[Sep-2025] Dumps Practice Exam Questions Study Guide for the PT0-003 Exam
PT0-003 Dumps with Practice Exam Questions Answers
CompTIA PT0-003 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 137
A penetration tester conducted a vulnerability scan against a client's critical servers and found the following:
Which of the following would be a recommendation for remediation?
- A. Configure access controls on each of the servers
- B. Deploy a user training program
- C. Implement a patch management plan
- D. Utilize the secure software development life cycle
Answer: C
NEW QUESTION # 138
A penetration tester currently conducts phishing reconnaissance using various tools and accounts for multiple intelligence-gathering platforms. The tester wants to consolidate some of the tools and accounts into one solution to analyze the output from the intelligence-gathering tools. Which of the following is the best tool for the penetration tester to use?
- A. Maltego
- B. SpiderFoot
- C. WIGLE.net
- D. Caldera
Answer: A
Explanation:
Penetration testers use OSINT (Open-Source Intelligence) tools to collect and analyze reconnaissance data.
Maltego (Option C):
Maltego is a powerful graph-based OSINT tool that integrates data from multiple sources (e.g., social media, DNS records, leaked credentials).
It automates data correlation and helps visualize connections.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "OSINT and Intelligence Gathering" Incorrect options:
Option A (Caldera): Used for adversary emulation, not OSINT.
Option B (SpiderFoot): A reconnaissance tool but lacks data correlation capabilities.
Option D (WIGLE.net): A wireless network database, not an OSINT analysis tool.
NEW QUESTION # 139
Which of the following protocols would a penetration tester most likely utilize to exfiltrate data covertly and evade detection?
- A. SMTP
- B. HTTPS
- C. DNS
- D. FTP
Answer: C
Explanation:
Covert data exfiltration is a crucial aspect of advanced penetration testing. Penetration testers often need to move data out of a network without being detected by the organization's security monitoring tools. Here's a breakdown of the potential methods and why DNS is the preferred choice for covert data exfiltration:
* FTP (File Transfer Protocol) (Option A):
* Characteristics: FTP is a clear-text protocol used to transfer files.
* Drawbacks: It is easily detected by network security tools due to its lack of encryption and distinctive traffic patterns. Most modern networks block or heavily monitor FTP traffic to prevent unauthorized file transfers.
NEW QUESTION # 140
During a security audit, a penetration tester wants to run a process to gather information about a target network's domain structure and associated IP addresses. Which of the following tools should the tester use?
- A. Netcat
- B. Dnsenum
- C. Wireshark
- D. Nmap
Answer: B
Explanation:
Dnsenum is a tool specifically designed to gather information about DNS, including domain structure and associated IP addresses. Here's why option A is correct:
Dnsenum: This tool is used for DNS enumeration and can gather information about a domain's DNS records, subdomains, IP addresses, and other related information. It is highly effective for mapping out a target network's domain structure.
Nmap: While a versatile network scanning tool, Nmap is more focused on port scanning and service detection rather than detailed DNS enumeration.
Netcat: This is a network utility for reading and writing data across network connections, not for DNS enumeration.
Wireshark: This is a network protocol analyzer used for capturing and analyzing network traffic but not specifically for gathering DNS information.
Reference from Pentest:
Anubis HTB: Shows the importance of using DNS enumeration tools like Dnsenum to gather detailed information about the target's domain structure.
Forge HTB: Demonstrates the process of using specialized tools to collect DNS and IP information efficiently.
NEW QUESTION # 141
During a security assessment of a web application, a penetration tester was able to generate the following application response:
Unclosed quotation mark after the character string Incorrect syntax near ".
Which of the following is the most probable finding?
- A. Cross-site scripting
- B. SQL injection
- C. Business logic flaw
- D. Race condition
Answer: B
Explanation:
The error message "Unclosed quotation mark after the character string Incorrect syntax near '." suggests that the application is vulnerable to SQL Injection (A). This type of vulnerability occurs when an attacker is able to inject malicious SQL queries into an application's database query. The error message indicates that the application's input handling allows for the manipulation of the underlying SQL queries, which can lead to unauthorized data access, data modification, and other database-related attacks.
NEW QUESTION # 142
A tester is performing an external phishing assessment on the top executives at a company. Two-factor authentication is enabled on the executives' accounts that are in the scope of work. Which of the following should the tester do to get access to these accounts?
- A. Configure an external domain using a typosquatting technique. Configure SET to bypass two-factor authentication using a phishlet that mimics the mail portal for the company.
- B. Configure Gophish to use an external domain. Clone the email portal web page from the company and get the two-factor authentication code using a vishing method.
- C. Configure an external domain using a typosquatting technique. Configure Evilginx to bypass two-factor authentication using a phishlet that simulates the mail portal for the company.
- D. Configure Gophish to use an external domain. Clone the email portal web page from the company and get the two-factor authentication code using a brute-force attack method.
Answer: C
Explanation:
To bypass two-factor authentication (2FA) and gain access to the executives' accounts, the tester should use Evilginx with a typosquatting domain. Evilginx is a man-in-the-middle attack framework used to bypass 2FA by capturing session tokens.
Phishing with Evilginx:
Evilginx is designed to proxy legitimate login pages, capturing credentials and 2FA tokens in the process.
It uses "phishlets" which are configurations that simulate real login portals.
Typosquatting:
Typosquatting involves registering domains that are misspelled versions of legitimate domains (e.g., example.
co instead of example.com).
This technique tricks users into visiting the malicious domain, thinking it's legitimate.
Steps:
Configure an External Domain: Register a typosquatting domain similar to the company's domain.
Set Up Evilginx: Install and configure Evilginx on a server. Use a phishlet that mimics the company's mail portal.
Send Phishing Emails: Craft phishing emails targeting the executives, directing them to the typosquatting domain.
Capture Credentials and 2FA Tokens: When executives log in, Evilginx captures their credentials and session tokens, effectively bypassing 2FA.
Pentest References:
Phishing: Social engineering technique to deceive users into providing sensitive information.
Two-Factor Authentication Bypass: Advanced phishing attacks like those using Evilginx can capture and reuse session tokens, bypassing 2FA mechanisms.
OSINT and Reconnaissance: Identifying key targets (executives) and crafting convincing phishing emails based on gathered information.
Using Evilginx with a typosquatting domain allows the tester to bypass 2FA and gain access to high-value accounts, demonstrating the effectiveness of advanced phishing techniques.
NEW QUESTION # 143
A penetration tester attempts unauthorized entry to the company's server room as part of a security assessment. Which of the following is the best technique to manipulate the lock pins and open the door without the original key?
- A. Plug spinner
- B. Decoding
- C. Bypassing
- D. Raking
Answer: D
Explanation:
Raking is a lock-picking technique used to manipulate the pins of a lock using a rake tool. Here's how it works:
* Process:
* The rake tool is inserted into the lock, and quick, repeated movements are made to move the pins into the correct position.
* This technique is effective for many pin tumbler locks and is faster than single-pin picking.
* Comparison to Other Options:
* Plug Spinner: Used to reverse the direction of the lock cylinder after picking it. It is not used for the initial picking process.
* Bypassing: Involves circumventing the locking mechanism entirely (e.g., shim, carding). This is not the same as picking.
* Decoding: Used for combination locks and does not apply to pin tumbler locks.
CompTIA Pentest+ References:
* Domain 3.0 (Attacks and Exploits)
NEW QUESTION # 144
A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?
- A. crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null
- B. schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe
- C. sudo useradd -ou 0 -g 0 user
- D. wmic startup get caption,command
Answer: B
NEW QUESTION # 145
During an assessment, a penetration tester exploits an SQLi vulnerability. Which of the following commands would allow the penetration tester to enumerate password hashes?
- A. sqlmap -u www.example.com/?id=1 --schema --current-user --current-db
- B. sqlmap -u www.example.com/?id=1 --search -T user
- C. sqlmap -u www.example.com/?id=1 --dump -D accounts -T users -C cred
- D. sqlmap -u www.example.com/?id=1 --tables -D accounts
Answer: C
Explanation:
To enumerate password hashes using an SQL injection vulnerability, the penetration tester needs to extract specific columns from the database that typically contain password hashes. The --dump command in sqlmap is used to dump the contents of the specified database table. Here's a breakdown of the options:
Option A: sqlmap -u www.example.com/?id=1 --search -T user
The --search option is used to search for columns and not to dump data. This would not enumerate password hashes.
Option B: sqlmap -u www.example.com/?id=1 --dump -D accounts -T users -C cred This command uses --dump to extract data from the specified database accounts, table users, and column cred.
This is the correct option to enumerate password hashes, assuming cred is the column containing the password hashes.
Option C: sqlmap -u www.example.com/?id=1 --tables -D accounts
The --tables option lists all tables in the specified database but does not extract data.
Option D: sqlmap -u www.example.com/?id=1 --schema --current-user --current-db The --schema option provides the database schema information, and --current-user and --current-db provide information about the current user and database but do not dump data.
References from Pentest:
Writeup HTB: Demonstrates using sqlmap to dump data from specific tables to retrieve sensitive information, including password hashes.
Luke HTB: Shows the process of exploiting SQL injection to extract user credentials and hashes by dumping specific columns from the database.
NEW QUESTION # 146
A company hires a penetration tester to perform an external attack surface review as part of a security engagement. The company informs the tester that the main company domain to investigate is comptia.org.
Which of the following should the tester do to accomplish the assessment objective?
- A. Perform a vulnerability assessment over the main domain address provided by the client.
- B. Perform a physical security review to identify vulnerabilities that could affect the company.
- C. Perform a phishing assessment to try to gain access to more resources and users' computers.
- D. Perform information-gathering techniques to review internet-facing assets for the company.
Answer: D
Explanation:
An external attack surface review focuses on identifying publicly accessible assets that an attacker could exploit. The first step in this process is information gathering, which involves enumerating domains, subdomains, public IPs, DNS records, and other internet-facing resources. This is done using passive reconnaissance tools such as Whois, Shodan, Google Dorking, and OSINT techniques.
Option A is correct because it aligns with the assessment goal-finding public-facing systems and their vulnerabilities before an attacker does.
Option B (phishing assessment) is incorrect because it involves social engineering, which is not part of an external attack surface review.
Option C (physical security review) is incorrect as it pertains to physical penetration testing, not an external attack analysis.
Option D (vulnerability assessment) is incorrect because a vulnerability assessment is a later step after reconnaissance. The first step is identifying assets through information gathering.
Reference: CompTIA PenTest+ PT0-003 Official Guide - Chapter 4 (Information Gathering and OSINT).
NEW QUESTION # 147
During an assessment, a penetration tester inspected a log and found a series of thousands of requests coming from a single IP address to the same URL. A few of the requests are listed below.
Which of the following vulnerabilities was the attacker trying to exploit?
- A. ..Insecure direct object reference
- B. ..SQL injection
- C. ..Session hijacking
- D. ..URL manipulation
Answer: A
Explanation:
The attacker is sequentially changing the serviceID parameter in the URL, likely in an attempt to access objects that they are not authorized to see. This is indicative of an attempt to exploit an Insecure Direct Object Reference (IDOR) vulnerability, where unauthorized access to objects can occur by manipulating input or changing parameters in the URL.
An insecure direct object reference (IDOR) vulnerability occurs when an application exposes a reference to an internal object, such as a file, directory, database record, or key, without any proper authorization or validation mechanism. This allows an attacker to manipulate the reference and access other objects that they are not authorized to access. In this case, the attacker was trying to exploit the IDOR vulnerability in the servicestatus.php script, which accepts a serviceID parameter that directly references a service object. By changing the value of the serviceID parameter, the attacker could access different services that they were not supposed to see. References: The Official CompTIA PenTest+ Student Guide (Exam PT0-002) eBook, Chapter 4, Section 4.2.2: Insecure Direct Object References; Best PenTest+ certification study resources and training materials, Section 1: Cross-site Scripting (XSS) Attack.
NEW QUESTION # 148
A penetration tester gains access to a domain server and wants to enumerate the systems within the domain.
Which of the following tools would provide the best oversight of domains?
- A. Netcat
- B. Wireshark
- C. Responder
- D. Nmap
Answer: D
Explanation:
* Installation:
* Nmap can be installed on various operating systems. For example, on a Debian-based system:
sudo apt-get install nmap
* Basic Network Scanning:
* To scan a range of IP addresses in the network:
nmap -sP 192.168.1.0/24
* Service and Version Detection:
* To scan for open ports and detect the service versions running on a specific host:
nmap -sV 192.168.1.10
* Enumerating Domain Systems:
* Use Nmap with additional scripts to enumerate domain systems. For example, using the --script option:
nmap -p 445 --script=smb-enum-domains 192.168.1.10
* Advanced Scanning Options:
* Stealth Scan: Use the -sS option to perform a stealth scan:
nmap -sS 192.168.1.10
* Aggressive Scan: Use the -A option to enable OS detection, version detection, script scanning, and traceroute:
nmap -A 192.168.1.10
* Real-World Example:
* A penetration tester uses Nmap to enumerate the systems within a domain by scanning the network for live hosts and identifying the services running on each host. This information helps in identifying potential vulnerabilities and entry points for further exploitation.
* References from Pentesting Literature:
* In "Penetration Testing - A Hands-on Introduction to Hacking," Nmap is extensively discussed for various stages of the penetration testing process, from reconnaissance to vulnerability assessment.
* HTB write-ups often illustrate the use of Nmap for network enumeration and discovering potential attack vectors.
References:
* Penetration Testing - A Hands-on Introduction to Hacking
* HTB Official Writeups
NEW QUESTION # 149
During a pre-engagement activity with a new customer, a penetration tester looks for assets to test. Which of the following is an example of a target that can be used for testing?
- A. API
- B. HTTP
- C. IPA
- D. ICMP
Answer: A
Explanation:
API as a Target:
APIs (Application Programming Interfaces) are common assets to test for vulnerabilities such as improper authentication, data leakage, or injection attacks.
Testing APIs often uncovers critical issues in modern applications.
Why Not Other Options?
B (HTTP): This is a protocol, not a specific asset.
C (IPA): Unrelated to penetration testing (likely a typo or irrelevant here).
D (ICMP): This is a protocol used for network diagnostics, not an application asset.
CompTIA Pentest+ Reference:
Domain 1.0 (Planning and Scoping)
NEW QUESTION # 150
A tester runs an Nmap scan against a Windows server and receives the following results:
Nmap scan report for win_dns.local (10.0.0.5)
Host is up (0.014s latency)
Port State Service
53/tcp open domain
161/tcp open snmp
445/tcp open smb-ds
3389/tcp open rdp
Which of the following TCP ports should be prioritized for using hash-based relays?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Port 445 is used for SMB (Server Message Block) services, which are commonly targeted for hash-based relay attacks like NTLM relay attacks.
Step-by-Step Explanation
Understanding Hash-Based Relays:
NTLM Relay Attack: An attacker intercepts and relays NTLM authentication requests to another service, effectively performing authentication on behalf of the victim.
SMB Protocol: Port 445 is used for SMB/CIFS traffic, which supports NTLM authentication.
Prioritizing Port 445:
Vulnerability: SMB is often targeted because it frequently supports NTLM authentication, making it susceptible to relay attacks.
Tools: Tools like Responder and NTLMRelayX are commonly used to capture and relay NTLM hashes over SMB.
Execution:
Capture Hash: Use a tool like Responder to capture NTLM hashes.
Relay Hash: Use a tool like NTLMRelayX to relay the captured hash to another service on port 445.
Reference from Pentesting Literature:
Penetration testing guides frequently discuss targeting SMB (port 445) for hash-based relay attacks.
HTB write-ups often include examples of NTLM relay attacks using port 445.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
NEW QUESTION # 151
A penetration tester has found indicators that a privileged user's password might be the same on 30 different Linux systems. Which of the following tools can help the tester identify the number of systems on which the password can be used?
- A. Cain and Abel
- B. Hydra
- C. Medusa
- D. John the Ripper
Answer: C
Explanation:
Both Hydra and Medusa can be used for that same purpose:
THC Hydra is a brute-force cracking tool for remote authentication services. It supports many protocols, including telnet, FTP, LDAP, SSH, SNMP, and others.
Medusa is a Parallel, Modular and Speedy method for brute-force which issued for remote authentication. Following are the applications and protocols like modular design, Thread based parallel testing and flexible user input and protocols are AFP, CVS, FTP, HTTP, IMAP etc.
NEW QUESTION # 152
In a cloud environment, a security team discovers that an attacker accessed confidential information that was used to configure virtual machines during their initialization. Through which of the following features could this information have been accessed?
- A. Virtual private cloud
- B. IAM
- C. Block storage
- D. Metadata services
Answer: D
Explanation:
In a cloud environment, the information used to configure virtual machines during their initialization could have been accessed through metadata services.
Metadata Services:
Definition: Cloud service providers offer metadata services that provide information about the running instance, such as instance ID, hostname, network configurations, and user data.
Access: These services are accessible from within the virtual machine and often include sensitive information used during the initialization and configuration of the VM.
NEW QUESTION # 153
SIMULATION
Using the output, identify potential attack vectors that should be further investigated.
Answer:
Explanation:
See explanation below.
Explanation:
1: Null session enumeration
Weak SMB file permissions
Fragmentation attack
2: nmap
-sV
-p 1-1023
192.168.2.2
3: #!/usr/bin/python
export $PORTS = 21,22
for $PORT in $PORTS:
try:
s.connect((ip, port))
print("%s:%s - OPEN" % (ip, port))
except socket.timeout
print("%:%s - TIMEOUT" % (ip, port))
except socket.error as e:
print("%:%s - CLOSED" % (ip, port))
finally
s.close()
port_scan(sys.argv[1], ports)
NEW QUESTION # 154
Which of the following activities should be performed to prevent uploaded web shells from being exploited by others?
- A. Remove the persistence mechanisms.
- B. Preserve artifacts.
- C. Spin down the infrastructure.
- D. Perform secure data destruction.
Answer: D
Explanation:
Secure Data Destruction:
Securely deleting the web shell ensures it cannot be accessed or exploited by attackers in the future.
This involves removing the malicious file and overwriting the space it occupied to prevent recovery.
Why Not Other Options?
A (Remove persistence mechanisms): While helpful in maintaining security, this doesn't address the immediate threat of the web shell.
B (Spin down infrastructure): This could disrupt operations and doesn't directly mitigate the web shell issue.
C (Preserve artifacts): While necessary for forensic analysis, it does not prevent further exploitation of the web shell.
CompTIA Pentest+ Reference:
Domain 3.0 (Attacks and Exploits)
NEW QUESTION # 155
During a security assessment for an internal corporate network, a penetration tester wants to gain unauthorized access to internal resources by executing an attack that uses software to disguise itself as legitimate software. Which of the following host-based attacks should the tester use?
- A. On-path
- B. Buffer overflow
- C. Logic bomb
- D. Rootkit
Answer: D
Explanation:
A rootkit is a type of malicious software designed to provide an attacker with unauthorized access to a computer system while concealing its presence. Rootkits achieve this by modifying the host's operating system or other software to hide their existence, allowing the attacker to maintain control over the system without detection.
* Definition and Purpose:
* Rootkits are primarily used to gain and maintain root access (administrative privileges) on a system.
* They disguise themselves as legitimate software or integrate deeply into the operating system to avoid detection.
* Mechanisms of Action:
* Kernel Mode Rootkits: These operate at the kernel level, which is the core of the operating system, making them very powerful and hard to detect.
* User Mode Rootkits: These run in the same space as user applications, intercepting and altering standard system API calls to hide their presence.
* Bootkits: These infect the Master Boot Record (MBR) or Volume Boot Record (VBR) and load before the operating system, making them extremely difficult to detect and remove.
* Detection and Prevention:
* Detection Tools: Tools like RootkitRevealer, Chkrootkit, and rkhunter can help in identifying rootkits.
* Prevention: Regular system updates, use of strong antivirus and anti-malware solutions, and integrity checking tools like Tripwire can help in preventing rootkit infections.
* Real-World Examples:
* Sony BMG Rootkit: In 2005, Sony BMG included a rootkit in their digital rights management (DRM) software on music CDs. The rootkit hid files and processes, leading to a major scandal when it was discovered.
* Stuxnet: This sophisticated worm included a rootkit component to hide its presence on infected systems, making it one of the most infamous examples of rootkit use in a cyber attack.
* References from Pentesting Literature:
* In "Penetration Testing - A Hands-on Introduction to Hacking" by Georgia Weidman, rootkits are discussed in the context of post-exploitation, where maintaining access to the compromised system is crucial.
* Various HTB write-ups, such as the analysis of complex attacks involving multiple stages of exploitation, often highlight the use of rootkits in maintaining persistent access.
Step-by-Step ExplanationReferences:
* Penetration Testing - A Hands-on Introduction to Hacking
* HTB Official Writeups on sophisticated attacks
NEW QUESTION # 156
A penetration tester is conducting a wireless security assessment for a client with 2.4GHz and 5GHz access points. The tester places a wireless USB dongle in the laptop to start capturing WPA2 handshakes. Which of the following steps should the tester take next?
- A. Enable monitoring mode using Aircrack-ng.
- B. Use Kismet to automatically place the wireless dongle in monitor mode and collect handshakes.
- C. Run KARMA to break the password.
- D. Research WiGLE.net for potential nearby client access points.
Answer: A
Explanation:
Enabling monitoring mode on the wireless adapter is the essential step before capturing WPA2 handshakes.
Monitoring mode allows the adapter to capture all wireless traffic in its vicinity, which is necessary for capturing handshakes.
Preparation:
Wireless USB Dongle: Ensure the wireless USB dongle is compatible with monitoring mode and packet injection.
Aircrack-ng Suite: Use the Aircrack-ng suite, a popular set of tools for wireless network auditing.
Enable Monitoring Mode:
Command: Use the airmon-ng tool to enable monitoring mode on the wireless interface.
Step-by-Step Explanationairmon-ng start wlan0
Verify: Check if the interface is in monitoring mode.
iwconfig
Capture WPA2 Handshakes:
Airodump-ng: Use airodump-ng to start capturing traffic and handshakes.
airodump-ng wlan0mon
References from Pentesting Literature:
Enabling monitoring mode is a fundamental step in wireless penetration testing, discussed in guides like
"Penetration Testing - A Hands-on Introduction to Hacking".
HTB write-ups often start with enabling monitoring mode before proceeding with capturing WPA2 handshakes.
References:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
NEW QUESTION # 157
Which of the following best explains why communication is a vital phase of a penetration test?
- A. To explain the data destruction process
- B. To discuss situational awareness
- C. To ensure the likelihood of future assessments
- D. To build rapport with the emergency contact
Answer: B
Explanation:
Communication is a vital phase of a penetration test to ensure all parties involved are aware of the test's progress, findings, and any potential impact on business operations. Discussing situational awareness involves sharing real-time insights about the security posture, any vulnerabilities found, and potential risks.
This enables the organization to make informed decisions, mitigate risks promptly, and ensure the test aligns with business objectives and constraints.
NEW QUESTION # 158
GET /foo/images/file?id=2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd Which of the following web application attacks is the tester performing?
- A. Cross-Site Request Forgery
- B. Directory Traversal
- C. Insecure Direct Object Reference
- D. Local File Inclusion
Answer: B
Explanation:
The attacker is attempting to access restricted files by navigating directories beyond their intended scope.
* Directory Traversal (Option C):
* The request uses encoded "../" sequences (%2e%2e%2f = ../) to move up directories and access
/etc/passwd.
* This is a classic directory traversal attack aimed at accessing system files.
NEW QUESTION # 159
A penetration tester is contracted to attack an oil rig network to look for vulnerabilities. While conducting the assessment, the support organization of the rig reported issues connecting to corporate applications and upstream services for data acquisitions. Which of the following is the MOST likely culprit?
- A. Application failures
- B. Patch installations
- C. Bandwidth limitations
- D. Successful exploits
Answer: D
Explanation:
Successful exploits could cause network disruptions, service outages, or data corruption, which could affect the connectivity and functionality of the oil rig network. Patch installations, application failures, and bandwidth limitations are less likely to be related to the penetration testing activities.
NEW QUESTION # 160
During host discovery, a security analyst wants to obtain GeoIP information and a comprehensive summary of exposed services. Which of the following tools is best for this task?
- A. WiGLE.net
- B. Censys.io
- C. theHarvester
- D. WHOIS
Answer: B
Explanation:
Censys.io is a powerful reconnaissance tool that scans the internet and provides detailed information about exposed services, certificates, and GeoIP data.
* Option A (WiGLE.net) #: Used for wireless network mapping, not host discovery.
* Option B (WHOIS) #: Provides domain registration information, not GeoIP or service summaries.
* Option C (theHarvester) #: Used for OSINT, mainly to collect emails, subdomains, and usernames.
* Option D (Censys.io) #: Correct. Censys provides:
* GeoIP data (location of hosts).
* Exposed services and open ports.
* TLS certificate analysis.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - Reconnaissance and OSINT Tools
NEW QUESTION # 161
A penetration tester enumerates a legacy Windows host on the same subnet. The tester needs to select exploit methods that will have the least impact on the host's operating stability. Which of the following commands should the tester try first?
- A. msf > use <module_name> msf > set <options> msf > set PAYLOAD windows/meterpreter/reverse_tcp msf > run
- B. hydra -L administrator -P /path/to/pwlist.txt -t 100 rdp://<target_host>
- C. responder -I eth0 john responder_output.txt <rdp to target>
- D. python3 ./buffer_overflow_with_shellcode.py <target> 445
Answer: C
Explanation:
Responder is a tool used for capturing and analyzing NetBIOS, LLMNR, and MDNS queries to perform various man-in-the-middle (MITM) attacks. It can be used to capture hashed credentials, which can then be cracked offline. Using Responder has the least impact on the host's operating stability compared to more aggressive methods like buffer overflow attacks or payload injections.
Step-by-Step Explanation
Understanding Responder:
Purpose: Responder is used to capture NTLMv2 hashes from a Windows network.
Operation: It listens on the network for LLMNR, NBT-NS, and MDNS requests and responds to them, tricking the client into authenticating with the attacker's machine.
Command Breakdown:
responder -I eth0: Starts Responder on the network interface eth0.
john responder_output.txt: Uses John the Ripper to crack the hashes captured by Responder.
<rdp to target>: Suggests the next step after capturing credentials might involve using RDP with the cracked password, but the initial capture is passive and low impact.
Why This is the Best Choice:
Least Impact: Responder passively captures network traffic without interacting directly with the target host's system processes.
Stealth: It operates quietly on the network, making it less likely to cause stability issues or be detected by host-based security mechanisms.
Reference from Pentesting Literature:
Tools like Responder are discussed in penetration testing guides for initial reconnaissance and credential gathering without causing significant disruptions.
HTB write-ups frequently mention the use of Responder in network-based attacks to capture credentials safely.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
NEW QUESTION # 162
......
Free CompTIA PenTest+ PT0-003 Exam Question: https://freedumps.torrentvalid.com/PT0-003-valid-braindumps-torrent.html