PenTest+ Attacks & Exploits 2 — Questions and Answers
Question 1: A penetration tester uses a script to send thousands of login attempts against a web application using a list of common username/password pairs. Which attack technique is being performed?
- Password spraying
- Credential stuffing (Correct answer)
- Brute force
- Rainbow table attack
Correct answer: Credential stuffing
Credential stuffing uses previously breached username/password pairs to attempt logins across multiple services.
Question 2: During a pentest, a tester discovers that a web application reflects user-supplied input in error messages without sanitization. Which vulnerability class does this represent?
- SQL injection
- Reflected XSS (Correct answer)
- CSRF
- Path traversal
Correct answer: Reflected XSS
Reflected XSS occurs when user-supplied input is immediately returned by the server in a response without proper sanitization.
Question 3: A tester intercepts a JWT token and modifies the algorithm field from RS256 to none, then submits it without a signature. What vulnerability is being exploited?
- Token replay attack
- Algorithm confusion attack
- JWT none algorithm vulnerability (Correct answer)
- Signature forgery
Correct answer: JWT none algorithm vulnerability
The JWT 'none' algorithm vulnerability allows an attacker to remove the signature when the server accepts unsigned tokens with alg=none.
Question 4: An attacker sends an email appearing to come from an executive asking an employee to wire funds immediately. Which social engineering technique is this?
- Vishing
- Whaling
- Spear phishing
- Business Email Compromise (BEC) (Correct answer)
Correct answer: Business Email Compromise (BEC)
Business Email Compromise (BEC) involves impersonating executives or vendors to trick employees into transferring money or sensitive data.
Question 5: A tester gains code execution via a deserialization flaw in a Java application. Which tool is most commonly used to generate Java deserialization payloads?
- Metasploit
- ysoserial (Correct answer)
- SQLmap
- Burp Suite
Correct answer: ysoserial
ysoserial is the standard tool for generating Java deserialization exploit payloads targeting various Java libraries.
Question 6: During an assessment, a tester finds a Linux SUID binary that calls system() with a relative path. Which privilege escalation technique applies?
- DLL hijacking
- PATH variable hijacking (Correct answer)
- LD_PRELOAD injection
- Kernel exploit
Correct answer: PATH variable hijacking
PATH variable hijacking exploits SUID binaries that call system commands using relative paths by placing a malicious binary earlier in the PATH.
Question 7: A penetration tester uses Responder to capture NTLMv2 hashes on a network. What type of attack does Responder perform to collect these hashes?
- Pass-the-hash
- LLMNR/NBT-NS poisoning (Correct answer)
- Kerberoasting
- AS-REP roasting
Correct answer: LLMNR/NBT-NS poisoning
Responder performs LLMNR and NBT-NS poisoning to intercept name resolution requests and capture NTLMv2 authentication hashes.
PenTest+ Attacks & Exploits 2
A penetration tester uses a script to send thousands of login attempts against a web application using a list of common username/password pairs.
Which attack technique is being performed?