PT0-003 試験問題を無料オンラインアクセス

A penetration tester conducts a web application test and wants to enumerate the file folder structure https://testsite.com. Which of the following is the correct command?

• A.wfuzz -c -w common.txt -u https://testsite.com/index.php -H "Cookie;session=FUZZ"
• B.wfuzz -c -w common.txt -u https://testsite.com?FUZZ=test
• C.wfuzz -c -w common.txt -u https://testsite.com/FUZZ
• D.wfuzz -c -w common.txt -u https://testsite.com/index.php -d "username=admin&password=FUZZ"

While running a social engineering campaign, a penetration tester gets a list of employees from social media and now wants to conduct a phishing exercise. Which of the following should the tester use first?

• A.Wayback Machine
• B.SpiderFoot
• C.Social Engineering Toolkit
• D.Hunter.io

A penetration tester gains access to a chrooted environment and runs service --status-all on a target host. The tester reviews the following output:
[ + ] cron
[ + ] dhcp
[ - ] tomcat
[ - ] xserver
[ + ] ssh
The only other commands that the tester can execute are ps, nc, tcpdump, and crontab.
Which of the following is the best method to maintain persistence?

• A.Validate write access to crontaband add a reverse shell.
• B.Capture credentials to use with tcpdump.
• C.Scan the X11 server from the outside for unauthenticated connectivity.
• D.Check access to the tomcatdefault manager page and use an LFI payload.

SIMULATION 6
A penetration tester performs several Nmap scans against the web application for a client.
INSTRUCTIONS
Click on the WAF and servers to review the results of the Nmap scans. Then click on each tab to select the appropriate vulnerability and remediation options.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

正解：

Most likely vulnerability: Perform a SSRF attack against App01.example.com from CDN.example.com.
The scenario suggests that the CDN network (with a WAF) can be used to perform a Server-Side Request Forgery (SSRF) attack. Since the penetration tester has the pentester workstation interacting through the CDN/WAF and the production network is behind it, the most plausible attack vector is to exploit SSRF to interact with the internal services like App01.example.com.
Two best remediation options:
Restrict direct communications to App01.example.com to only approved components.
Require an additional authentication header value between CDN.example.com and App01.example.com.
Restrict direct communications to App01.example.com to only approved components: This limits the exposure of the application server by ensuring that only specified, trusted entities can communicate with it.
Require an additional authentication header value between CDN.example.com and App01.example.com: Adding an authentication layer between the CDN and the app server helps ensure that requests are legitimate and originate from trusted sources, mitigating SSRF and other indirect attack vectors.
Nmap Scan Observations:
CDN/WAF shows open ports for HTTP and HTTPS but filtered for MySQL, indicating it acts as a filtering layer.
App Server has open ports for HTTP, HTTPS, and filtered for MySQL.
DB Server has all ports filtered, typical for a database server that should not be directly accessible.
These findings align with the SSRF vulnerability and the appropriate remediation steps to enhance the security of internal communications.

While conducting an assessment, a penetration tester identifies the details for several unreleased products announced at a company-wide meeting. Which of the following attacks did the tester most likely use to discover this information?

• A.Credential harvesting
• B.Eavesdropping
• C.SQL injection attack
• D.Bluesnarfing