PT0-003 Reviews Questions

1. Reflected XSS - Input sanitization (<> ...)

2. Sql Injection Stacked - Parameterized Queries

3. DOM XSS - Input Sanitization (<> ...)

4. Local File Inclusion - sandbox req

5. Command Injection - sandbox req

6. SQLi union - paramtrized queries

7. SQLi error - paramtrized queries

8. Remote File Inclusion - sandbox

9. Command Injection - input saniti $

10. URL redirect - prevent external calls

When a penetration tester has limited command-line access on a Windows system, the choice of tool is critical for gathering information to aid in furthering the test. Here’s an explanation for each option:

mmc.exe (Microsoft Management Console):

Primarily used for managing Windows and its services. It’s not typically useful for gathering information about the system from the command line in a limited access scenario.

icacls.exe:

This tool is used for modifying file and folder permissions. While useful for modifying security settings, it does not directly aid in gathering system information or enumeration.

nltest.exe:

This is a powerful command-line utility for network testing and gathering information about domain controllers, trusts, and replication status. Key functionalities include:

Listing domain controllers: nltest /dclist:

Querying domain trusts: nltest /domain_trusts

Checking secure channel: nltest /sc_query:

These capabilities make nltest very useful for understanding the network environment, especially in a domain context, which is essential for penetration testing.

rundll.exe:

This utility is used to run DLLs as programs. While it can be used for executing code, it does not provide direct information about the system or network environment.

Conclusion: nltest.exe is the best choice among the given options as it provides valuable information about the network, domain controllers, and trust relationships. This information is crucial for a penetration tester to plan further actions and understand the domain environment.

=================

When developing a phishing campaign, the tester should first use social media to gather information about the targets.

Explanation:

Social Media:

Purpose: Social media platforms like LinkedIn, Facebook, and Twitter provide valuable information about individuals, including their job roles, contact details, interests, and connections.

Reconnaissance: This information helps craft convincing and targeted phishing emails, increasing the likelihood of success.

Process:

Gathering Information: Collect details about the target employees, such as their names, job titles, email addresses, and any personal information that can make the phishing email more credible.

Crafting Phishing Emails: Use the gathered information to personalize phishing emails, making them appear legitimate and relevant to the recipients.

Other Options:

Shoulder Surfing: Observing someone’s screen or keyboard input to gain information, not suitable for gathering broad information for a phishing campaign.

Recon-ng: A tool for automated reconnaissance, useful but more general. Social media is specifically targeted for gathering personal information.

Password Dumps: Using previously leaked passwords to find potential targets is more invasive and less relevant to the initial stage of developing a phishing campaign.

Pentest References:

Spear Phishing: A targeted phishing attack aimed at specific individuals, using personal information to increase the credibility of the email.

OSINT (Open Source Intelligence): Leveraging publicly available information to gather intelligence on targets, including through social media.

By starting with social media, the penetration tester can collect detailed and personalized information about the targets, which is essential for creating an effective spear phishing campaign.

=================

The tool and command provided by option B are used to perform passive DNS enumeration, which can uncover subdomains associated with a domain. Here’s why option B is correct:

amass enum -passive -d comptia.org: This command uses the Amass tool to perform passive DNS enumeration, effectively identifying subdomains of the target domain. The output provided (subdomains) matches what this tool and command would produce.

nslookup -type=SOA comptia.org: This command retrieves the Start of Authority (SOA) record, which does not list subdomains.

nmap -Pn -sV -vv -A comptia.org: This Nmap command performs service detection and aggressive scanning but does not enumerate subdomains.

shodan host comptia.org: Shodan is an internet search engine for connected devices, but it does not perform DNS enumeration to list subdomains.

References from Pentest:

Writeup HTB: Demonstrates the use of DNS enumeration tools like Amass to uncover subdomains during external assessments​​.

Horizontall HTB: Highlights the effectiveness of passive DNS enumeration in identifying subdomains and associated information​​.

=================