Quiz
Prueba 2
Este quiz tem tipos de pergunta que abrem no player de sempre.
Perguntas do quiz (31)
1We have extracted a few lines of the config.yaml with the settings of beef-xss.
Select appropriate answer based on the meaning of these settings of beef-xss:
permitted_hooking_subnet:
- "0.0.0.0/0"
permitted_ui_subnet:
- "0.0.0.0/0"- AThe second setting "permitted_ui_subnet" should be limited to the attacker/pentester team network interface.
- BThe first setting "permitted_hooking_subnet" should be adjusted regarding the pentester scope.
- CThe first setting "permitted_hooking_subnet" allows us to control from which networks browsers may be hooked.
- DAll answers are correct
2We have created malware with Veil.py, this is the final output of the program:
What do we need to configure in metasploit console to create the listener?
- AYou need to run the command "/var/lib/veil/output/handlers/payload.exe" locally to apply listener settings.
- BAll answers are false
- CYou need to run the command "resource
var/lib/veil/output/handlers/payload.rc" from the msfconsole to apply listener settings - DWhen payload runs in target, listener is automatically created in attacking metasploit
3Select the correct statement regarding BeEF:
- ABeEF allows for integration with Metasploit to establish a persistent channel
- BBeEF requires the victim's browser to load a hook.js script to establish control over it
- CAll other answers are correct
- DBeEF enables control of a victim's web browser using JavaScript while the user remains on the page
4What is the main advantage of using Veil.py (also known as Veil-Evasion) instead of msfvenom or SET for creating a binary that we want to send to a victim in a phishing attack?
- AAll the answers are false
- BVeil focuses on obfuscation techniques to make payloads less recognizable to AV
- CUnlike Veil, SET allows for remote control of AV software on the victim’s machine
- DUnlike msfvenom, Veil can create both staged and non-staged payloads
5Regarding the payloads definition, select the wrong answer:
- AA staged payload typically will work in two phases, one establishing the connection and a second step to send the payload
- Bmsfvenom can generate a non-stage (stageless) payload
- CA non-staged payload (stageless) will open two network connections
- DA non-staged payload (stageless) contains the code in a single block and so the size of these payloads are usually bigger
6How can a TCP Reset attack occur? Select the correct choice:
- ABy compromising user credentials and manipulating TCP connection parameters
- BA TCP Reset attack happens when client encrypts the TCP traffic (TLS)
- CBy guessing TCP Sequence Number from a TCP connection and sending forged TCP reset packets
- DBy exploiting a vulnerability in the TCP/IP protocol stack related to Window Size zero
7How can a SYN Flood attack happen? Select the correct choice:
- ABy overwhelming a target server to answer a flood of TCP packets with Windows size 0
- BBy exploiting vulnerabilities in the server's operating system
- CBy intercepting and manipulating SYN TCP data packets in transit and forwarding them to the victim
- DBy overwhelming a target server to answer a flood of opened TCP connections
8What does an amplification DoS attack involve? Which statement is false?
- AIt involves a direct one-to-one interaction between the attacker (amplifier) and the victim. The attacker (amplifier) sends a massive volume request to the victim
- BIt typically uses UDP-based protocols (Fire-and-Forget)
- COne of the most typical amplification DoS attack is based on DNS request/answers
- DIn an amplification DoS attack, the base amplification factor is determined by the size of the response message from the amplifier compared to the client’s request message
9Which of the following statements is false about DoS attacks?
- ADoS TCP Window Size 0 attack consists of overloading the target with full TCP Connections until the server is forced to reduce TCP Window to zero.
- BOne type of HTTP DoS Attack involves sending POST requests to the target that can be very expensive for the target to process
- CA Smurf attack consists of sending ICMP echo request (ping) packets with a spoofed source IP address to a network’s broadcast address
- DARP poisoning attack involves associating a legitimate IP address with a wrong or malicious MAC address
10Regarding Windows UAC, select the false statement:
- AOne of the common techniques to bypass UAC is based on DLL Hijacking
- BIf UAC is enabled in Windows, any operation that requires elevation of privilege will prompt the user for confirmation or an administrator password depending on UAC settings
- CA successful technique to bypass Windows UAC is to manipulate Registry keys associated with auto-elevating privileges
- DUAC can be bypassed by simply renaming the file extension of a potentially malicious program
11Identify the correct statement regarding the functionality of Mimikatz:
- AOnce an attacker has bypassed Windows UAC, they run mimikatz to extract Windows credentials (password and Kerberos tickets)
- BMimikatz contains a database of publicly known Windows exploits and allows to find vulnerabilities in Windows systems
- CAll anwers are false
- DMimikatz is a tool designed for circumventing the User Account Control (UAC) in Windows during penetration testing
12What is Living off the Land (LotL)? Select the correct answer:
- ATechnique where attackers use legitimate tools to run malicious activities.
- BIt is a technique where attackers manipulate Windows Registry to bypass Windows UAC
- CIt is a technique that makes malicious persistence sessions in target
- DAll answers are false
13In our laboratory, we used Shelter under Wine to modify executables. Can you explain what the main function of this tool is?
- ACreate a standalone x64 binary for achieving persistence sessions on a Windows target
- BRun the executable to identify the places where it can insert the shellcode
- CMake possible to run a malicious Windows payload on a Linux system
- DAll the above are false
14For what purpose did we use the Alternate Data Streams (ADS) in Windows systems?
- AFor evading AV detection of a malicious payload when it is uploaded in the victim, by using the Shelter tool to create the payload together with the stream
- BFor creating symbolic links between hidden files and streams, which allows hiding a malicious payload
- CFor achieving persistence, because it allows a malicious payload to be self-executed when the victim accesses the machine we’ve compromised
- DFor hiding a malicious payload in a stream, because these are an obscure features of NTFS
15Select the wrong answer from the following statements about sqlmap:
- AIf PHP setting "magic quotes" is ON, sqlmap will have more likelihood of successfully exploiting SQL injection vulnerabilities
- BFor a web application requiring authentication, sqlmap needs to use a valid session cookie to access the next authenticated parts of the application
- Csqlmap has the capability to perform dictionary-based attacks to crack hashed passwords that it retrieves from the database
- Dsqlmap can be used to retrieve and dump the contents of specified database tables
16In the context of using ZAP during your lab exercises, which of the following statements correctly describes the functionalities of ZAP’s included protected mode?
- AProtected mode allows ZAP to perform any harmful actions and this is the reason why it is used to scan servers in production
- BStandard mode actively scans the new URLs as they are discovered and prevents users from performing potentially harmful actions on these new URLs
- CThe Protected mode allows the user to do harmful actions only for URLs included in the defined context
- DNone of the other answers is true
17During web application penetration testing, the pentester engineer finds that target webserver adds a new hidden input tag with the same value in every form of the web app.
The input tag is structured like this:
<input type="hidden" id="AntiCSRF" name="AntiCSRF" value="SuperSecretValueAndGiddenToo">
Which of the following statements is most accurate regarding the webserver's vulnerability to Cross-Site-Request Forgery (CSRF) attacks?- AThe webserver is NOT vulnerable to CSRF attacks because the attacker cannot guess the token's value because it is hidden
- BThe webserver is vulnerable to CSRF attacks because this token is insufficient; the webserver should also generate a session cookie
- CNone of them are correct
- DThe webserver is vulnerable to CSRF attacks because the new input/token is not randomly generated and attackers can easily discover this value inspecting the HTML code
18Select the correct answer related to the anti-CSRF mechanism that is used in DVWA
- AOWASP ZAP does not have any software mechanism to identify and to use anti-CSRF token, only Burp Community has that capability
- BAll answers are false
- CA hidden CSRF token named user_token is implemented in DVWA for CSRF protection
- DDVWA does not implement any anti-CSRF token mechanism regardless of DVWA security level
19Select the false statement regarding SET:
- ASET has the capability to clone a legitimate website and inject malicious code from this cloned website to the victims
- BSET has a attack vector to control victim browsers by a JavaScript library (hook.js)
- CSET can be used in combination with BeEF to force a user to visit a malicious webpage created by SET
- DSET creates a resource file (meta_config) that can be read by Metasploit to launch the corresponding handler
20Examine the following statements about social engineering techniques and the use of Robert Cialdini’s principles of persuasion. Which statement is false?
- AAlthough Cialdini’s principles of persuasion do not directly apply to AI systems, AI can mimic human voice and be used to create voice phishing attacks
- BOne of the main principles of persuasion is Fear: potential loss or danger can motivate people to take actions
- CSocial engineering attacks often exploit Cialdini’s principles
- DSocial engineering is the act of manipulating people into performing actions or revealing sensitive information through psychological tactics
21In the context of Kerberos protocol security within Windows environments, identify the statement that is incorrect
- AThe Authentication Server and the Ticket-Granting Server shares a symmetric key known as KTGS
- BOne of the advantages of Kerberos is that the authentication and authorization process is divided
- CThe Ticket-Granting Ticket (TGT) is requested by the client using the ticket itself, although the client cannot decipher the ticket’s content
- DKerberos is susceptible to replay attacks, allowing previously captured data to be reused maliciously
22Why are LM hashes considered to be vulnerable?
- ALM hashes are case-sensitive, which exponentially increases the difficulty of cracking them with brute-force attacks
- BLM hashes are unique and two passwords will never have the same hash
- CAll answers are wrong
- DLM hashes are vulnerable because they split the password into two 7-character chunks and hash each one without salt, making them susceptible to brute-force attacks
23Which of the following statement is correct regarding NTLMv2?
- AWhen a user logs in, their password is hashed using the NT algorithm, and this hash is then used later in the NTLMv2 authentication process
- BAll answers are false
- CNTLMv2 is a Network Authentication challenge-response protocol based on DES
- DNTLMv2 is the protocol that replaced Kerberos as the default authentication method in Windows domains
24What makes NT hashes more secure than their predecessor, LM hashes?
- AAll answers are right
- BNT hashes are not vulnerable to pass-the-hash attacks due to their MD4 encryption mechanism
- CNT hashes are salted with a unique value for each account, which prevents the use of precomputed rainbow tables for attacks
- DNT hashes are more secure because they use the MD4 hashing algorithm applied to the full password (preserving case-sensitive) without splitting it
25Regarding the Responder attack (responder.py) select the appropriate answer:
- AResponder answers broadcasted requests LLMNR (Link Local Multicast Name Resolution) and/or NBT-NS (NetBIOS over TCP/IP) Name Service pretending to be a Service Server
- BAll the answers are true
- CResponder can also perform NTLM relay attacks
- DResponder is in the middle of client and server capturing authentication attempts (NTLM hashes) or passwords cracked offline
26Build our own TGS. The Service key or the password of the service account is required[blank_start].[blank_end]
- AGolden Ticket
- BSilver Ticket
- CKerberoasting
27Build our own TGT. We need to obtain the NTLM hash of krbtgt account[blank_start].[blank_end]
- AGolden Ticket
- BSilver Ticket
- CKerberoasting
28Ask for a Service Ticket (TGS). Try to crack this ticket to get the service account password[blank_start].[blank_end]
- AGolden Ticket
- BSilver Ticket
- CKerberoasting
29This XSS vulnerability occurs when an application immediately sends back data included in an incoming HTTP request without adequately sanitizing or escaping it[blank_start].[blank_end]
- ADOM XSS
- BStored XSS
- CReflected XSS
30In this XSS vulnerability, the application takes data from an untrusted source and stores it. Later, when the application constructs HTML code in a subsequent request, it uses this stored data, leading to a vulnerability[blank_start].[blank_end]
- AReflected XSS
- BStored XSS
- CDOM XSS
31This XSS vulnerability happens when JavaScript in a web application takes data from a source that an attacker can manipulate, such as the website's URL, and then uses this data in a function that allows for dynamic code execution, like eval() or by altering the innerHTML property[blank_start].[blank_end]
- AReflected XSS
- BStored XSS
- CDOM XSS
Informações
- Descrição
- Ciberseguridad Quiz sobre Prueba 2, criado por Elvira González em 05-12-2024.
- Autor
- Elvira González
- Idioma
- Español
- Visualizações
- 6
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz