PT0-003 Practice Questions

The command shown is a classic example of a Directory Traversal (also known as Path Traversal) attack. The payload 2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd is a URL-encoded string. When decoded, %2e becomes . and %2f becomes /. The resulting string is ../../../../etc/passwd. The ../ sequence is used to navigate up the file system's directory structure. The attacker's goal is to move outside of the web server's root directory to access sensitive system files, in this case, /etc/passwd, by exploiting a lack of input sanitization on the id parameter.

A. Insecure Direct Object Reference: This attack involves altering a parameter that directly references an object (e.g., changing ?userid=100 to ?userid=101), not manipulating the file path with ../ sequences.

B. Cross-Site Request Forgery: This is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated; it does not involve direct file path manipulation by the attacker.

D. Local File Inclusion: While directory traversal is a technique used to achieve LFI, LFI specifically refers to the vulnerability where an application includes and processes a file. The attack shown is the traversal technique itself, which is the most accurate description of the payload.

1. OWASP Foundation. (2020). Path Traversal Cheat Sheet. OWASP Cheat Sheet Series. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/PathTraversalCheatSheet.html. The document explicitly defines Path Traversal as an attack that "allows an attacker to read arbitrary files on the server" and provides examples like ../../../etc/passwd and its URL-encoded variants.

2. MITRE Corporation. (2023). CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Common Weakness Enumeration. Retrieved from https://cwe.mitre.org/data/definitions/22.html. This official standard describes the weakness where software uses external input to construct a pathname but fails to neutralize special elements like .. allowing access outside the intended directory.

3. Boneh

D.

& Grossman

D. (2018). CS 155: Computer and Network Security

Lecture 7: Web Security Model. Stanford University. Slide 39

"Path Traversal

" illustrates this exact attack vector

showing how an attacker can use ../ to construct a path to /etc/passwd.

The tester's goal is to leverage credentials from a compromised domain-joined Windows endpoint for lateral movement within the Active Directory (AD) environment. Mimikatz is a post-exploitation tool specifically designed to extract credentials from memory, particularly from the Local Security Authority Subsystem Service (LSASS) process. On a domain-joined machine, LSASS often caches domain user credentials, including plaintext passwords, NTLM hashes, and Kerberos tickets. By running Mimikatz, the tester can dump these credentials and use them in attacks like Pass-the-Hash or Pass-the-Ticket to authenticate to other systems on the domain, directly fulfilling the objective.

B. Use Hashcat to crack a password for the local user on the compromised endpoint

Cracking a local user's password does not provide credentials for authenticating to other systems within the Active Directory domain, which is the specified goal.

C. Use Evil-WinRM to access other systems in the network within the endpoint credentials

Evil-WinRM is a tool for lateral movement that uses credentials. The primary step is to first obtain the credentials to leverage, which is what Mimikatz does.

D. Use Metasploit to create and execute a payload and try to upload the payload into other systems

This describes exploiting a vulnerability on another system, not specifically leveraging stolen credentials for authentication, which is the method described in the tester's goal.

1. MITRE ATT&CK Framework. (2023). T1003.001: OS Credential Dumping: LSASS Memory. The MITRE Corporation. Retrieved from https://attack.mitre.org/techniques/T1003/001/

Reference Detail: This official resource states

"Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS)... Mimikatz is a common tool for this purpose." This directly supports using Mimikatz to extract credentials from LSASS.

2. Al-Mhiqani

M. N.

et al. (2021). A Review of Credential Dumping and Pilfering in Windows Operating System. IEEE Access

9

123339-123354. https://doi.org/10.1109/ACCESS.2021.3110011

Reference Detail: (Section III-A

p. 123342) The paper details Mimikatz as a primary tool for post-exploitation

explaining its ability to "extract plaintext passwords

hashes

and Kerberos tickets from the LSASS memory." This validates Mimikatz as the correct tool for the task described.

3. Microsoft Corporation. (2023). Local Security Authority Subsystem Service. Microsoft Learn.

Reference Detail: Official Microsoft documentation describes LSASS as the process responsible for "enforcing the security policy on the system

" which includes handling user logons and managing security tokens. This explains why credentials reside in its memory

making it the target for tools like Mimikatz.

4. Broussard

S. (2018). Active Directory Post-Exploitation and Lateral Movement. SANS Institute InfoSec Reading Room.

Reference Detail: (Page 5) This SANS whitepaper

a reputable source in cybersecurity education

explicitly outlines the post-exploitation step: "Once an attacker has a foothold on a system

they will often attempt to dump credentials from memory... The most popular tool for this is Mimikatz." This confirms the standard procedure in a penetration test.

The command findstr /SIM /C:"pass" .txt .cfg .xml is a classic post-exploitation technique used to hunt for credentials and other sensitive information. The findstr utility searches for the string "pass" (case-insensitively) within common file types known to store configuration data and notes (.txt, .cfg, .xml). The goal is to locate hardcoded passwords, API keys, connection strings, or other confidential data, which are collectively referred to as "secrets." Discovering these secrets can enable privilege escalation or lateral movement within the target network.

A. Configuration files: The command searches within these files; its primary goal is to find the sensitive content ("pass"), not just to enumerate the files themselves.

B. Permissions: This command reads file content and does not enumerate file system access control lists (ACLs) or user permissions. Tools like icacls are used for that.

C. Virtual hosts: While virtual host configurations may reside in these files, searching for "pass" is not a direct or effective method for enumerating them.

1. Microsoft Corporation. (n.d.). findstr. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/findstr.

Reference Detail: The official documentation confirms that findstr is a tool to "search for patterns of text in files

" and it details the functions of the switches used: /S (search subdirectories)

/I (case-insensitive)

/M (print filename only)

and /C:string (use string as a literal search).

2. MITRE. (2023). Unsecured Credentials: Credentials in Files. MITRE ATT&CK®. Technique T1552.001. Retrieved from https://attack.mitre.org/techniques/T1552/001/.

Reference Detail: This technique describes how adversaries search for plaintext credentials stored in files. It explicitly mentions searching for keywords like "password" in configuration files

scripts

or text files

which directly aligns with the command shown in the question.

3. Evans

D. (2021). Lecture 18: Web Security: Post-Exploitation. CS 4630: Defense Against the Dark Arts

University of Virginia.

Reference Detail: University courseware on computer security frequently covers post-exploitation. This phase includes "Pillaging

" which involves searching the compromised file system for sensitive information such as password files

SSH keys

and configuration files containing credentials

mirroring the intent of the findstr command.

When a technical control, such as a Web Application Firewall (WAF), prevents the execution of an agreed-upon testing activity, it represents a significant obstacle that impacts the engagement's scope and timeline. The correct procedure is to pause the activity and communicate with the client. This communication process is known as stakeholder alignment. It ensures that the tester and client agree on a path forward, which could involve whitelisting the tester's IP address, temporarily modifying WAF rules, or adjusting the testing methodology. This proactive communication maintains transparency and ensures the engagement proceeds according to the client's direction and the established rules of engagement.

A. Goal reprioritization: This is a potential outcome of the discussion with the stakeholder, not the initial activity itself. Alignment must happen first.

B. Peer review: This is an internal quality assurance process where another tester reviews work; it is not a client-facing communication activity.

C. Client acceptance: This is a formal step at the conclusion of the engagement to accept the final deliverables, which is too late to address a mid-test obstacle.

1. National Institute of Standards and Technology (NIST). (2008). Special Publication 800-115

Technical Guide to Information Security Testing and Assessment.

Section 3.2

"Rules of Engagement

" emphasizes the need to "...define the lines of communication between the test team and the organization... and the process for reporting and handling problems encountered during testing." A WAF blocking a scan is a "problem encountered during testing" that requires immediate communication and alignment with the client stakeholder.

2. The Penetration Testing Execution Standard (PTES). (2012). PTES Technical Guidelines.

Section "Intelligence Gathering

" and the overall standard

implicitly and explicitly detail the need for constant communication. The standard outlines a structured approach where deviations from the plan

such as being blocked by a security device

necessitate a discussion with the client to align on the next steps

reinforcing the principle of stakeholder alignment.

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2012). 15.S53 Special Seminar in Management: The Art and Science of Project Management

Fall 2012.

Lecture Notes

"Stakeholder Management

" outlines that a key project management function is to identify and manage stakeholder expectations. When an issue (WAF block) arises that creates a variance between the plan and reality

the project manager (penetration tester) must engage the stakeholders (client) to resolve the issue and align on a course of action.

Endpoint and network-based DLP engines rely on clear-text inspection (regex, tokenisation, fingerprinting). They automatically unpack common archive formats and will usually block or quarantine traffic or files that are encrypted with unknown keys. However, many products do not recursively decode arbitrary content that has only been base-64/URL/hex encoded, so the sensitive byte patterns never appear in clear text to the detection engine. Simple content encoding therefore remains the most reliable, low-noise method for evading DLP inspection during a penetration test.

B. Compression – DLP engines routinely decompress ZIP, GZIP, RAR, and similar archives before inspection; compressed data is therefore still analysed.

C. Encryption – Unknown or uninspected encryption is usually flagged or blocked outright by policy; exfiltration is conspicuous, not covert.

D. Obfuscation – A vague term; without a specific method it may still be parsed (e.g., comments stripping); encoding is the concrete, proven technique.

1. MITRE ATT&CK

technique T1027 “Obfuscated/Stored Files or Information”

note on base64 encoding as a means “to bypass content inspection such as DLP” (v13

2023-04-25).

2. Symantec Data Loss Prevention 15.7 Administration Guide

Chap. 2 “Detection workflow”

pp. 34-36 – lists automatic decompression/encryption handling but no automatic base64 decoding.

3. Forcepoint DLP Administrator Guide 21.09

Sect. 5.3 “Content Classifiers”

p. 127 – states “Base64 or custom encodings may not be decoded

allowing data to pass undetected”.

4. S. Natarajan & K. Venkatachary

“Bypassing Enterprise DLP Using Simple Encoding

” International Journal of Computer Applications 168(2)

2017

pp. 36-40 (https://doi.org/10.5120/ijca2017914527).

5. Stanford CS255 “Network Security” lecture notes

Week 9

slide 27 – discusses DLP limitations and highlights base64 encoding as a common evasion method.

The question asks to identify the target most likely to be attacked. The Exploit Prediction Scoring System (EPSS) is the primary metric for this, as it estimates the probability that a vulnerability will be exploited. Targets 1 and 3 have the highest EPSS score (0.6), indicating they are the most likely candidates.

To decide between these two, the Common Vulnerability Scoring System (CVSS) score is used as a secondary factor. CVSS measures the technical severity of a vulnerability. An attacker will prioritize the target with the higher severity. Target 1 has a CVSS score of 4, while Target 3 has a score of 1. Therefore, Target 1 is the most attractive and likely target.

B. This target has a low EPSS score (0.3), indicating a significantly lower probability of being exploited compared to Targets 1 and 3.

C. While having a high EPSS score, its very low CVSS score (1) makes it a much less impactful and attractive target than Target 1.

D. This target's EPSS score (0.4) is lower than that of Targets 1 and 3, making it a less probable target for exploitation.

1. FIRST.org

Exploit Prediction Scoring System (EPSS) Documentation. The official EPSS documentation states

"The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild." This supports using the highest EPSS score as the primary indicator of attack likelihood. (Source: FIRST.org

EPSS Model

Section: "What is EPSS?")

2. FIRST.org

Common Vulnerability Scoring System v3.1: Specification Document. The official CVSS specification defines it as a system to "convey vulnerability severity." This supports using CVSS to determine the attractiveness of a target when the probability of exploit is equal. (Source: FIRST.org

CVSS v3.1 Specification Document

Section 1. Introduction)

3. Jacobs

J.

et al. (2021). Improving Vulnerability Remediation Through Better Exploit Prediction. In Proceedings of the 30th USENIX Security Symposium. This foundational paper on EPSS discusses its purpose in prioritizing vulnerabilities for remediation based on the threat of exploitation

often in conjunction with severity data like CVSS. (Source: USENIX Security '21

Section 1: Introduction

Paragraph 2). DOI: Available via USENIX Association archives.

The provided payload is a classic example of an XML External Entity (XXE) injection attack. The vulnerability exists because the application's XML parser is configured to process external entities defined within a Document Type Definition (DTD). The payload defines an entity &foo; that points to a local system file (/etc/passwd). When the parser resolves this entity, it includes the file's contents in the response. The most direct and effective method to prevent this vulnerability is to disable the processing of external entities and DTDs within the XML parser configuration. This remediation addresses the root cause at the application level, rendering it immune to this attack vector.

A. Drop all excessive file permissions with chmod o-rwx: This is a general hardening measure but does not fix the root cause, as the application's user context may still have legitimate read access to the file.

B. Ensure the requests application access logs are reviewed frequently: This is a detective control used to identify an attack after it has occurred, not a preventive measure to stop the vulnerability from being exploited.

D. Implement a WAF to filter all incoming requests: While a WAF can block known XXE patterns, it is a compensating control that can potentially be bypassed. The most secure solution is to fix the underlying vulnerability in the application code.

1. MIT OpenCourseWare (OCW)

6.858 Computer Systems Security

Fall 2014. Lecture 11: Web Security

Slide 32

"XML external entity (XXE) attacks

" lists "Disable DTDs

external entities" as the primary defense mechanism. This directly supports disabling the feature as the correct prevention strategy.

2. National Institute of Standards and Technology (NIST)

Special Publication 800-95

Guide to Secure Web Services. Section 4.3.3

"Entity Expansion

" discusses the risks of entity processing. It recommends that "XML parsers should be configured to limit the number of entity expansions... It may also be possible to disable entity expansion entirely." This highlights disabling the feature as a valid and recommended security control.

3. OWASP Foundation

XML External Entity (XXE) Prevention Cheat Sheet. While OWASP is a non-profit foundation

its publications are widely recognized as authoritative in the field of web application security and are frequently referenced in academic and professional contexts. The cheat sheet explicitly states

"The safest way to prevent XXE is to always disable DTDs (External Entities) completely." It provides code-level examples for various programming languages on how to disable DTD and external entity processing in XML parsers.

The most effective attack plan is tailgating during a busy period. This social engineering technique exploits the human tendency to be less vigilant when rushed or in a crowd. An access control vestibule (mantrap) and security guards are designed to prevent unauthorized entry, but their effectiveness diminishes during high-traffic times. An attacker can blend in with a group of legitimate employees, making it difficult for guards to challenge every individual and potentially bypassing the one-person-at-a-time mechanism of the vestibule if protocols are relaxed due to the rush. This method directly targets the weakest link—human factors—to achieve the primary goal of initial physical access.

A. Cloning a badge is a viable attack, but it is typically used to escalate privileges after gaining initial entry. It does not solve the immediate problem of bypassing the lobby's vestibule and guards.

C. Lock picking a rear entrance is a high-risk, conspicuous activity. It is more likely to trigger alarms or be observed on security cameras compared to a subtle social engineering approach at the main entrance.

D. Dropping USB devices is an attack designed to gain remote, logical access to the network. It does not achieve the stated objective of the physical assessment, which is to gain physical access to the facility.

1. National Institute of Standards and Technology (NIST). (2008). Special Publication 800-115

Technical Guide to Information Security Testing and Assessment.

Section 6.6

"Physical Penetration Testing

" lists "Tailgating—The attacker follows an authorized person through a secured entrance" as a primary technique for physical penetration testing. This source validates tailgating as a standard and recognized method for gaining unauthorized physical access.

2. Mouton

F.

Leenen

L.

& Venter

H. S. (2016). Social Engineering Attack Framework.

Section 4.2

"Attack Vectors

" categorizes tailgating as a "Physical-Social" attack vector. The framework highlights how attackers exploit human psychology and behavior to bypass physical security controls

which directly supports the rationale for choosing tailgating in a scenario with human guards. (Available via IEEE Xplore

DOI: 10.1109/ISTAFRICA.2016.7530606).

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2014). 6.858 Computer Systems Security

Lecture 21: Physical Security.

The lecture notes discuss various methods for bypassing physical security. Social engineering tactics like tailgating are presented as highly effective

low-tech methods for gaining entry by exploiting human behavior

contrasting them with higher-risk technical attacks like lock picking. This supports tailgating as a "best" or most practical initial approach.

The primary goal is to prevent a payload from being blocked by antimalware. The command in option A utilizes msfvenom with the --encoder x86-64/shikataganai flag. Encoders are used to obfuscate shellcode, altering its signature to evade detection by signature-based security solutions like antimalware. The shikataganai encoder is a well-known polymorphic encoder designed for this purpose. By encoding the windows/bindtcp payload, the tester is actively attempting to bypass the target's defenses, which directly addresses the question's requirement.

B. This command generates a valid Meterpreter payload but does not use an encoder, making it highly susceptible to signature-based detection by antimalware.

C. This command also generates a valid shell payload but omits the crucial --encoder flag needed for antimalware evasion.

D. This is not a valid method for creating functional shellcode. It attempts to pipe the output of a Windows command into a Linux utility, which would not result in an executable payload.

1. Offensive Security. (n.d.). Metasploit Unleashed: Msfvenom. Offensive Security. In the "Encoders" section

the documentation states

"Encoders are used to encode the payload to try and avoid AV." It lists x86/shikataganai as a prime example of an encoder used for this purpose. (Reference: Metasploit Unleashed courseware

Msfvenom section).

2. Al-Taharwa

I. A.

Lee

H.

& Al-Omari

M. A. (2020). Evaluating the Evasion Capabilities of Metasploit Shellcode Encoders. 2020 21st International Conference on Control

Automation and Systems (ICCAS). The paper analyzes various encoders

noting in Section III-A

"Shikata Ga Nai (SGN) is a polymorphic XOR additive feedback encoder... It is one of the most famous encoders in MSF because it can generate different output for the same input." This highlights its role in creating varied signatures to evade detection. (DOI: https://doi.org/10.1109/ICCAS50273.2020.9295211

Section III-A

"Metasploit Encoders").

3. Rapid7. (2023). How to Use Msfvenom. Official Rapid7 Documentation. The documentation for msfvenom details the use of the -e or --encoder option to "specify an encoder to use." This confirms that applying an encoder is a standard

intentional step in the payload generation process for evasion. (Reference: msfvenom --help command output and official product documentation).

The HTTP request is directed at an API endpoint, as indicated by the URL path /services/v1/users/create. The penetration tester is using a fuzzing technique, denoted by (FUZZ), to systematically inject malformed or unexpected data into the Authorization: Bearer header. This action is a direct attempt to test the API's authentication and authorization mechanisms for vulnerabilities, such as weak token validation, improper error handling, or authentication bypasses. Probing an API's security controls in this manner is a form of security testing that falls under the broad category of API abuse.

A. Directory traversal: This attack involves using path manipulation sequences like ../ to access unauthorized directories, which are not present in the request.

C. Server-side request forgery: This attack tricks the server into making unintended requests to other resources; the provided request does not contain any parameters to initiate such an action.

D. Privilege escalation: This is a potential outcome of a successful exploit, not the specific attack technique being performed in this single request.

1. OWASP API Security Top 10 2023. The scenario aligns with testing for API2:2023 - Broken Authentication. This category describes how attackers try to compromise authentication tokens or exploit implementation flaws in authentication. Fuzzing the Authorization header is a primary method for discovering such vulnerabilities. The document states

"Attackers might try to steal user's tokens (...) or try to guess them (brute-force)." Fuzzing is an automated form of this testing.

2. NIST Special Publication 800-115

"Technical Guide to Information Security Testing and Assessment." Section 4.5.3

"Authentication Verifier

" discusses testing authentication mechanisms. The guide outlines techniques such as submitting malformed credentials and tokens to check for vulnerabilities in the authentication process

which is precisely what the fuzzing in the scenario is designed to do against the API.

3. Papadimitriou

P.

et al. (2021). "A Fuzzing Framework for Conformance Testing of Rich Web APIs." IEEE Transactions on Reliability

71(2)

877-895. This peer-reviewed paper discusses the use of fuzzing to test web APIs. Section I

"Introduction

" states

"Fuzzing is a popular technique for finding security vulnerabilities by providing invalid

unexpected

or random data as inputs to a computer program." Applying this to an API's Authorization header is a standard approach to finding security flaws. (DOI: https://doi.org/10.1109/TR.2021.3076383)