Pass the CompTIA PenTest+ PT0-003 Questions and answers with ExamsMirror

Evaluation Criteria:

CVSS (Common Vulnerability Scoring System): Indicates the severity of vulnerabilities, with higher scores representing more critical vulnerabilities.

EPSS (Exploit Prediction Scoring System): Estimates the likelihood of a vulnerability being exploited in the wild.

Analysis:

hrdatabase: CVSS = 9.9, EPSS = 0.50

financesite: CVSS = 8.0, EPSS = 0.01

legaldatabase: CVSS = 8.2, EPSS = 0.60

fileserver: CVSS = 7.6, EPSS = 0.90

Selection Justification:

fileserver has the highest EPSS score of 0.90, indicating a high likelihood of exploitation despite having a slightly lower CVSS score compared to other targets.

This makes it a critical target for immediate testing to mitigate potential exploitation risks.

Pentest References:

Risk Prioritization: Balancing between severity (CVSS) and exploitability (EPSS) is crucial for effective vulnerability management.

Risk Assessment: Evaluating both the impact and the likelihood of exploitation helps in making informed decisions about testing priorities.

By selecting the fileserver, the penetration tester focuses on a target that is highly likely to be exploited, addressing the most immediate risk based on the given scores.

Top of Form

Bottom of Form

The tester is attempting to register a malicious DLL as a server-level plugin to escalate privileges.

Privilege escalation (Option B):

The command uses dnscmd.exe, a legitimate Windows tool for managing DNS servers.

By setting a malicious DLL (adduser.dll) as a server-level plugin, attackers can gain SYSTEM-level privileges.

This technique is a DLL hijacking attack.

Tailgating is the term used to describe a situation where a penetration tester bypasses physical access controls and gains access to a facility by entering at the same time as an employee.

Tailgating:

Definition: Tailgating occurs when an unauthorized person follows an authorized person into a restricted area without the latter’s consent or knowledge. The authorized person typically opens a door or checkpoint, and the unauthorized person slips in behind them.

Example: An attacker waits near the entrance of a building and enters right after an employee, bypassing security measures.

Physical Security:

Importance: Physical security is a crucial aspect of overall security posture. Tailgating exploits human factors and weaknesses in physical security controls.

Prevention: Security measures such as turnstiles, mantraps, and security personnel can help prevent tailgating.

Pentest References:

Physical Penetration Testing: Tailgating is a common technique used in physical penetration tests to assess the effectiveness of an organization’s physical security controls.

Social Engineering: Tailgating often involves social engineering, where the attacker relies on the politeness or unawareness of the employee to gain unauthorized access.

By understanding and using tailgating, penetration testers can evaluate the effectiveness of an organization’s physical security measures and identify potential vulnerabilities that could be exploited by malicious actors.

=================

Channel Scanning:

Wireless communications can be disrupted by identifying and interfering with the channels used by Wi-Fi networks.

Channel scanning allows the tester to map all active Wi-Fi channels, identify the target network, and determine possible jamming or interference strategies.

Why Not Other Options?

A (Port mirroring): This applies to wired network traffic duplication for monitoring purposes and is unrelated to wireless disruption.

B (Sidecar scanning): Not a relevant technique in the context of wireless disruption.

C (ARP poisoning): This targets Ethernet/IP communication in a local network, not wireless communication at the radio frequency level.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Wireless Network Disruption Techniques

If a penetration tester gains access to a host but does not have a shell, the best tool for further enumeration is Netcat. Here’s why:

Netcat:

Versatility: Netcat is known as the "Swiss Army knife" of networking tools. It can be used for port scanning, banner grabbing, and setting up reverse shells.

Enumeration: Without a shell, Netcat can help enumerate open ports and services running on the host, providing insight into the host's environment.

Comparison with Other Tools:

ProxyChains: Used to chain proxies together, not directly useful for enumeration without an initial shell.

PowerShell ISE: Requires a shell to execute commands and scripts.

Process IDs: Without a shell, enumerating process IDs directly isn’t possible.

Netcat’s ability to perform multiple network-related tasks without needing a shell makes it the best choice for further enumeration.

=================

Enabling monitoring mode on the wireless adapter is the essential step before capturing WPA2 handshakes. Monitoring mode allows the adapter to capture all wireless traffic in its vicinity, which is necessary for capturing handshakes.

Preparation:

Wireless USB Dongle: Ensure the wireless USB dongle is compatible with monitoring mode and packet injection.

Aircrack-ng Suite: Use the Aircrack-ng suite, a popular set of tools for wireless network auditing.

Enable Monitoring Mode:

Command: Use the airmon-ng tool to enable monitoring mode on the wireless interface.

Step-by-Step Explanationairmon-ng start wlan0

Verify: Check if the interface is in monitoring mode.

iwconfig

Capture WPA2 Handshakes:

Airodump-ng: Use airodump-ng to start capturing traffic and handshakes.

airodump-ng wlan0mon

References from Pentesting Literature:

Enabling monitoring mode is a fundamental step in wireless penetration testing, discussed in guides like "Penetration Testing - A Hands-on Introduction to Hacking".

HTB write-ups often start with enabling monitoring mode before proceeding with capturing WPA2 handshakes.

The goal is collecting information transmitted over the network during an internal assessment.

C. responder.py -I eth0 -wP

Responder is a widely used tool for LLMNR/NBT-NS poisoning and network credential capture.

By listening on the network interface (-I eth0), it can intercept authentication requests, capture hashes, and perform MITM attacks.

This directly aligns with network information gathering and interception.

Why not the others?

A. ntlmrelayx.py: Used for relaying captured NTLM hashes to another target, but it doesn’t collect the data directly. Typically used after Responder has captured credentials.

B. nc -tulpn: Netcat with -tulpn is for listening/port binding, not for capturing network authentication broadcasts.

D. crackmapexec smb: SMB enumeration/exploitation tool, useful once credentials are known, but not for collecting transmitted data.

CompTIA PT0-003 Objective Mapping:

Domain 2.0: Information Gathering and Vulnerability Scanning

2.3: Given a scenario, gather information by leveraging tools (e.g., Responder for network-based credential capture).

Search engine enumeration refers to using advanced search operators (e.g., Google Dorking) to find sensitive or misconfigured data exposed publicly on the internet. In this case, the administrator inadvertently posted firewall configuration details, and a tester likely used specific search queries to discover this data.

According to the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 3 – Passive Reconnaissance and OSINT):

“Search engine enumeration, often using dorking techniques, can uncover publicly available but sensitive data, such as configuration files, credentials, or documents unintentionally published online.”

A DNS zone transfer attack occurs when a misconfigured DNS server allows attackers to retrieve the entire DNS record set.

Zone transfer (Option A):

The command host -t axfr domain.com dnsl.domain.com requests an AXFR (authoritative transfer) of the DNS records.

This provides subdomains, email servers, and internal DNS records, which attackers can use for reconnaissance.

The Wayback Machine is an online tool that archives web pages over time, allowing users to see how a website looked at various points in its history. This can be extremely useful for penetration testers looking to explore potential security weaknesses by searching for subdomains that might have existed in the past.

Accessing the Wayback Machine:

Go to the Wayback Machine website: archive.org/web.

Enter the URL of the target website you want to explore.

Navigating Archived Pages:

The Wayback Machine provides a timeline and calendar interface to browse through different snapshots taken over time.

Select a snapshot to view the archived version of the site. Look for links, subdomains, and resources that may no longer be available in the current version of the website.

Identifying Subdomains:

Examine the archived pages for references to subdomains, which might be visible in links, scripts, or embedded content.

Use the information gathered to identify potential entry points or older versions of web applications that might still be exploitable.

Tool Integration:

Tools like Burp Suite or SpiderFoot can integrate with the Wayback Machine to automate the discovery process of archived subdomains and resources.

Real-World Example:

During a penetration test, a tester might find references to oldadmin.targetsite.com in an archived page from several years ago. This subdomain might no longer be listed in DNS but could still be accessible, leading to potential security vulnerabilities.

References from Pentesting Literature:

In various penetration testing guides and HTB write-ups, using the Wayback Machine is a common technique for passive reconnaissance, providing historical context and revealing past configurations that might still be exploitable.

Step-by-Step ExplanationReferences:

HTB Official Writeups

=================