PenTest+ Attacks & Exploits 4 — Questions and Answers
Question 1: A tester discovers a web application that generates PDF files by passing user input to a headless browser. The tester injects an iframe pointing to an internal IP. What vulnerability is this?
- XSS via PDF
- Server-Side Request Forgery (SSRF) (Correct answer)
- HTML injection
- Open redirect
Correct answer: Server-Side Request Forgery (SSRF)
SSRF via PDF generation occurs when user-controlled HTML/URLs are processed server-side, allowing attackers to reach internal network resources.
Question 2: An attacker exploits a race condition between a privilege check and file operation in a SUID program. What classic vulnerability type does this represent?
- Use-after-free
- Time-of-check to time-of-use (TOCTOU) (Correct answer)
- Integer overflow
- Double free
Correct answer: Time-of-check to time-of-use (TOCTOU)
TOCTOU (Time-of-Check to Time-of-Use) exploits the window between a security check and the subsequent use of the checked resource.
Question 3: During a red team engagement, an operator uses Cobalt Strike's sleep command combined with jitter. What is the primary purpose of this technique?
- Increase beacon speed
- Evade network-based anomaly detection (Correct answer)
- Encrypt C2 traffic
- Bypass endpoint AV scanning
Correct answer: Evade network-based anomaly detection
Sleep with jitter adds randomized delays to beacon check-ins, making traffic patterns irregular and harder to detect via network behavioral analysis.
Question 4: A tester finds a stored XSS vulnerability in an admin panel's user comment field. An attacker submits a payload that creates a new admin account when an admin views the comment. This is an example of:
- Reflected XSS exploitation
- XSS-driven CSRF attack (Correct answer)
- DOM-based XSS
- Clickjacking
Correct answer: XSS-driven CSRF attack
Combining stored XSS with CSRF allows the attacker's script to perform authenticated actions on behalf of the admin victim viewing the malicious comment.
Question 5: Which technique allows an attacker to move laterally using a compromised account's NTLM hash without cracking it to plaintext?
- Overpass-the-hash
- Pass-the-hash (Correct answer)
- Silver ticket attack
- Kerberoasting
Correct answer: Pass-the-hash
Pass-the-hash uses a captured NTLM hash directly for authentication against SMB, WMI, or other NTLM-supporting services without needing the plaintext password.
Question 6: A tester identifies a PostgreSQL database and injects a COPY TO/FROM PROGRAM statement. What capability does this provide?
- Database schema extraction
- OS command execution via the database (Correct answer)
- Blind SQL data exfiltration
- Privilege escalation within the database
Correct answer: OS command execution via the database
PostgreSQL's COPY TO/FROM PROGRAM allows superusers to execute OS commands by passing shell commands to the PROGRAM keyword.
Question 7: During wireless testing, a tester captures a 4-way WPA2 handshake and runs it through hashcat with a wordlist. What is being attacked?
- The WPA2 TKIP encryption key
- The Pre-Shared Key (PSK) via offline dictionary attack (Correct answer)
- The PMK directly
- The PMKID without client association
Correct answer: The Pre-Shared Key (PSK) via offline dictionary attack
Capturing a WPA2 4-way handshake enables an offline dictionary attack against the PSK, since the handshake contains data derived from the password.
PenTest+ Attacks & Exploits 4
A tester discovers a web application that generates PDF files by passing user input to a headless browser.
The tester injects an iframe pointing to an internal IP.
What vulnerability is this?