Q. Which type of Linux kernel exploits is most likely to be useful to penetration testers?

View solution

Q. What is a common opportunity for penetration testers regarding Linux kernel patches?

View solution

Q. How can penetration testers quickly check a Linux system for potential kernel issues?

View solution

Q. Why is it essential for penetration testers to know common attack and exploit techniques for Windows systems?

View solution

Q. What is a common method for harvesting credentials from Windows systems?

View solution

Q. What type of authentication hashes does Windows frequently rely on for authentication purposes?

View solution

Q. What is a characteristic of NTLM hashes used in Windows for authentication?

View solution

Q. How do pass-the-hash attacks work in the context of Windows systems?

View solution

Q. What Registry location contains the password of the logged-in user in an encrypted form on Windows systems?

View solution

Q. How can the encrypted password and encryption key be recovered from the LSA secrets Registry location?

View solution

Q. What information does the Windows Security Accounts Manager (SAM) database contain?

View solution

Q. How can password hashes be dumped from the SAM database on Windows systems?

View solution

Q. What is a common requirement for executing processes like dumping the SAM database?

View solution

Q. What module in Metasploit lists missing patches on Windows systems?

View solution

Q. When are Windows kernel exploits most useful for penetration testers?

View solution

Q. What type of flaws work on almost all systems, regardless of the operating system or application?

View solution

Q. What is a common focus of exploits that work on multi-platform applications?

View solution

Q. What Sysinternals tools can provide easy-to-review reports for reviewing filesystem permissions in Windows?

View solution

Q. Where does PuTTY store proxy credentials in cleartext on Windows systems?

View solution

Q. What type of tools may store passwords on the local system, making them potential targets for credential retrieval?

View solution