Network Exploitation Quiz

Q1. `ssh -L 8080:10.0.0.5:80 user@pivot` is:

Remote forwarding X11 forwarding Dynamic forwarding Local port forwarding to reach an internal service via the pivot

Q2. `-Pn` tells nmap to:

Use decoys Scan only privileged ports Do an aggressive OS scan Skip host discovery and treat the host as up

Q3. BlueKeep (CVE-2019-0708) is a wormable RCE vulnerability in:

Telnet SNMP RDP (Remote Desktop) SMB

Q4. `nmap -D` decoys and packet fragmentation are used to:

Enumerate SMB Evade IDS/firewall detection by obscuring the real scanner Crack hashes Speed up scans

Q5. Which set of legacy protocols exposes credentials in cleartext to a sniffer?

TLS, IPsec SSH, HTTPS, SMB3 Telnet, FTP, HTTP, SNMPv1 Kerberos, LDAPS

Q6. Hydra is typically used to:

Sniff packets Perform DNS AXFR Brute-force or spray credentials against network services (SSH, RDP, SMB, FTP) Exploit SMBv1

Q7. ARP spoofing on a LAN primarily enables:

Port scanning A man-in-the-middle position to intercept/alter traffic DNS zone transfer Password cracking

Q8. An NFS export with 'no_root_squash' is dangerous because a remote root user can:

Only read files Crash the server Write files owned by root on the share (e.g., a SUID binary for local privesc) Change the export

Q9. enum4linux or a null SMB session is used to:

Relay Kerberos Crack SMB passwords Enumerate users, groups and shares without credentials where anonymous access is allowed Encrypt shares

Q10. A classic default SNMP community string to try first is:

admin guest root public

Q11. SMTP VRFY and EXPN commands can be abused to:

Restart the server Read email Enumerate valid usernames/mailboxes Send spam only

Q12. A misconfigured DNS server allowing a zone transfer (AXFR) lets an attacker:

Poison the cache Dump all DNS records for the domain at once Spoof MAC addresses Take over the domain

Q13. proxychains is used together with a SOCKS proxy to:

Force other command-line tools' traffic through a pivot Spoof ARP Sniff Wi-Fi Crack passwords

Q14. Tools like chisel and ligolo-ng are used to:

Tunnel/pivot traffic through a compromised host (often over HTTP/S) Fuzz web apps Dump LSASS Brute-force RDP

Q15. In Metasploit, `autoroute` (with a Meterpreter session) is used to:

Generate payloads Auto-exploit every host Route traffic to a newly reachable subnet through the compromised host (pivot) Crack passwords