Back to CompTIA PenTest+ (PenTest+)

Attacks and Exploits

Execute network, authentication, host-based, web application, cloud-based, and AI attacks using appropriate tools and techniques (35% of exam).

The largest domain covering comprehensive attack techniques. Network attacks include VLAN hopping, on-path attacks, and service exploitation. Authentication attacks cover brute-force attacks, pass-the-hash, and credential stuffing. Host-based attacks encompass privilege escalation, process injection, and credential dumping. Web application attacks include SQL injection, cross-site scripting (XSS), and directory traversal. Cloud-based attacks cover container escapes, metadata service attacks, and IAM misconfiguration exploitation. Also includes AI attacks such as prompt injection and model manipulation against artificial intelligence systems.
5 minutes 5 Questions

In the context of the CompTIA PenTest+ certification, understanding the distinction and relationship between attacks and exploits is fundamental to the vulnerability assessment and penetration testing lifecycle. An **exploit** is a specific piece of software, a chunk of data, or a sequence of comma…

Concepts covered: VLAN hopping attacks, On-path attacks (MITM), ARP spoofing and poisoning, DNS poisoning attacks, Service exploitation, Network protocol attacks, Wireless network attacks, Bluetooth attacks, LLMNR/NBT-NS poisoning, Brute-force attacks, Password spraying, Credential stuffing, Pass-the-hash attacks, Pass-the-ticket attacks, Kerberoasting, AS-REP roasting, Golden ticket attacks, Silver ticket attacks, NTLM relay attacks, Privilege escalation techniques, Windows privilege escalation, Linux privilege escalation, Process injection, DLL hijacking, Credential dumping, Mimikatz usage, Token manipulation, UAC bypass techniques, Living off the land binaries (LOLBins), SQL injection attacks, Cross-site scripting (XSS), Cross-site request forgery (CSRF), Directory traversal attacks, File inclusion vulnerabilities, Command injection, Server-side request forgery (SSRF), XML external entity (XXE) attacks, Insecure deserialization, Authentication bypass techniques, Session hijacking, Cookie manipulation, API security testing, REST API vulnerabilities, GraphQL security issues, API authentication attacks, Rate limiting bypass, Cloud penetration testing, Container escape attacks, Metadata service attacks, IAM misconfiguration exploitation, S3 bucket misconfiguration, Azure security testing, AWS security testing, Kubernetes security attacks, Serverless function attacks, AI system attack vectors, Prompt injection attacks, Model manipulation attacks, AI data poisoning, Adversarial machine learning, IoT penetration testing, Embedded device attacks, Firmware analysis, Hardware hacking basics, Metasploit framework, Cobalt Strike basics, Empire framework, SQLmap usage, Hydra password cracking, John the Ripper, Hashcat password cracking, Responder tool, Impacket toolkit, BloodHound for AD

Test mode:
Start practice test
PenTest+ - Attacks and Exploits Example Questions

Test your knowledge of Attacks and Exploits

Question 1

What does the --format flag specify when executing John the Ripper against a hash file?

Correct Answer: The hash algorithm type that John the Ripper should use to interpret and process the target hashes

The --format flag in John the Ripper specifies the hash algorithm type that should be used to interpret and process the target hashes. This is a critical parameter because John the Ripper supports hundreds of different hash formats, and it needs to know which specific hashing algorithm was used to create the hashes you're trying to crack.

When you specify the format (for example, --format=raw-md5 or --format=NT), you're telling John the Ripper exactly how to attempt to crack those hashes by using the appropriate algorithm for comparison. Without the correct format specification, John the Ripper either won't be able to crack the hashes at all or will use automatic detection, which may not always be accurate.

The other options are incorrect because:

The --format flag does not control how cracked passwords are displayed in the terminal or exported to files. John the Ripper has separate options and mechanisms for controlling output formatting.

The flag does not specify character encoding for wordlist dictionaries. Character encoding for input files is handled differently and is not the primary purpose of the --format parameter.

While the --format flag does specify the hash algorithm type, it typically doesn't require you to manually specify iteration counts and salt positions as separate components of the format parameter. These technical details are usually built into the format specification itself when you select a particular format type. Some advanced formats may have variations that account for different implementations, but this is handled by choosing the appropriate pre-defined format name rather than manually configuring these parameters.

Question 2

What is the default communication port used by Empire's HTTP listener when establishing initial agent connectivity?

Correct Answer: Port 80 for HTTP traffic

The correct answer is Port 80 for HTTP traffic.

Empire is a post-exploitation framework commonly used in penetration testing and red team operations. When setting up an HTTP listener in Empire for initial agent connectivity, the default communication port is Port 80, which is the standard port for HTTP traffic.

This default configuration allows the C2 (Command and Control) traffic to blend in with normal web browsing activity, making it less suspicious and more likely to pass through firewalls and security controls that typically allow outbound HTTP traffic on port 80.

Why the other answers are incorrect:

Port 443 is indeed used for HTTPS traffic and can be configured in Empire for encrypted communications, but it is not the default port for the HTTP listener. Empire does support HTTPS listeners, but the question specifically asks about the HTTP listener's default port.

Port 8080 is commonly used as an alternative HTTP port or for proxy services, but it is not Empire's default HTTP listener port. While port 8080 can be configured manually, it would stand out more in network traffic analysis as it's not a standard web browsing port.

Port 5985 is the default port for Windows Remote Management (WinRM) over HTTP, which is an entirely different protocol and service. While WinRM can be used in post-exploitation scenarios, it is not related to Empire's HTTP listener configuration.

Question 3

Which character sequence is commonly used in directory traversal attacks to reference the parent directory in file path manipulation?

Correct Answer: ../ (dot dot slash)

The correct answer is '../ (dot dot slash)'.

Directory traversal attacks (also known as path traversal attacks) exploit insufficient security validation of user-supplied file names. The fundamental character sequence used in these attacks is '../' which represents the parent directory in file system navigation.

When an attacker uses '../', they are instructing the system to move up one directory level in the file system hierarchy. By chaining multiple instances of this sequence (like ../../ or ../../../), attackers can navigate multiple levels up the directory tree to access files outside the intended directory scope.

For example, if a web application expects files from '/var/www/files/' and doesn't properly validate input, an attacker could use '../../../etc/passwd' to attempt to access the system's password file.

The '../' sequence is the core building block of directory traversal attacks and is the most commonly recognized pattern security professionals look for when testing for this vulnerability.

Regarding the other options:

The double dot dot slash sequence is simply a chained version of the basic '../' pattern - while it is used in directory traversal attacks, it's not the fundamental character sequence itself, just a repetition of it.

The single dot slash ('./' ) represents the current directory, not the parent directory, so it doesn't enable traversal up the directory tree, which is necessary for this type of attack.

The tilde slash ('~/' ) is a Unix/Linux shortcut that represents a user's home directory, not a parent directory reference, and is not the primary character sequence used in directory traversal attacks.

More Attacks and Exploits questions
2217 questions (total)
Start 100 question test