PenTest+ Attacks & Exploits 2

Question 1

A penetration tester uses a script to send thousands of login attempts against a web application using a list of common username/password pairs. Which attack technique is being performed?

Accepted Answer

Credential stuffing

Answer

Credential stuffing uses previously breached username/password pairs to attempt logins across multiple services.

Question 2

During a pentest, a tester discovers that a web application reflects user-supplied input in error messages without sanitization. Which vulnerability class does this represent?

Accepted Answer

Reflected XSS

Answer

Reflected XSS occurs when user-supplied input is immediately returned by the server in a response without proper sanitization.

Question 3

A tester intercepts a JWT token and modifies the algorithm field from RS256 to none, then submits it without a signature. What vulnerability is being exploited?

Accepted Answer

JWT none algorithm vulnerability

Answer

The JWT 'none' algorithm vulnerability allows an attacker to remove the signature when the server accepts unsigned tokens with alg=none.

Question 4

An attacker sends an email appearing to come from an executive asking an employee to wire funds immediately. Which social engineering technique is this?

Accepted Answer

Business Email Compromise (BEC)

Answer

Business Email Compromise (BEC) involves impersonating executives or vendors to trick employees into transferring money or sensitive data.

Question 5

A tester gains code execution via a deserialization flaw in a Java application. Which tool is most commonly used to generate Java deserialization payloads?

Accepted Answer

ysoserial

Answer

ysoserial is the standard tool for generating Java deserialization exploit payloads targeting various Java libraries.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Attacks & Exploits 2