A penetration tester wants to perform a stealthy TCP port scan that does not complete the three-way handshake. Which Nmap scan type should be used?
Reconnaissance Scanning
Question · Easy
Which Nmap option enables OS fingerprinting based on TCP/IP stack behavior?
You need to enumerate SMB shares on a Windows host without authentication. Which command is most appropriate?
Tech Exam Prep Podcast
Listen on Spotify
Podcast
Which tool is specifically designed to enumerate Windows hosts via SMB null sessions, returning users, groups, shares, and password policy?
You want to perform a DNS zone transfer against ns1.example.com for the domain example.com. Which command is correct?
Question · Medium
Which tool is best known for brute-forcing DNS subdomains using a wordlist and detecting wildcard records?
Which Nmap NSE script category runs scripts that may crash a vulnerable service or be considered intrusive?
You suspect SNMP is running on UDP/161 with the default community string. Which command enumerates the entire MIB tree using snmpwalk v2c with community 'public'?
Which command grabs the HTTP banner of a web server using netcat?
Which Nmap flag combines OS detection, version detection, default scripts, and traceroute in one option?
Which NSE script attempts to detect Windows machines vulnerable to MS17-010 (EternalBlue)?
While performing reconnaissance you find an open TCP/445 port. Which protocol is most commonly running on this port?
Which tool maps share-level permissions across multiple hosts and is often used after enum4linux to identify writable shares?
Which rpcclient command lists user accounts on a Windows host over a SMB null session?
Question · Hard
Which Nmap technique fragments TCP packets to evade simple stateless firewalls and IDS signatures?
What does the Nmap option --top-ports 100 do?
Which command-line tool checks a target's web server for known vulnerabilities and misconfigurations using a signature database?
Which Nmap option specifies a list of decoy IP addresses to obscure the true source of a scan?
Which technique discovers live hosts on a /24 without sending TCP/UDP probes by relying on ARP requests on the local segment?
Which open-source intelligence (OSINT) search engine indexes Internet-facing devices and can identify exposed industrial control systems and IoT devices by banner?
After gaining a low-privileged shell on a Linux host, which script automates checks for kernel exploits, SUID binaries, sudo misconfigurations, and writable services?
System Hacking Malware
Which Mimikatz command extracts plaintext credentials, NTLM hashes, and Kerberos tickets from LSASS memory?
You captured an NTLMv2 hash with Responder. Which hashcat mode is correct for cracking it?
Which Metasploit command searches for modules related to a specific CVE?
Within a Meterpreter session on Windows, which command attempts to elevate privileges using a known UAC bypass module?
Which Meterpreter command migrates the running session into another process to maintain stability if the original process is killed?
Which technique uses a captured NTLM hash to authenticate to remote SMB services without first cracking the password?
Which Linux SUID binary, if marked SUID-root, can be abused to spawn a root shell using `find . -exec /bin/sh -p \; -quit`?
Which tool hides a secret message inside a JPEG image using a passphrase-encrypted payload?
Which tool inspects firmware images to find embedded file systems (squashfs, JFFS2) and binaries useful for IoT analysis?
Which msfvenom command generates a 64-bit Windows reverse-TCP Meterpreter executable?
What does the John the Ripper option `--wordlist=/usr/share/wordlists/rockyou.txt --rules` do?
Which hashcat mode cracks Linux /etc/shadow entries that begin with $6$?
Which Windows tool, often dropped by post-exploitation frameworks, dumps cached domain credentials and Local Security Authority secrets?
Which class of malware is specifically designed to spread autonomously across networks without requiring user execution?
On Windows, which scheduled-task command line creates a persistence task that runs at user logon?
Which post-exploitation tool maps Active Directory attack paths by ingesting collected SharpHound data and rendering them as a Neo4j graph?
Which file's contents are extracted by Mimikatz's lsadump::sam command on a live Windows host?
Which Linux capability, when set on a binary, allows it to read files regardless of file permissions and is commonly abused for privesc?
Which Windows utility is built into the OS and is commonly abused for living-off-the-land download of malicious payloads?
Which Wireshark display filter shows only HTTP traffic to or from 10.10.10.5?
Network Perimeter Hacking
Which tcpdump expression captures only DNS traffic to/from a host called dns1?
Which tool performs ARP spoofing to reroute traffic between a target and the gateway in a Linux environment?
Which DoS technique slowly opens many partial HTTP connections and never finishes the headers, exhausting the web server's connection pool?
Which hping3 command sends a TCP SYN flood to 10.10.10.5 on port 80 with random source IPs?
What is the goal of CAM table flooding (using a tool like macof)?
Which IDS evasion technique encodes URI characters (e.g., %2e%2e%2f for ../) to bypass signature matching for path traversal?
Loading more…