PenTest+ Attacks & Exploits 3 — Questions and Answers
Question 1: A tester discovers a web server running PHP with the allow_url_include directive enabled. An attacker supplies a remote URL as a file parameter. What attack is possible?
- Local File Inclusion (LFI)
- Remote File Inclusion (RFI) (Correct answer)
- Server-Side Request Forgery (SSRF)
- XML External Entity (XXE)
Correct answer: Remote File Inclusion (RFI)
Remote File Inclusion (RFI) allows attackers to include and execute remote files when the server fetches and processes URLs passed as parameters.
Question 2: An attacker on a switched network sends gratuitous ARP replies mapping the default gateway's IP to their own MAC address. What is the goal?
- DNS spoofing
- ARP cache poisoning for MitM (Correct answer)
- MAC flooding
- VLAN hopping
Correct answer: ARP cache poisoning for MitM
ARP cache poisoning redirects network traffic through the attacker's machine by associating the gateway's IP with the attacker's MAC address.
Question 3: During a Windows pentest, a tester extracts the NTDS.dit file from a domain controller. What is the purpose of obtaining this file?
- To read cached Group Policy settings
- To extract all domain password hashes (Correct answer)
- To enumerate Active Directory OUs
- To obtain Kerberos service tickets
Correct answer: To extract all domain password hashes
NTDS.dit is the Active Directory database that stores all domain user account password hashes, making it a primary credential harvesting target.
Question 4: A tester submits XML input containing a DOCTYPE declaration that references an external entity pointing to /etc/passwd. Which vulnerability is being tested?
- SSRF
- XXE injection (Correct answer)
- XPath injection
- SSTI
Correct answer: XXE injection
XXE (XML External Entity) injection exploits XML parsers that process external entity references, potentially exposing local files or internal services.
Question 5: A tester sets up a rogue Wi-Fi access point with the same SSID as a corporate network to capture client credentials. What is this attack called?
- Deauthentication attack
- Evil twin attack (Correct answer)
- Karma attack
- WPA handshake capture
Correct answer: Evil twin attack
An evil twin attack creates a fraudulent access point mimicking a legitimate network to intercept client traffic and capture credentials.
Question 6: Which technique involves an attacker injecting shellcode into a running process's memory by exploiting a buffer that resides on the heap rather than the stack?
- Stack-based buffer overflow
- Heap spray (Correct answer)
- Return-oriented programming
- Format string attack
Correct answer: Heap spray
Heap spray fills large portions of heap memory with NOP sleds and shellcode to increase the probability of hitting injected code during exploitation.
Question 7: A penetration tester uses BloodHound to analyze Active Directory relationships. What primary attack path does BloodHound help identify?
- Pass-the-ticket vulnerabilities
- Attack paths to Domain Admin via ACL abuse and group memberships (Correct answer)
- Weak Kerberos encryption types
- Unpatched domain controller CVEs
Correct answer: Attack paths to Domain Admin via ACL abuse and group memberships
BloodHound maps Active Directory relationships and identifies attack paths to privileged accounts through misconfigurations, ACLs, and group memberships.
PenTest+ Attacks & Exploits 3
A tester discovers a web server running PHP with the allow_url_include directive enabled.
An attacker supplies a remote URL as a file parameter.
What attack is possible?