Automating Offensive Workflows GASAE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An automated post-exploitation pipeline must perform privilege escalation, lateral movement, and data exfiltration across a Windows domain. The team requires that the pipeline minimize the chance of triggering endpoint detection and response (EDR) alerts, and also requires that if a lateral movement step fails, the pipeline retries with a different technique before aborting. Which design best meets these constraints?

   • AUse a scheduled task that runs a batch file invoking various tools, with a simple loop that retries the same lateral movement command after a delay.
   • BUse a single PowerShell script that runs all post-exploitation actions in sequence, with a try-catch that retries the same lateral movement command up to three times.
   • CUse a custom C2 framework that automates the entire chain, but with no retry logic; if a step fails, the operator manually intervenes.
   • DUse an orchestration platform that defines separate tasks for each phase, with a retry policy that alternates between two lateral movement techniques (e.g., WMI and SMB) on failure, and uses built-in logging that writes to a local file.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is integrating a commercial vulnerability scanner with an open-source exploitation framework. The scanner outputs findings in a proprietary format, and the exploitation framework expects a specific XML schema. The team needs to automate the transfer of findings from the scanner to the exploitation framework, but the scanner's API is rate-limited and the exploitation framework cannot be modified. What is the most effective approach?

   • AExport the scanner's findings to CSV and manually convert them to XML using a spreadsheet before importing into the exploitation framework.
   • BDevelop a middleware service that periodically polls the scanner's API, converts the findings to the required XML schema, and queues them for the exploitation framework, respecting the API rate limit.
   • CUse a cron job to run a script that directly calls the scanner's API and writes the XML file, ignoring the rate limit.
   • DModify the exploitation framework's source code to accept the scanner's proprietary format directly.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester needs to automate service enumeration across a large IP range. The tester wants to identify open ports and running services, and then feed that information into a vulnerability scanner. Which approach is most efficient?

   • AUse Nmap with the -sV flag to perform service version detection and output the results in XML format for the vulnerability scanner.
   • BUse a simple ping sweep to identify live hosts and then manually check services.
   • CUse a custom Python script that connects to each port and reads banners.
   • DUse a commercial scanner that only outputs a proprietary format.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A red team needs to automate OSINT gathering for a client. The team wants to collect data from public sources such as social media, job postings, and DNS records, and then correlate this data to identify potential usernames and technologies. The automation must respect rate limits and legal boundaries. Which toolset and approach is most appropriate?

   • AUse a commercial threat intelligence platform that provides OSINT feeds and automatically correlates data, but does not allow custom username generation.
   • BWrite a Python script that scrapes all public social media profiles without any delay, storing data in a local database.
   • CUse a single Nmap command with OSINT scripts to gather all information from public sources.
   • DUse theHarvester to collect emails and subdomains, linkedin2username to generate usernames from LinkedIn, and a custom Python script to correlate and store results, with built-in delays to respect rate limits.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an orchestration platform commonly used to automate offensive security workflows?

   • AWireshark
   • BMicrosoft Word
   • CNmap
   • DApache Airflow
   Reveal Solution Discussion Select an answer first