Pass the CompTIA PenTest+ PT0-003 Questions and answers with CertsForce

WiFi-Pumpkin is used for man-in-the-middle (MitM) attacks on Wi-Fi networks, making it ideal for intercepting and accessing data.

Option A (Metasploit) ❌: Good for exploitation, but not specialized for Wi-Fi attacks.

Option B (WiFi-Pumpkin) ✅: Correct.

Creates fake Wi-Fi access points.

Intercepts network traffic (SSL stripping, DNS spoofing).

Option C (SET - Social Engineering Toolkit) ❌: Focuses on phishing, not Wi-Fi attacks.

Option D (theHarvester) ❌: Used for OSINT, not Wi-Fi exploitation.

Option E (WiGLE.net) ❌: Maps Wi-Fi networks, but does not capture sensitive data.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Wireless Attacks & Fake APs

PowerView is a PowerShell tool used for Active Directory enumeration. It is part of the PowerSploit framework and allows penetration testers to gather detailed information about the AD environment, including user accounts, groups, computers, shares, and trust relationships.

PowerView is most commonly used to:

Enumerate domain users, groups, and memberships

Identify privileged users and group memberships

Discover domain trusts and permissions

According to the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 8 – Post-Exploitation and Lateral Movement):

“PowerView is a post-exploitation tool used primarily for Active Directory reconnaissance, including user and group enumeration, identifying domain trusts, and mapping out the AD structure.”

To avoid locking out accounts while attempting access, the penetration tester should use credential stuffing.

Credential Stuffing:

Definition: An attack method where attackers use a list of known username and password pairs, typically obtained from previous data breaches, to gain unauthorized access to accounts.

Advantages: Unlike brute-force attacks, credential stuffing uses already known credentials, which reduces the number of attempts per account and minimizes the risk of triggering account lockout mechanisms.

Tool: Tools like Sentry MBA, Snipr, and others are commonly used for credential stuffing attacks.

Other Techniques:

MFA Fatigue: A social engineering tactic to exhaust users into accepting multi-factor authentication requests, not applicable for avoiding lockouts in this context.

Dictionary Attack: Similar to brute-force but uses a list of likely passwords; still risks lockout due to multiple attempts.

Brute-force Attack: Systematically attempts all possible password combinations, likely to trigger account lockouts due to high number of failed attempts.

Pentest References:

Password Attacks: Understanding different types of password attacks and their implications on account security.

Account Lockout Policies: Awareness of how lockout mechanisms work and strategies to avoid triggering them during penetration tests.

By using credential stuffing, the penetration tester can attempt to gain access using known credentials without triggering account lockout policies, ensuring a stealthier approach to password attacks.

======

Software Composition Analysis (SCA) is used to analyze dependencies in applications and identify vulnerable open-source libraries.

Option A (VM - Virtual Machine) ❌: A VM is a computing environment, not a vulnerability detection tool.

Option B (IAST - Interactive Application Security Testing) ❌: IAST analyzes runtime behavior, but it does not specialize in detecting vulnerable libraries.

Option C (DAST - Dynamic Application Security Testing) ❌: DAST scans running applications for vulnerabilities, but it does not analyze open-source libraries.

Option D (SCA - Software Composition Analysis) ✅: Correct.

Identifies security flaws in dependencies.

Used for managing supply chain risks.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Software Composition Analysis (SCA)

The tester is using Mimikatz to dump cached credentials from Local Security Authority (LSA) memory.

Pass-the-Hash (Option C):

The tester extracts cached credentials to authenticate without cracking passwords.

Pass-the-Hash (PtH) allows lateral movement by reusing the NTLM hash on other systems.

The vulnerability in question is XML External Entity (XXE) injection, which occurs when an application processes XML input containing external entities that access files on the server or external resources.

Disabling External Entities:

The root cause of the issue is the application ' s ability to process external entities ( < !ENTITY foo SYSTEM ... > ). Disabling external entities entirely prevents XXE attacks.

This can be achieved by properly configuring the XML parser (e.g., in Java, disable DocumentBuilderFactory.setFeature( " http://apache.org/xml/features/disallow-doctype-decl " , true)).

Why Not Other Options?

A (chmod o-rwx): File permission hardening may reduce the impact of a successful attack but does not mitigate XXE at the parser level.

B (Review logs): Reviewing logs is a reactive measure, not a prevention mechanism.

D (WAF): A WAF may block some malicious requests but is not a reliable mitigation for XXE vulnerabilities embedded in legitimate XML input.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

OWASP XXE Prevention Cheat Sheet

======

An increase in DNS traffic during a penetration test suggests data exfiltration using DNS tunneling, a method where attackers encode data into DNS queries to avoid detection.

Option A (Covert data exfiltration) ✅: Correct. DNS tunneling (e.g., dnscat2, Iodine) is a stealthy method to bypass firewalls and extract sensitive data.

Option B (URL spidering) ❌: Would cause increased web traffic, not DNS requests.

Option C (HTML scraping) ❌: Involves parsing web pages, not DNS traffic.

Option D (DoS attack) ❌: DoS floods bandwidth or servers, but does not increase DNS queries significantly.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – DNS Tunneling & Data Exfiltration

The missing do keyword is the reason for the syntax error. Bash for loops must include a do statement before executing commands within the loop.

Corrected script:

#!/bin/bash

for i in {1..254}; do

ping -c1 192.168.1.$i

done

From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 4 – Scanning and Enumeration):

“In Bash scripting, control structures like for-loops require correct syntax, including the ' do ' keyword for loop logic to execute properly.”

Lateral Movement with PsExec:

PsExec is a tool used for executing processes on remote systems.

The command enables the tester to execute cmd.exe on the target host (server01) to achieve lateral movement and potentially escalate privileges.

Why Not Other Options?

A: The command is not testing connectivity; it is executing a remote command.

C: PsExec does not send its binary; it executes commands on remote systems.

D: The command is not enabling cmd.exe; it is using it as a tool for executing commands remotely.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)