PT0-003

A penetration tester wants to send a specific network packet with custom flags and sequence numbers to a vulnerable target. Which of the following should the tester use?

Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?

A penetration tester is performing a security review of a web application. Which of the following should the tester leverage to identify the presence of vulnerable open-source libraries?

A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent: ```xml <?xml version="1"?> <!DOCTYPE data [ <!ENTITY foo SYSTEM "file:///etc/passwd" ]> <test>&foo;</test> ``` Which of the following should the tester recommend in the report to best prevent this type of vulnerability?

A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?

A penetration tester needs to test a very large number of URLs for public access. Given the following code snippet: ```python 1 import requests 2 import pathlib 3 4 for url in pathlib.Path("urls.txt").read_text().split("\n"): 5 response = requests.get(url) 6 if response.status == 401: 7 print("URL accessible") ``` Which of the following changes is required?

During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?

While performing an internal assessment, a tester uses the following command: ``` crackmapexec smb 192.168.1.0/24 -u user.txt -p Summer123@ ``` Which of the following is the main purpose of the command?

A penetration testing team needs to determine whether it is possible to disrupt the wireless communications for PCs deployed in the client's offices. Which of the following techniques should the penetration tester leverage?

Which of the following tasks would ensure the key outputs from a penetration test are not lost as part of the cleanup and restoration activities?

A tester gains initial access to a server and needs to enumerate all corporate domain DNS records. Which of the following commands should the tester use?

A penetration tester is performing network reconnaissance. The tester wants to gather information about the network without causing detection mechanisms to flag the reconnaissance activities. Which of the following techniques should the tester use?

A penetration tester reviews a SAST vulnerability scan report. The following lines of code have been reported as vulnerable: ``` Issue 40 of 126 Language: Java Severity: Medium Call: try { // ... } catch (SomeException e) { e.printStackTrace(); } ``` Which of the following is the best method to remediate this vulnerability?

During a security assessment, a penetration tester uses a tool to capture plaintext log-in credentials on the communication between a user and an authentication system. The tester wants to use this information for further unauthorized access. Which of the following tools is the tester using?

A penetration tester established an initial compromise on a host. The tester wants to pivot to other targets and set up an appropriate relay. The tester needs to enumerate through the compromised host as a relay from the tester's machine. Which of the following commands should the tester use to do this task from the tester's host? Options: A. attacker_host$ nmap -sT <target_cidr> | nc -n <compromised_host> 22 B. attacker_host$ mknod backpipe p attacker_host$ nc -l -p 8000 | 0 <backpipe | nc <target_cidr> 80 | tee backpipe C. attacker_host$ nc -nlp 8000 | nc -n <target_cidr> attacker_host$ nmap -sT 127.0.0.1 8000 D. attacker_host$ proxychains nmap -sT <target_cidr>

A penetration tester is unable to identify the Wi-Fi SSID on a client's cell phone. Which of the following techniques would be most effective to troubleshoot this issue?

During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward. Which of the following types of attacks is this an example of?

A penetration tester attempts unauthorized entry to the company’s server room as part of a security assessment. Which of the following is the best technique to manipulate the lock pins and open the door without the original key?

Which of the following technologies are most likely used with badge cloning? (Choose two.)

During a penetration test of a web application, the tester gains full access to the application's source code. The application repository includes thousands of code files. Given that the assessment timeline is very short, which of the following approaches would allow the tester to identify hard-coded credentials most effectively?