal hosts not directly accessible
SSH local (-L) and remote (-R) port forwarding tunnels traffic through an SSH connection, allowing access to internal services behind firewalls.
Question 4: Which Metasploit auxiliary module creates a SOCKS proxy through an active Meterpreter session?
- auxiliary/server/capture/http
- auxiliary/server/socks_proxy (Correct answer)
- post/windows/gather/credentials
- auxiliary/scanner/http/dir_scanner
Correct answer: auxiliary/server/socks_proxy
The socks_proxy auxiliary module creates a local SOCKS listener that routes all traffic through the Meterpreter session for seamless pivoting.
Question 5: What is 'double pivoting' in penetration testing?
- Exploiting two different vulnerabilities on one host simultaneously
- Chaining two compromised hosts to reach a third, deeper network segment (Correct answer)
- Using two Metasploit sessions on the same target
- Running two reverse shells in parallel for redundancy
Correct answer: Chaining two compromised hosts to reach a third, deeper network segment
Double pivoting chains two compromised hosts sequentially, routing traffic through the first pivot to reach the second, which then provides access to an even deeper network.
Question 6: Why is DNS tunneling commonly used for data exfiltration during penetration tests?
- DNS traffic is encrypted by default
- DNS queries are rarely blocked by firewalls and can carry encoded data on port 53 (Correct answer)
- DNS responses are too small to inspect
- DNS tunneling is undetectable by all IDS systems
Correct answer: DNS queries are rarely blocked by firewalls and can carry encoded data on port 53
DNS tunneling encodes data within DNS queries and responses, exploiting the fact that port 53 UDP/TCP is almost universally allowed through firewalls.
PenTest+ PenTest+ Post-Exploitation & Pivoting 2
What is 'pivoting' in the context of penetration testing?