Pass the CompTIA PenTest+ PT0-003 Questions and answers with CertsForce

The tester is conducting a phishing attack by cloning the company's login page to steal employee credentials.

Option A (BeEF) ❌: BeEF is used for browser exploitation, not phishing.

Option B (theHarvester) ❌: Used for OSINT, gathering emails, but does not conduct phishing attacks.

Option C (SET - Social Engineering Toolkit) ✅: Correct.

SET allows testers to clone web pages and perform phishing attacks.

Option D (GoPhish) ❌: GoPhish is a phishing simulation tool, but SET is specifically designed for credential harvesting.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Social Engineering & Phishing Attacks

In network penetration testing, the initial steps involve gathering information to build an understanding of the network's structure, devices, and potential entry points. The process generally follows a structured approach, starting from broad discovery methods to more specific identification techniques. Here's a comprehensive breakdown of the steps:

Host Discovery (Answer: C):

Objective: Identify live hosts on the network.

Tools & Techniques:

Ping Sweep: Using tools like nmap with the -sn option (ping scan) to check for live hosts by sending ICMP Echo requests.

ARP Scan: Useful in local networks, arp-scan can help identify all devices on the local subnet by broadcasting ARP requests.

nmap -sn 192.168.1.0/24

 References:

The GoBox HTB write-up emphasizes the importance of identifying hosts before moving to service enumeration​​.

The Forge HTB write-up also highlights using Nmap for initial host discovery in its enumeration phase​​.

 Service Discovery (Option A):

Objective: After identifying live hosts, determine the services running on them.

Tools & Techniques:

Nmap: Often used with options like -sV for version detection to identify services.

nmap -sV 192.168.1.100

 References:

As seen in multiple write-ups (e.g., Anubis HTB and Bolt HTB), service discovery follows host identification to understand the services available for potential exploitation​​​​.

 OS Fingerprinting (Option B):

Objective: Determine the operating system of the identified hosts.

Tools & Techniques:

Nmap: With the -O option for OS detection.

nmap -O 192.168.1.100

 References:

Accurate OS fingerprinting helps tailor subsequent attacks and is often performed after host and service discovery, as highlighted in the write-ups​​.

 DNS Enumeration (Option D):

Objective: Identify DNS records and gather subdomains related to the target domain.

Tools & Techniques:

dnsenum, dnsrecon, and dig.

dnsenum example.com

Enabling monitoring mode on the wireless adapter is the essential step before capturing WPA2 handshakes. Monitoring mode allows the adapter to capture all wireless traffic in its vicinity, which is necessary for capturing handshakes.

Preparation:

Wireless USB Dongle: Ensure the wireless USB dongle is compatible with monitoring mode and packet injection.

Aircrack-ng Suite: Use the Aircrack-ng suite, a popular set of tools for wireless network auditing.

Enable Monitoring Mode:

Command: Use the airmon-ng tool to enable monitoring mode on the wireless interface.

Step-by-Step Explanationairmon-ng start wlan0

Verify: Check if the interface is in monitoring mode.

iwconfig

Capture WPA2 Handshakes:

Airodump-ng: Use airodump-ng to start capturing traffic and handshakes.

airodump-ng wlan0mon

References from Pentesting Literature:

Enabling monitoring mode is a fundamental step in wireless penetration testing, discussed in guides like "Penetration Testing - A Hands-on Introduction to Hacking".

HTB write-ups often start with enabling monitoring mode before proceeding with capturing WPA2 handshakes.

SearchSploit is a command-line interface for Exploit-DB that allows testers to quickly search for known exploits based on software name and version.

With Apache 2.2.3, lighttpd 1.4.32, and MySQL, the tester can plug these into SearchSploit to identify vulnerabilities, matching the goal of finding quick attack paths with limited time.

Other tools:

msfvenom: Payload generator, not a search tool.

sqlmap: SQLi exploitation tool, useful for web apps with SQLi, but requires validation of such a vuln first.

BeEF: Browser exploitation framework, not relevant here.

CompTIA PenTest+ Reference:

PT0-003 Objective 2.2 & 2.5: Exploit and identify attack paths.

SearchSploit and Exploit-DB usage are recommended tools in CompTIA’s resources.

The tester is attempting to register a malicious DLL as a server-level plugin to escalate privileges.

Privilege escalation (Option B):

The command uses dnscmd.exe, a legitimate Windows tool for managing DNS servers.

By setting a malicious DLL (adduser.dll) as a server-level plugin, attackers can gain SYSTEM-level privileges.

This technique is a DLL hijacking attack.