You are developing an exploit for a web application that has a format string vulnerability. You need to leak a stack address and then write to a specific memory location. The application is 64-bit and uses ASLR. Which technique is most appropriate?

Use a buffer overflow to overwrite the return address.

Use a heap overflow to gain code execution.

Use the %x format specifier to leak stack values, then use %n to write.

Use the %p format specifier to leak stack values, then use %n to write to a target address.

You need to deliver a PowerShell payload that evades both static signature detection and AMSI scanning. The payload is a simple reverse shell. Which technique is most likely to bypass both?

Use a simple XOR cipher to encrypt the script and decrypt it at runtime.

Use a reflective loading technique to load an unmanaged DLL from memory.

Use string concatenation and variable substitution to obfuscate the payload, then invoke it via IEX.

Base64-encode the entire script and use -EncodedCommand.

You are crafting a shellcode payload for a Windows exploit. The shellcode must be position-independent and avoid null bytes. Which technique is most appropriate?

Use a reverse shell payload that connects back to your machine.

Use a staged payload that downloads the final shellcode from a remote server.

Use a bind shell payload that listens on a port.

Use an encoder to remove null bytes from the payload.

You are automating a network scan with Nmap and need to feed the results into a Python script that will attempt default credentials on discovered SMB services. The Nmap output must be easily parsed. Which approach is most efficient?

Run Nmap with `-oN` and use regex to extract IP addresses and open ports from the text output.

Run Nmap with `-oG` and use `grep` in a shell script to extract the needed fields.

Run Nmap with `-oX -` and parse the XML output in Python using the `xml.etree.ElementTree` module.

Run Nmap with `-oA` to produce all output formats and manually copy the results into Python.

You are writing a Python script to interact with a network service that uses TLS with a self-signed certificate. The script must connect to the service, send a JSON payload, and receive a response. The service is slow to respond, and you need to avoid hangs. Which scripting approach is most robust?

Use `socket` directly without SSL and send plaintext JSON.

Use the `ssl` module with `ssl._create_unverified_context()` and set a socket timeout using `socket.settimeout(10)`.

Use `http.client` with default SSL context and no timeout.

Use `requests` with `verify=False` and no timeout.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 2

Practical Scripting for Offensive Operations GXPN Practice Questions (Page 9)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 41–45

41expert · hard
You are developing an exploit for a web application that has a format string vulnerability. You need to leak a stack address and then write to a specific memory location. The application is 64-bit and uses ASLR. Which technique is most appropriate?
Select an answer first
42expert · hard
You need to deliver a PowerShell payload that evades both static signature detection and AMSI scanning. The payload is a simple reverse shell. Which technique is most likely to bypass both?
Select an answer first
43application · medium
You are crafting a shellcode payload for a Windows exploit. The shellcode must be position-independent and avoid null bytes. Which technique is most appropriate?
Select an answer first
44application · medium
You are automating a network scan with Nmap and need to feed the results into a Python script that will attempt default credentials on discovered SMB services. The Nmap output must be easily parsed. Which approach is most efficient?
Select an answer first
45expert · hard
You are writing a Python script to interact with a network service that uses TLS with a self-signed certificate. The script must connect to the service, send a JSON payload, and receive a response. The service is slow to respond, and you need to avoid hangs. Which scripting approach is most robust?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.