Automating Offensive Workflows GASAE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is integrating a custom exploit tool with a commercial C2 framework. The exploit tool outputs data in a custom binary format, and the C2 framework expects JSON over HTTP. The team needs to automate the transfer of data from the exploit tool to the C2 framework, but the exploit tool cannot be modified. What is the best approach?

   • AUse a manual process where an operator reads the binary output and manually enters the data into the C2 framework.
   • BCreate a shim or adapter that runs alongside the exploit tool, captures its output, converts it to JSON, and forwards it to the C2 framework's API.
   • CModify the C2 framework to accept the custom binary format directly.
   • DUse a file-based integration where the exploit tool writes to a file, and a cron job converts the file to JSON and sends it to the C2 framework.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An automated offensive workflow includes a long-running vulnerability scan that must complete before exploitation begins. The scan sometimes fails due to network timeouts. The team wants to ensure that the exploitation phase only starts after a successful scan, and that the workflow does not hang indefinitely. Which configuration is most appropriate?

   • ARun the scan and exploitation in parallel to save time.
   • BSet a timeout on the scan task and configure the workflow to fail if the scan does not complete within the timeout.
   • CUse a simple script that waits for the scan process to exit, regardless of exit code.
   • DSchedule the exploitation task to start at a fixed time after the scan is scheduled to begin.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A red team is automating a post-exploitation workflow that includes data collection from a database. The client has a strict policy that prohibits copying production data to any external system, even for testing. The team needs to demonstrate the ability to extract sensitive data, but must comply with the policy. What is the best way to achieve this?

   • AExtract the full dataset to a red-team-controlled cloud storage and encrypt it, arguing that encryption protects the data.
   • BAsk the client to sign a waiver allowing the data extraction for the duration of the test.
   • CExtract a small, anonymized sample of the data to a controlled internal server, and document that the full dataset could be extracted.
   • DOnly show a screenshot of the database query results without extracting any data.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A penetration testing team is automating exploitation of a web application that uses a Web Application Firewall (WAF). The team's exploit scripts are being blocked by the WAF. They need to adjust the automation to bypass the WAF while staying within the rules of engagement. Which approach is most appropriate?

   • AIncrease the speed of the exploit attempts to overwhelm the WAF before it can block them.
   • BDisable the WAF for the duration of the test by requesting a change from the client's security team.
   • CUse a different exploit that does not trigger the WAF, even if it is less effective.
   • DModify the exploit scripts to use encoding and obfuscation techniques that are known to evade the specific WAF, and test them against a local instance of the WAF before running against the target.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A red team is automating a post-exploitation workflow that includes data exfiltration from a client's environment. The client has strict data protection policies and requires that no data leaves the production network. The team must still demonstrate the ability to exfiltrate data. What is the best way to satisfy both the client's policy and the exercise objective?

   • AConfigure the exfiltration automation to send data to a controlled internal server that simulates an external destination, and ensure all data is deleted after the exercise.
   • BOnly simulate the exfiltration by creating a log entry that says the data was sent, without actually transferring any data.
   • CAsk the client to temporarily relax the data protection policy for the duration of the exercise.
   • DUse a real external server controlled by the red team to receive the data, and rely on encryption to protect it in transit.
   Reveal Solution Discussion Select an answer first