Exploitation Fundamentals GPEN Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A penetration tester is conducting an internal test and has gained a foothold on a Linux server. The tester needs to pivot to a Windows server on a different subnet. The Windows server is not directly reachable from the tester's workstation, but the Linux server can reach it. The tester wants to use Metasploit to exploit a vulnerability on the Windows server. What is the most effective way to proceed?

   • ASet up a Metasploit route through the Linux server's session to reach the Windows server's subnet.
   • BUpload a reverse shell payload to the Linux server and use it as a proxy to reach the Windows server.
   • CUse a reverse shell from the Windows server directly to the tester's workstation.
   • DUse a bind shell on the Windows server and connect to it from the Linux server.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester has gained a foothold on a web server and needs to move laterally to a database server. The database server is on a different subnet and is not directly reachable from the tester's attack machine. The web server has two network interfaces and can reach the database server. Which technique is most appropriate?

   • AUse a bind shell on the database server and connect from the web server.
   • BUse a port forward on the web server to forward traffic to the database server.
   • CUse a reverse shell from the database server to the attack machine.
   • DUse the web server as a pivot to route traffic to the database server.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A penetration tester discovers that a web application is vulnerable to SQL injection. Which action would be considered exploitation rather than vulnerability assessment?

   • ACrafting a SQL injection payload to extract data from the database
   • BDocumenting the SQL injection vulnerability in the final report
   • CUsing a scanner to confirm the presence of the SQL injection flaw
   • DRecommending parameterized queries to mitigate the vulnerability
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A penetration tester has successfully exploited a web server and gained a reverse shell. The tester now needs to escalate privileges to obtain administrative access. The tester has identified a misconfigured service that runs with SYSTEM privileges. Which post-exploitation technique is most appropriate to escalate privileges?

   • AUse a kernel exploit to gain SYSTEM privileges.
   • BPerform a buffer overflow attack on the service to gain SYSTEM privileges.
   • CAbuse the misconfigured service to execute a command with SYSTEM privileges.
   • DUse a password spraying attack against the administrator account.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester is assessing a web application that uses a backend database. During reconnaissance, the tester discovers that the application does not sanitize user input in a search field. The tester wants to demonstrate that this flaw can be exploited to retrieve unauthorized data. Which exploitation technique is the tester most likely to use?

   • ACross-site scripting (XSS) to execute JavaScript in the tester's own browser.
   • BMisconfiguration abuse by accessing default credentials on the database server.
   • CBuffer overflow attack against the search field to overwrite adjacent memory.
   • DSQL injection by submitting crafted SQL statements in the search field.
   Reveal Solution Discussion Select an answer first