A penetration tester was able to gather MD5 hashes from a server and crack the hashes easily with rainbow tables. Which of the following should be included as a recommendation in the remediation report?
Correct Answer: A
Question 62
Deconfliction is necessary when the penetration test:
Correct Answer: C
This will then enable the PenTest to continue so that additional issues can be found, exploited, and analyzed.
Question 63
A consultant starts a network penetration test. The consultant uses a laptop that is hardwired to the network to try to assess the network with the appropriate tools. Which of the following should the consultant engage first?
Correct Answer: C
In network penetration testing, the initial steps involve gathering information to build an understanding of the network's structure, devices, and potential entry points. The process generally follows a structured approach, starting from broad discovery methods to more specific identification techniques. Here's a comprehensive breakdown of the steps: Host Discovery (answer: C): Objective: Identify live hosts on the network. Tools & Techniques: Ping Sweep: Using tools like nmap with the -sn option (ping scan) to check for live hosts by sending ICMP Echo requests. ARP Scan: Useful in local networks, arp-scan can help identify all devices on the local subnet by broadcasting ARP requests. nmap -sn 192.168.1.0/24 * Reference: The GoBox HTB write-up emphasizes the importance of identifying hosts before moving to service enumeration. The Forge HTB write-up also highlights using Nmap for initial host discovery in its enumeration phase. * Service Discovery (Option A): Objective: After identifying live hosts, determine the services running on them. Tools & Techniques: Nmap: Often used with options like -sV for version detection to identify services. nmap -sV 192.168.1.100 * Reference: As seen in multiple write-ups (e.g., Anubis HTB and Bolt HTB), service discovery follows host identification to understand the services available for potential exploitation. * OS Fingerprinting (Option B): Objective: Determine the operating system of the identified hosts. Tools & Techniques: Nmap: With the -O option for OS detection. nmap -O 192.168.1.100 * Reference: Accurate OS fingerprinting helps tailor subsequent attacks and is often performed after host and service discovery, as highlighted in the write-ups. * DNS Enumeration (Option D): Objective: Identify DNS records and gather subdomains related to the target domain. Tools & Techniques: dnsenum, dnsrecon, and dig. dnsenum example.com Reference: DNS enumeration is crucial for identifying additional attack surfaces, such as subdomains and related services. This step is typically part of the reconnaissance phase but follows host discovery and sometimes service identification. Conclusion: The initial engagement in a network penetration test is to identify the live hosts on the network (Host Discovery). This foundational step allows the penetration tester to map out active devices before delving into more specific enumeration tasks like service discovery, OS fingerprinting, and DNS enumeration. This structured approach ensures that the tester maximizes their understanding of the network environment efficiently and systematically.
Question 64
Which of the following is the BEST resource for obtaining payloads against specific network infrastructure products?
Correct Answer: A
"Exploit Database (ExploitDB) is a repository of exploits for the purpose of public security, and it explains what can be found on the database. The ExploitDB is a very useful resource for identifying possible weaknesses in your network and for staying up to date on current attacks occurring in other networks" Exploit-DB is a website that collects and archives exploits for various software and hardware products, including network infrastructure devices. Exploit-DB allows users to search for exploits by product name, vendor, type, platform, CVE number, or date. Exploit-DB is a useful resource for obtaining payloads against specific network infrastructure products. Metasploit is a framework that contains many exploits and payloads, but it is not a resource for obtaining them. Shodan is a search engine that scans the internet for devices and services, but it does not provide exploits or payloads. Retina is a vulnerability scanner that identifies weaknesses in network devices, but it does not provide exploits or payloads.
Question 65
A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host. Which of the following is an active reconnaissance tool that would be BEST to use to accomplish this task?
