5. Exploiting Wired/Wireless Networks

Explanation: RHOST is the IP address of the target (remote) system and LHOST is the IP address of the local (attacker’s) system. Setting these parameters is essential because they determine where the attack is directed and where the victim system should communicate after the exploitation.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page pg in PDF)

Explanation: In MAC spoofing attacks, an attacker impersonates a MAC address of another device, typically a network infrastructure device like a router. They can spoof Layer 2 addresses to make victim devices believe that they are communicating with their default gateway when they are actually communicating with the attacker’s device. This allows the attacker to intercept traffic.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page N/A in PDF)

Explanation: A Preferred Network List (PNL) attack leverages a list of trusted or preferred wireless networks that a client would automatically connect to. The attacker impersonates these networks, causing clients to connect to the attacker’s device. This then allows the attacker to eavesdrop on or manipulate the client’s communications.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 81 in PDF)

Explanation: In the context of the Metasploit exploit demonstrated, RHOST is used to configure the IP address of the victim system.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: A Rogue Access Point is an unauthorized wireless access point installed on a network. It is most likely installed by an attacker to create a backdoor, and divert users to unwanted locations or to bypass security controls. It has the potential to fool users into connecting to it, creating potential vulnerabilities and exploits.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: An attacker can recover the PSK by collecting a sufficient amount of data from wireless traffic in the air. The IVs are sent in plaintext when a wireless infrastructure device is configured with WEP. This, combined with the predictable length of ARP packets, allows an attacker to recover the PSK much faster.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 73 in PDF)

Explanation: TCP port 465 is registered by the Internet Assigned Numbers Authority (IANA) for SMTP over SSL (SMTPS). However, SMTPS has been deprecated in favor of STARTTLS.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The VRFY command is used to verify whether a user’s email mailbox exists.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page page in PDF)

Explanation: VRFY stands for verify, and in the context of SMTP commands, it is used to verify whether a user’s email mailbox exists.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: TCP port 587 is designated for use with the Secure SMTP (SSMTP) protocol for encrypted communications, as defined in RFC 2487. This protocol employs STARTTLS for security. It’s used by Mail User Agents for email submission.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 47 in PDF)

Explanation: SMTP open relay refers to an email server that accepts and relays (that is, sends) emails from any user. This can be exploited for spamming, phishing and other email related scams.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page N/A in PDF)

Explanation: EternalBlue is an exploit that when successful, allows an unauthenticated remote attacker to compromise a vulnerable system and execute arbitrary code. It has been used in multiple ransomware attacks such as WannaCry and Nyeta.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 123 in PDF)

Explanation: A pass-the-hash attack involves using a password hash obtained from a compromised system to gain access to another client or server system, based on the fact that password hashes can’t be reversed to reveal the actual password. The attacker therefore directly employs the hash for authentication.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page Not in PDF)

Explanation: After locating the network, an attacker can use the ’aireplay-ng’ command to perform a deauthentication attack against the wireless network. This step is crucial in capturing the WPA four-way handshake for later attempt to brute-force the WPA PSK.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5-22 in PDF)

Explanation: A common vulnerability in the Link-Local Multicast Name Resolution (LLMNR) protocol is that an attacker can spoof an authoritative source for name resolution on a victim’s system by responding to LLMNR traffic. The attacker can essentially poison the LLMNR service and manipulate the victim’s system.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 41 in PDF)

Explanation: Most implementations of WPS do not limit the number of incorrect PIN attempts that a user can make. This allows malicious actors to conduct brute-force attacks by attempting many PIN combinations in succession until the correct one is found.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The STARTTLS command is used within the SMTP protocol to upgrade an existing plaintext connection to an encrypted (TLS or SSL) connection.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page unknown in PDF)

Explanation: Post Office Protocol version 3 (POP3) utilizes TCP port 995 for encrypted communications, providing a safe protocol for mail delivery from the server to the client.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 10 in PDF)

Explanation: The ’searchsploit’ command is used to search for known exploits that can be leveraged against vulnerabilities in a system. As shown in the example, ’searchsploit smtp’ will list known SMTP-related exploits.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: In an evil twin attack, the attacker creates a rogue access point and configures it to appear exactly like the existing corporate network. The users are then typically redirected to a cloned captive portal or a website with the help of DNS spoofing.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 50 in PDF)

Explanation: Aireplay-ng, part of the Aircrack-ng suite is the tool described in the provided text used to launch deauthentication attacks. This can be seen with the line ’The bottom terminal window in Figure 5-18 shows the launch of a deauthentication attack using the Aireplay-ng utility.’

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 55 in PDF)

Explanation: An amplification attack is a form of DDoS attack where the attacker sends smaller packets and in response, huge packets are sent back by the unwitting participant such as an open DNS resolver. The victim’s system thus receives packets much larger than what was initially sent thereby causing it to flood and potentially affecting the system or network.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 105 in PDF)

Explanation: The VRFY command in SMTP is used to verify whether a user’s email mailbox exists on the email server.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: In the attack process described, the attacker uses Airmon-ng to start the wireless interface in monitoring mode. This is the first step, which enables the attacker to observe and capture packets from the wireless network for further exploitation.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5-21 in PDF)

Explanation: As the passage explains, an attacker can potentially spoof an authorized MAC address and then bypass a Network Access Control (NAC) configuration, allowing unauthorized access to the network.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: Exploit chaining refers to the practice of leveraging multiple vulnerabilities in sequence against a single system to achieve a compromise.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: RFID cloning refers to the process by which an RFID tag is replicated or duplicated. The copied tag can then be used for unauthorized access to buildings or specific rooms.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 60 in PDF)

Explanation: WPA is not susceptible to the IV attacks that affect WEP; However, it is susceptible to handshake capture and subsequent brute-force attacks on its Pre-Shared Key (PSK). An attacker can capture the four-way handshake between a client and a wireless device and then, using a tool such as Aircrack-ng and a wordlist, can perform the attack.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The WPA3 protocol introduced a new handshake called the “dragonfly handshake” that uses Extensible Authentication Protocol (EAP) for authentication.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page N/A in PDF)

Explanation: WPA and WPA2 allow the WPA four-way handshake between a client and a wireless infrastructure device to be captured. An attacker can then brute-force the WPA Pre-shared Key (PSK). This vulnerability has been addressed in WPA3.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: Airodump-ng, which is a part of the Aircrack-ng suite, is a tool that is used for packet capturing in 802.11 wireless networks. It is capable of capturing and analyzing wireless network traffic.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 61 in PDF)

Explanation: TCP port 25 is the default port used in SMTP for non-encrypted communications.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: A common vulnerability in LLMNR involves an attacker spoofing an authoritative source for name resolution on a victim’s system by responding to LLMNR traffic over UDP port 5355 and NBT-NS traffic over UDP port 137. The attacker can basically poison the LLMNR service to manipulate the victim’s system.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 67 in PDF)

Explanation: The EternalBlue exploit, when successfully executed, allows an unauthenticated remote attacker to compromise the targeted system and execute arbitrary code. This exploit is popular in ransomware and has been ported to different tools, including Metasploit.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 59-60 in PDF)

Explanation: Dynamic Address Resolution Protocol (ARP) Inspection (DAI) is a mitigation method commonly used to prevent ARP cache poisoning attacks, which occur when an attacker spoofs MAC addresses to intercept traffic.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 64 in PDF)

Explanation: NetBIOS Name Service uses UDP port 137, making it the correct answer. NetBIOS Name Service is used for name registration and resolution.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 365 in PDF)

Explanation: The PRGA (pseudo-random generation algorithm) elements acquired through wireless fragmentation attacks are not used to recover the WEP key, but to generate packets with tools like Packetforgeng, part of the Aircrack-ng suite. These packets can then be used to perform wireless injection attacks.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: One of the vulnerabilities in LLMNR is that an attacker can spoof an authoritative source for name resolution on a victim system by responding to LLMNR traffic over UDP port 5355 and NBT-NS traffic over UDP port 137. The attacker poisons the LLMNR service to manipulate the system. If the requested host belongs to a resource that requires identification or authentication, the username and NTLMv2 hash are sent to the attacker. The attacker can gather the hash sent over the network and then crack the hashes offline to get the plaintext passwords.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 25 in PDF)

Explanation: The ’set RHOST’ command is used to set the remote system you want to exploit, and the ’set LHOST’ command is used to set the IP address that the victim should communicate with after the exploit executes.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 37 in PDF)

Explanation: The passage states that attackers can silently steal RFID information (such as a badge or a tag) with an RFID reader like the Proxmark3 just by walking near an individual or a tag. This is how they are able to clone RFID badges to gain entry into secure areas.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The AUTH command is used to authenticate a client to the server in SMTP protocols.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: By launching a disassociation attack, the attacker can attempt to disconnect the user from the authenticating wireless AP and then carries out another attack to obtain the user’s valid credentials. This process involves forcing the deauthenticated clients to connect to a deceptively similar malicious access point known as an evil twin.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page NA in PDF)

Explanation: In a KARMA attack, the attacker creates a rogue Access Point (AP) and listens for the probe requests sent by wireless devices. They then intercept these requests and generate the same SSID (Service Set Identifier) for which the device is sending probes, allowing them to intercept wireless traffic.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 61 in PDF)

Explanation: In Step 2, the attacker utilizes the airodump-ng command to capture all traffic on the wireless network to a file named wpa_capture. They also specify certain parameters, such as the wireless channel, the BSSID, and the wireless interface.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page n/a in PDF)

Explanation: ARP cache poisoning is also commonly known as ARP spoofing. In this type of attack, an attacker targets hosts, switches, and routers connected to a Layer 2 network by poisoning the ARP caches of system connected to the subnet and intercepting traffic intended for other hosts on the subnet.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: TCP port 139 is used for NetBIOS Session Service for connection-oriented communication as stated in the provided text.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 33 in PDF)

Explanation: STARTTLS is used to start a Transport Layer Security (TLS) connection to an email server during an SMTP conversation.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 55 in PDF)

Explanation: TCP port 25 is the default port used in SMTP (Server Message Block Protocol) for non-encrypted communications.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 37 in PDF)

Explanation: The text points out that WEP (Wired Equivalent Privacy) is particularly susceptible to many different attacks, including those that involve modifications of the Initialization Vector (IV). An attacker may manipulate the IV of an encrypted wireless packet during its transmission in order to obtain information about the plaintext of a single packet, and this information can potentially be used to generate another encryption key.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 23 in PDF)

Explanation: In SMTP commands, STARTTLS is used to initiate a Transport Layer Security (TLS) connection to an email server. TLS is a protocol that provides privacy and data integrity between two communicating computer applications.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: A Kerberos implementation contains three basic elements: client, server, and key distribution center (KDC), including the authentication server and the ticket-granting server. While the server behavior may be important in Kerberos authentication, it is not defined as a basic element of a Kerberos implementation.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: In a DHCP starvation attack, an attacker broadcasts a large number of DHCP REQUEST messages with spoofed source MAC addresses. This causes the DHCP server to consume all IP addresses in its scope responding to these spoofed requests, leaving no addresses to assign to genuine network clients.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: A BGP (Border Gateway Protocol) hijacking is achieved by an attacker configuring or compromising an edge router to announce prefixes that have not been assigned to his/her organization. This can cause the traffic to be redirected to the attacker if the malicious announcement presents a more specific route than the legitimate announcement or offers a shorter path.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 23 in PDF)

Explanation: From the information provided, Bluejacking is effectively Bluetooth ’spam’, sending unsolicited messages often including a contact card (vCard) to devices. Bluesnarfing, however, provides unauthorized access to information on the victim’s device such as calendars, contact lists, emails and text messages, photos, or videos.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 38 in PDF)

Explanation: A double-tagging VLAN hopping attack involves the use of two VLAN tags; an outer tag with the attacker’s VLAN and an inner tag of the victim’s VLAN. Most switches configured for 802.1Q remove only one 802.1Q tag so when the double-tagged frame reaches the switch, it only processes the outer tag of the VLAN that the ingress interface belongs to.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page Page in PDF)

Explanation: The ’set RHOST’ command is used to configure the IP address of the remote host (RHOST) that is going to be exploited by the EternalBlue exploit in Metasploit.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: Kerberoasting is a post-exploitation activity that is used by an attacker to extract service account credential hashes from Active Directory for offline cracking. It exploits weaknesses in encryption implementations and improper password practices, allowing the threat actor to extract service account credential hashes without sending any IP packets to the victim and without needing domain admin credentials.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The STARTTLS command is an SMTP command used to start a Transport Layer Security (TLS) connection to an email server during a security evaluation. This enables encryption, adding a layer of security to the email transmission process.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: A SYN flood attack, in the context of DoS attacks, refers to the practice of attackers sending multiple TCP SYN packets to a victim’s web server with the aim of either oversaturating their connection bandwidth or depleting their system resources. It’s a direct form of DoS attack.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: Dynamic Address Resolution Protocol (ARP) Inspection (DAI) is a security feature that validates ARP packets in a network. DAI intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. This capability can help to prevent ARP cache poisoning attacks.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 56 in PDF)

Explanation: War driving is indeed a method attackers use to find wireless access points by just driving (or walking) around. It allows the attacker to gain a significant amount of information over a very short period of time.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 123 in PDF)

Explanation: While Buffer Overflow attacks are a common type of cybersecurity attack, they are not listed as a network-based attack or exploit in the provided text.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: A common vulnerability in SNMP implementation is the leaving of weak or default SNMP credentials in networking devices. Security can significantly improve by changing these default passwords and limiting SNMP access to only trusted hosts.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: A disassociation or deauthentication attack is carried out by an attacker to cause legitimate wireless clients to deauthenticate from legitimate wireless access points (APs) or wireless routers, creating a Denial of Service (DoS) condition.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: In a Downgrade Attack, the intruder manipulates the system into using an outdated or flawed encryption protocol or hashing algorithm. The manipulated system then becomes vulnerable to other attacks because of the inherent weaknesses of the chosen algorithm or protocol.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: Jamming wireless signals or causing wireless network interference is meant to create a full or partial DoS (Denial of Service) condition in the wireless network. This condition disrupts the normal functioning of the network.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 123 in PDF)

Explanation: Successful exploitation of the KRACK vulnerabilities allows unauthenticated attackers to reinstall a previously used encryption or integrity key. With the reinstalled key, the attacker can capture and attempt to decrypt network traffic, or forge or replay previously seen traffic.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 24 in PDF)

Explanation: The correct order to exploit WPA and WPA2 vulnerabilities using the Aircrack-ng suite of tools involves five basic steps: starting the wireless interface in monitoring mode using Airmon-ng, locating the network, capturing traffic using the airodump-ng command, performing a deauthentication attack using the aireplay-ng command, and finally, cracking the WPA PSK using the aircrack-ng command.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: Nmap is used to scan network devices and determine their types, versions, and other identifying attributes. In the text, Example 5-11 uses Nmap to ascertain the version and type of the FTP server – in this case, vsftpd version 3.0.3.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: TCP port 993 is the default port used by the IMAP protocol for encrypted (SSL/TLS) communications. It facilitates secure communications for this specific email protocol.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: NETCONF is a modern and more secure protocol compared to SNMP. It is especially beneficial for newer infrastructure devices, such as routers and switches.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: In a DNS cache poisoning attack, one of the primary steps is for the attacker to corrupt the data of the DNS server cache to impersonate a particular website. This manipulation forces the DNS server to redirect the victim to the attacker’s system. In this case, the attacker is impersonating the website ’theartofhacking.org’.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: STARTTLS command is used to start a Transport Layer Security (TLS) connection to an email server. It is used to secure the communication between the client and the server.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 25 in PDF)

Explanation: The searchsploit command is used in Kali Linux to find known exploits for a given service, such as SMTP.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 77 in PDF)

Explanation: The AUTH command in SMTP is used to authenticate a client to a server. It is used as part of the email delivery process, and requires the client to provide valid authentication credentials.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 231 in PDF)

Explanation: In a DNS Cache Poisoning attack, the attacker manipulates the DNS resolver cache by injecting corrupted DNS data. This forces the DNS server to send the IP address of the attacker’s system to the victim instead of the real IP address of the website the victim is trying to access, thereby redirecting the victim’s communications to the attacker’s system.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The HELO command is used to initiate an SMTP conversation with an email server. This is usually the first command a client sends to an SMTP server after making a connection.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page Page in PDF)

Explanation: VRFY is an SMTP command that is used to verify whether a specific user’s email mailbox exists on the system. This can be useful during penetration testing to gather potential user account information.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page Page: in PDF)

Explanation: Network Basic Input/Output System (NetBIOS) and Link-Local Multicast Name Resolution (LLMNR) are protocols that are used primarily by Microsoft Windows for host identification. However, NetBIOS was specifically mentioned in relation to host identification in the text.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The STARTTLS command is used to initiate a TLS connection to an email server. This security mechanism ensures the encryption of email in transit.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The STARTTLS command is used to start a Transport Layer Security (TLS) connection to an email server. This provides encryption for the connection, ensuring the contents of the communication can’t be easily intercepted or deciphered.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: Kerberos implementation does not include a ’Key Retriever’ as a basic element. The three basic elements of Kerberos are: Client, Server, and the Key Distribution Center (KDC) which itself includes the authentication server and the ticket-granting server.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: In the context of an Evil Twin attack, an attacker primarily performs a DNS cache poisoning attack to get the DNS cache to accept a spoofed record. This enables them to redirect victims to a different location of their choosing, often to a malicious website or a falsified portal.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: TCP port 587 is utilized for the Secure SMTP (SSMTP) protocol for encrypted communications, as is outlined in RFC 2487, using STARTTLS. Mail User Agents (MUAs) use this port for email submission. STARTTLS may also be used over TCP port 25 in some implementations, but TCP port 587 is specifically designed for encrypted SSMTP.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The common vulnerability in LLMNR involves an attacker spoofing an authoritative source for name resolution on a victim system. They do this by responding to LLMNR traffic over UDP port 5355 and NBT-NS traffic over UDP port 137. This essentially means the attacker poisons the LLMNR service in order to manipulate the victim’s system. If the requested host belongs to a resource that requires identification or authentication, the username and NTLMv2 hash are sent to the attacker. The attacker can then gather the hash sent over the network by using tools such as sniffers. Subsequently, the attacker can brute-force or crack the hashes offline to get the plaintext passwords.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The ’airmon-ng check kill’ command is used to stop any processes that may interfere with the monitoring of a wireless network interface. This is important in ensuring accurate and uninterrupted reconnaissance of the wireless network.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 56-57 in PDF)

Explanation: The commands set RHOST and set LHOST are used respectively to set the IP address of the remote system to be attacked and the IP of the host that you would like the victim to communicate with after exploitation.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: The text indicates that BLE communications can be susceptible to on-path attacks, and Denial of Service (DoS) attacks can also be problematic for BLE implementations. These attacks could allow an attacker to modify BLE messages between systems that could lead them to believe they are communicating with legitimate systems.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page page in PDF)

Explanation: The DATA SMTP command is used to initiate the transfer of the contents of an email message.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: UDP is often used as the transport mechanism in reflected DoS and DDoS attacks because it is more easily spoofed due to the lack of a three-way handshake. This means it is unable to provide the security guarantees that TCP can due to three-way handshake.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 56 in PDF)

Explanation: Ettercap can be used to spoof DNS replies to divert a user visiting a given website to an attacker’s local system. This enables the attacker to perform a credential harvesting attack where they capture the user’s login credentials.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 68 in PDF)

Explanation: An on-path attack involves an attacker placing themselves in-line or in the ’path’ between two devices or individuals that are communicating. This allows them to eavesdrop or manipulate the data being transferred.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 56 in PDF)

Explanation: The text mentions three categories of DoS attacks: Direct, Reflected, and Amplification. It does not mention ’Fragmented’ as a category.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: TCP port 143 is the default port used by the IMAP protocol in non-encrypted communications.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 5 in PDF)

Explanation: In the EternalBlue exploit via Metasploit, ’set RHOST’ and ’set LHOST’ commands are used to configure the IP addresses of the remote system to be exploited and the system that the victim communicates with after exploitation, respectively.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 124 in PDF)

Explanation: EternalBlue is a widely-used SMB exploit. When used successfully, it allows a remote attacker to compromise an affected system and execute arbitrary code. This exploit was used in infamous ransomware attacks such as WannaCry and Nyeta.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page (page_number) in PDF)

Explanation: In a Password Spraying attack, an attacker attempts to brute-force logins using common or default passwords with a list of usernames. On the other hand, In a Credential Stuffing attack, an attacker uses a list of usernames and passwords that were exposed in previous breaches.

Ref: CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

(Page 57 in PDF)