Information Gathering & Vulnerability Identification Flashcards

A penetration tester discovers that a web application uses predictable session token values (e.g., sequential integers). Which vulnerability category does this represent?

Answer: Broken authentication due to weak session management

Predictable session tokens fall under broken authentication — weak session management allows attackers to guess or forge valid session identifiers.

When performing passive DNS reconnaissance, which resource provides historical DNS records including past IP addresses associated with a domain?

Answer: Passive DNS databases (e.g., RiskIQ, SecurityTrails)

Passive DNS databases aggregate historical DNS resolution data, allowing testers to find past IP addresses and infrastructure changes for a domain.

During a network scan, a tester finds ports 135, 139, and 445 open on multiple hosts. What does this combination MOST likely indicate?

Answer: Windows systems with SMB and RPC services

Ports 135 (RPC), 139 (NetBIOS), and 445 (SMB) are characteristic Windows networking ports used for file sharing and remote procedure calls.

A tester reviews SSL/TLS certificate information for a target and discovers Subject Alternative Names (SANs) listing additional domains. Why is this significant for reconnaissance?

Answer: SANs can expose additional subdomains and related domains in scope

SAN entries in SSL certificates often list multiple hostnames and subdomains, providing valuable reconnaissance data about the organization's infrastructure.

Which phase of the penetration testing process involves documenting discovered vulnerabilities, their potential impact, and remediation recommendations?

Answer: Reporting

The reporting phase documents all findings including vulnerability details, evidence, business impact, and prioritized remediation guidance for the client.

A tester uses Masscan to perform rapid port scanning across a large IP range. What is the PRIMARY risk of using Masscan at high packet rates during a pentest?

Answer: High packet rates may trigger IDS/IPS alerts or disrupt network devices

Masscan's extremely high packet rates can overwhelm network devices, trigger intrusion detection systems, and potentially disrupt services on the target network.

What does the term 'attack surface' refer to in the context of vulnerability identification during a penetration test?

Answer: All the different points where an attacker could attempt to enter or extract data

The attack surface encompasses all potential entry points, interfaces, protocols, and data paths through which an attacker could attempt to compromise the target.