Exploitation Fundamentals GPEN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   During a penetration test, which activity best exemplifies the exploitation phase?

   • ASending a crafted request to a web application to achieve remote code execution
   • BInterviewing staff to assess security awareness
   • CReviewing the target's firewall rules to understand network segmentation
   • DRunning a vulnerability scanner against the target to identify missing patches
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A penetration tester has completed a vulnerability scan of a client's web application and identified a SQL injection flaw in the login form. The client's scope agreement explicitly permits active exploitation of web application vulnerabilities but prohibits any actions that could cause data loss or service disruption. Which action best aligns with the engagement's objectives and constraints?

   • AImmediately patch the vulnerability in the client's code to prevent further risk.
   • BUse sqlmap to extract the entire user database to prove the impact of the flaw.
   • CReport the vulnerability without attempting any exploitation to stay within safe boundaries.
   • DDemonstrate the injection by retrieving a single benign value, such as the database version, and document the finding.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a penetration test, a tester has successfully exploited a web application and gained a low-privilege shell on the underlying server. The next step in the exploitation lifecycle is to escalate privileges to gain administrative access. Which action is most appropriate?

   • AImmediately run a network scan to find other hosts.
   • BExfiltrate sensitive data from the current user's files.
   • CDelete all logs to cover tracks.
   • DEnumerate the system for misconfigured services, kernel vulnerabilities, or weak permissions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is assessing a web application that uses user-supplied filenames to construct file paths. The tester suspects that the application is vulnerable to path traversal. Which exploitation technique would confirm this vulnerability?

   • ASubmit a long string of characters to cause a buffer overflow.
   • BSubmit a SQL injection payload in the filename field.
   • CSubmit a filename like '../../etc/passwd' to read a sensitive file.
   • DSubmit a JavaScript payload to execute cross-site scripting.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration tester is engaged to test a client's external web application. The rules of engagement state that testing is limited to the application's login functionality and must not affect other systems. During testing, the tester discovers that the login form is vulnerable to SQL injection that could be used to read the entire user database. What is the most appropriate action?

   • AExploit the SQL injection to extract a single test record to prove the vulnerability, then document the risk.
   • BStop testing and report the vulnerability immediately without exploitation.
   • CExtract the entire user database to demonstrate the full impact of the vulnerability.
   • DUse the SQL injection to access other internal systems to show lateral movement.
   Reveal Solution Discussion Select an answer first