Jr Penetration Tester

Q1 Easy 10 pts

The FIRST phase of a penetration test is:

Exploitation Reconnaissance Reporting Privilege escalation

Q2 Easy 10 pts

Which tool is primarily a network port scanner?

Wireshark Nmap John the Ripper Hydra

Q3 Medium 15 pts

`nmap -sV` performs:

Ping sweep only Service & version detection Exploitation A UDP-only scan

Q4 Medium 15 pts

A stealthy TCP scan that never completes the handshake is the SYN or '____' scan (nmap -sS).

Q5 Medium 15 pts

Which is a PASSIVE recon technique?

Full nmap scan of the target WHOIS/OSINT lookups that don't touch the target Brute-forcing a login Sending exploits

Q6 Medium 20 pts

On Linux you find privilege-escalation binaries with `find / -perm -4000`; that bit is the ____ bit.

Q7 Medium 15 pts

`sudo -l` is run during Linux enumeration to:

List users Show what commands the current user may run via sudo Delete logs Restart the box

Q8 Medium 15 pts

Which tool cracks password hashes offline?

Nmap Hashcat Gobuster Netcat

Q9 Medium 15 pts

Hydra is used for:

Disk encryption Online brute-force of login services (SSH, FTP, HTTP) Packet capture Compiling exploits

Q10 Medium 15 pts

Gobuster/dirb/ffuf are used to:

Crack Wi-Fi Brute-force directories/files (and vhosts) on a web server Scan ports Sniff traffic

Q11 Easy 10 pts

Netcat is often nicknamed the:

'Swiss Army knife' of networking (connections, shells, transfers) GPU cracker Web proxy Antivirus

Q12 Medium 20 pts

A REVERSE shell means the:

Attacker's box listens; the victim connects back out Victim listens; attacker connects in Shell reverses text Server reboots

Q13 Medium 20 pts

A BIND shell means the:

Victim opens a listening port the attacker connects to Attacker listens and victim connects out Shell binds two files DNS is bound

Q14 Medium 15 pts

Metasploit's `msfconsole` is used to:

Edit photos Search, configure and launch exploits/payloads Scan Wi-Fi only Manage DNS

Q15 Medium 15 pts

`searchsploit` queries:

Live web servers A local copy of Exploit-DB for known exploits DNS records The Windows registry

Q16 Medium 20 pts

LinPEAS/WinPEAS are used to:

Encrypt disks Enumerate a host automatically for privilege-escalation paths Scan networks Crack hashes

Q17 Easy 10 pts

An anonymous FTP login uses the username:

root anonymous admin guest123

Q18 Easy 10 pts

Default credentials are dangerous because:

They're encrypted Unchanged vendor defaults grant easy unauthorized access They rotate automatically They're random

Q19 Hard 20 pts

`enum4linux` enumerates information from:

Wi-Fi APs SMB/Windows shares, users and shares via SMB/NetBIOS DNS zones TLS certs

Q20 Medium 15 pts

Nikto is a:

Port scanner Web server vulnerability scanner Password cracker Packet sniffer

Q21 Medium 15 pts

Maintaining access to a compromised host across reboots is establishing ____ .

Q22 Hard 20 pts

`proxychains` is used to:

Encrypt disks Route tools through a proxy/pivot to reach internal networks Crack Wi-Fi Scan ports faster

Q23 Medium 20 pts

Pivoting in a pentest means:

Rotating a chair Using a compromised host as a gateway to reach other networks Changing exploits Restarting a scan

Q24 Medium 15 pts

`nmap -p-` scans:

Only port 80 All 65535 TCP ports UDP only The top 100 ports

Q25 Medium 15 pts

`nmap -sC` runs:

A custom scan The default set of NSE scripts A UDP scan OS detection only

Q26 Medium 15 pts

`nmap -O` attempts:

Output to file OS fingerprinting/detection Only open ports An offline scan

Q27 Medium 15 pts

Banner grabbing reveals:

The victim's password Service/version info from a service's response banner The MAC address only The kernel source

Q28 Hard 20 pts

A Windows 'unquoted service path' can be abused for:

Faster boot Privilege escalation by planting a malicious executable Better graphics Disk cleanup

Q29 Medium 15 pts

Cracking speed for hashes is greatly increased by:

More RAM only GPU acceleration (e.g. hashcat) A faster monitor More disk space

Q30 Easy 10 pts

A wordlist commonly used for cracking is:

rockyou.txt kernel.img passwd.exe hosts.deny

Q31 Medium 20 pts

'Password spraying' differs from brute force by:

Trying many passwords on one account Trying a few common passwords across many accounts (to avoid lockouts) Using only numbers Cracking offline

Q32 Hard 20 pts

An LFI vulnerability lets an attacker:

Ping the server Include/read local files on the server via user input Encrypt traffic Scan ports

Q33 Medium 20 pts

Command injection occurs when:

A user picks a color User input is passed unsanitized into an OS command TLS expires A cookie is set

Q34 Medium 15 pts

Burp Suite is primarily a:

Port scanner Intercepting web proxy for testing web apps Password vault Disk imager

Q35 Medium 15 pts

Shodan is useful for recon because it:

Cracks passwords Indexes internet-exposed devices and services Hosts exploits Encrypts data

Q36 Medium 15 pts

Subdomain enumeration expands the attack surface by finding:

Open ports only Additional hostnames (e.g. dev.site.com) that may be vulnerable User passwords Kernel versions

Q37 Easy 10 pts

`curl`/`wget` are handy on a victim to:

Encrypt the disk Download tools/payloads or interact with web services Crack hashes Sniff Wi-Fi

Q38 Hard 20 pts

A Linux 'cron job' misconfiguration can lead to privesc when:

It runs a writable script as root on a schedule It only prints the date It's disabled It runs as the same user

Q39 Hard 20 pts

Kernel exploits are used when:

The web app is patched A vulnerable OS kernel version allows local privilege escalation DNS is down The GPU is idle

Q40 Medium 15 pts

'Rules of Engagement' in a pentest define:

The lunch menu Scope, timing, allowed techniques and contacts The exploit code The GPU model

Q41 Easy 10 pts

Testing systems WITHOUT authorization is:

Best practice Illegal and unethical Required by RoE A passive scan

Q42 Medium 15 pts

A CVE identifier (e.g. CVE-2021-44228) is:

A password A unique reference for a publicly known vulnerability An IP address A hash

Q43 Medium 15 pts

SMB commonly runs on TCP port:

22 445 3306 53

Q44 Easy 10 pts

RDP (Windows remote desktop) uses port:

3389 80 21 161

Q45 Easy 10 pts

SSH default port is:

23 22 25 110

Q46 Medium 15 pts

After gaining access, documenting steps matters because:

It's optional The client needs a clear, reproducible report to fix issues It slows you down It hides findings

Q47 Medium 15 pts

Transferring a Linux privesc enumeration script to a target, you might use:

A Python http.server on your box + wget on target Only physical USB Fax Bluetooth pairing

Q48 Medium 15 pts

A 'vulnerability scan' differs from a pentest in that it:

Manually exploits everything Automatically identifies potential issues but doesn't fully exploit them Is always illegal Requires no tools

Q49 Hard 20 pts

Kerberos, used in Active Directory, primarily provides:

File compression Network authentication via tickets Packet routing Disk encryption

Q50 Easy 10 pts

The safest habit before exploiting is to:

Skip notes Confirm the target is in scope and authorized Attack anything reachable Disable logging