PenTest+ Attacks & Exploits 3

Question 1

A tester discovers a web server running PHP with the allow_url_include directive enabled. An attacker supplies a remote URL as a file parameter. What attack is possible?

Accepted Answer

Remote File Inclusion (RFI)

Answer

Remote File Inclusion (RFI) allows attackers to include and execute remote files when the server fetches and processes URLs passed as parameters.

Question 2

An attacker on a switched network sends gratuitous ARP replies mapping the default gateway's IP to their own MAC address. What is the goal?

Accepted Answer

ARP cache poisoning for MitM

Answer

ARP cache poisoning redirects network traffic through the attacker's machine by associating the gateway's IP with the attacker's MAC address.

Question 3

During a Windows pentest, a tester extracts the NTDS.dit file from a domain controller. What is the purpose of obtaining this file?

Accepted Answer

To extract all domain password hashes

Answer

NTDS.dit is the Active Directory database that stores all domain user account password hashes, making it a primary credential harvesting target.

Question 4

A tester submits XML input containing a DOCTYPE declaration that references an external entity pointing to /etc/passwd. Which vulnerability is being tested?

Accepted Answer

XXE injection

Answer

XXE (XML External Entity) injection exploits XML parsers that process external entity references, potentially exposing local files or internal services.

Question 5

A tester sets up a rogue Wi-Fi access point with the same SSID as a corporate network to capture client credentials. What is this attack called?

Accepted Answer

Evil twin attack

Answer

An evil twin attack creates a fraudulent access point mimicking a legitimate network to intercept client traffic and capture credentials.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Attacks & Exploits 3