eJPT Vulnerability Assessment 4 — Questions and Answers
Question 1: Which command correctly runs Nmap with the vulnerability scan scripts against a target?
- nmap -sC -sV target
- nmap --script vuln target (Correct answer)
- nmap -O --exploit target
- nmap -p- -T5 --vuln target
Correct answer: nmap --script vuln target
The command 'nmap --script vuln target' loads all NSE scripts in the 'vuln' category to check for known vulnerabilities on the target.
Question 2: What type of vulnerability allows an attacker to inject OS commands through a web application input field?
- SQL Injection
- Command Injection (Correct answer)
- Cross-Site Scripting
- XML External Entity
Correct answer: Command Injection
Command Injection occurs when user-supplied input is passed unsanitized to a system shell, allowing attackers to execute arbitrary OS commands.
Question 3: During an assessment, you discover an FTP service allowing anonymous login. Why is this significant?
- Anonymous FTP always contains encrypted files
- It may expose sensitive files without requiring authentication (Correct answer)
- Anonymous FTP is required for compliance on all servers
- It indicates the server is running an outdated OS
Correct answer: It may expose sensitive files without requiring authentication
Anonymous FTP login allows anyone to access the FTP server without credentials, potentially exposing sensitive files or allowing unauthorized uploads.
Question 4: What is the purpose of the Metasploit 'db_nmap' command?
- Run Nmap scans and automatically import results into the Metasploit database (Correct answer)
- Download vulnerability databases from the internet
- Launch a DoS attack using Nmap timing templates
- Generate Nmap scan reports in PDF format
Correct answer: Run Nmap scans and automatically import results into the Metasploit database
The 'db_nmap' command runs Nmap from within Metasploit and automatically stores the scan results in the Metasploit PostgreSQL database for later use.
Question 5: Which vulnerability class is described as 'a flaw that allows attackers to redirect users to malicious sites via a trusted application'?
- SQL Injection
- Cross-Site Request Forgery
- Open Redirect (Correct answer)
- Directory Traversal
Correct answer: Open Redirect
Open Redirect vulnerabilities occur when a web application accepts user-controlled input to redirect users, enabling attackers to send victims to malicious sites.
Question 6: A vulnerability scanner reports a finding with 'Exploit Available: Yes'. What does this indicate?
- The vulnerability has been patched by the vendor
- A public working exploit exists, increasing the likelihood of attack (Correct answer)
- The scanner automatically exploited the vulnerability
- The vulnerability only exists in test environments
Correct answer: A public working exploit exists, increasing the likelihood of attack
When a scanner indicates an exploit is available, it means public exploit code exists (e.g., in Metasploit or Exploit-DB), significantly elevating the risk of the finding.
Question 7: What does 'patch management' aim to accomplish in the context of vulnerability remediation?
- Replace all legacy hardware with modern equipment
- Apply vendor-released fixes to close known vulnerabilities in software (Correct answer)
- Increase network monitoring frequency
- Enforce stronger password policies across systems
Correct answer: Apply vendor-released fixes to close known vulnerabilities in software
Patch management is the process of systematically applying software updates and security patches to fix known vulnerabilities identified during assessments.
eJPT Vulnerability Assessment 4
Which command correctly runs Nmap with the vulnerability scan scripts against a target?