PT0-003: CompTIA PenTest+Demo

Encoding data and exfiltrating it through DNS tunneling can evade many DLP controls because DNS is often permitted and receives less content inspection than common file-transfer, cloud-storage, or email channels. The encoding also reduces direct matching against sensitive-data patterns.

A wireless adapter must operate in monitor mode to passively capture the raw 802.11 frames needed to obtain a WPA2 handshake. The Aircrack-ng suite’s airmon-ng utility enables monitor mode on a wireless interface.

Dnsenum is a DNS-enumeration tool that discovers DNS records, subdomains, name servers, and associated IP addresses for a target domain.

BITSAdmin can create upload jobs that transfer a local file to a server, making it suitable for data exfiltration. Microsoft documents the /UPLOAD job type for bitsadmin /transfer.

Penetration-test cleanup requires securely deleting locally retained sensitive patient data before the engagement is closed. Encryption and hashing do not remove the risk or responsibility associated with retaining patient data.

Runlevel startup scripts in /etc/rc5.d are executed when the system enters runlevel 5. Editing an SSH-related script there can make a service or command start automatically, maintaining access across reboots.

Trivy scans container images and related artifacts for known vulnerabilities and configuration issues, making it well suited to assessing container environments.

snmpwalk performs SNMP GETNEXT queries to enumerate a target's exposed management-information subtree. Using SNMPv2c with the public community string manually checks whether the reported SNMP service is reachable and permits the expected information disclosure, thereby validating the scanner result and eliminating false positives.

The TLS 1.2 cipher suites use ECDHE key exchange. Ephemeral Diffie-Hellman key exchange provides forward secrecy, so compromise of the server’s long-term private key does not decrypt previously recorded sessions.

Physical penetration testing should start with reconnaissance. Surveillance of the office reveals foot-traffic patterns, routines, and potential entry opportunities while minimizing the chance of detection.

sudo -l identifies permitted privileged commands; route reveals network routing; netstat -a enumerates listening services and network connections; and last plus who identify historical and current user sessions. This is host and network enumeration to identify users, exposed services, and potential additional targets.

Maltego integrates disparate data sources through Transforms, merges related information into a graph, and supports graphical link analysis. This makes it suitable for consolidating and analyzing intelligence gathered from multiple reconnaissance platforms.

AWS STS GetCallerIdentity is a minimal identity and credential-validation operation that returns the caller’s identity without listing compute resources or testing permissions against a compute-service operation. AWS records authenticated STS API activity in CloudTrail, but this call is generally less indicative of cloud-resource discovery than resource-listing calls or an EC2 dry-run authorization probe.

Enumerating /etc/passwd identifies local user accounts, netstat -tulr reveals listening network services and routing information, and /etc/bash.bashrc exposes system-wide Bash startup configuration. Together, these collect broader account, network, and configuration data than the other choices.

Channel scanning identifies the wireless radio channels used in an environment, which is necessary for assessing whether those communications could be affected or disrupted through channel-specific wireless interference.

Domain Name System (DNS) tunneling encodes data within DNS queries or responses and can use routinely allowed DNS traffic to pass data out of a network covertly.

SearchSploit searches the Exploit-DB database for known public exploits associated with discovered software, services, and version numbers. It can quickly identify potential exploits for the enumerated Apache httpd, MySQL, and lighttpd services.

A backdoor provides persistent access to the host and can leave the environment exposed after authorized testing ends. It must be removed as part of post-engagement cleanup.

Bypassing targets weaknesses in an electronic access-control system or its installation to circumvent the locking control and obtain entry. Lock picking applies to mechanical locks; impersonation and tailgating depend on an authorized person; and jamming primarily causes interference rather than reliably granting access. OWASP’s physical-interface testing guidance specifically calls for determining whether implemented authorization checks can be bypassed.

Peer review adds an independent validation of vulnerability-scan results and reporting, helping identify errors, false positives, omissions, and unclear findings before the report is issued.

Preserving artifacts retains the penetration test’s collected evidence, logs, findings, and other outputs before cleanup or restoration removes them.

Credentialed scanning of a Windows domain controller requires full administrative privileges to access the registry, administrative shares, and other protected system information. A domain administrator account provides the required privileges; vendor guidance specifically limits scans of domain controllers to Domain Administrator accounts.

OAuth/OpenID Connect authentication relies on redirect-based authorization flows that can expose or permit misuse of authorization codes and access tokens if redirect URI validation, state/nonce binding, PKCE, or token replay protections are weak. Dynamic registration expands this flow-facing attack surface by allowing client metadata, including redirect URIs, to be registered. OAuth security guidance specifically addresses authorization-code and access-token replay risks and requires protections for redirect-based flows.

Eavesdropping is the unauthorized listening to or interception of communications, such as information discussed during a company-wide meeting. It can expose confidential business details without requiring access to credentials, Bluetooth devices, or a database.