CompTIA Updated PT0-003 Exam Questions and Answers by izhaan

The tool that the penetration tester should use for further investigation is WPScan. This is because WPScan is a WordPress vulnerability scanner that can detect common WordPress security issues, such as weak passwords, outdated plugins, and misconfigured settings. WPScan can also enumerate WordPress users, themes, and plugins from the robots.txt file.

The two entries in the robots.txt file that the penetration tester should recommend for removal are:

Allow: /admin

Allow: /wp-admin

These entries expose the WordPress admin panel, which can be a target for brute-force attacks, SQL injection, and other exploits. Removing these entries can help prevent unauthorized access to the web application’s backend. Alternatively, the penetration tester can suggest renaming the admin panel to a less obvious name, or adding authentication methods such as two-factor authentication or IP whitelisting.

Channel Scanning:

Wireless communications can be disrupted by identifying and interfering with the channels used by Wi-Fi networks.

Channel scanning allows the tester to map all active Wi-Fi channels, identify the target network, and determine possible jamming or interference strategies.

Why Not Other Options?

A (Port mirroring): This applies to wired network traffic duplication for monitoring purposes and is unrelated to wireless disruption.

B (Sidecar scanning): Not a relevant technique in the context of wireless disruption.

C (ARP poisoning): This targets Ethernet/IP communication in a local network, not wireless communication at the radio frequency level.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Wireless Network Disruption Techniques

Since SSID broadcast might be hidden, channel scanning allows the tester to identify active Wi-Fi networks.

Option A (Sidecar scanning) ❌: Not a recognized Wi-Fi testing method.

Option B (Channel scanning) ✅: Correct.

Identifies hidden SSIDs by monitoring probe requests and responses.

Option C (Stealth scanning) ❌: Typically refers to evading detection, not Wi-Fi analysis.

Option D (Static analysis scanning) ❌: Static analysis applies to code security, not Wi-Fi networks.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Wireless Reconnaissance Techniques

To enumerate password hashes using an SQL injection vulnerability, the penetration tester needs to extract specific columns from the database that typically contain password hashes. The --dump command in sqlmap is used to dump the contents of the specified database table. Here’s a breakdown of the options:

Option A: sqlmap -u www.example.com/?id=1 --search -T user

The --search option is used to search for columns and not to dump data. This would not enumerate password hashes.

Option B: sqlmap -u www.example.com/?id=1 --dump -D accounts -T users -C cred

This command uses --dump to extract data from the specified database accounts, table users, and column cred. This is the correct option to enumerate password hashes, assuming cred is the column containing the password hashes.

Option C: sqlmap -u www.example.com/?id=1 --tables -D accounts

The --tables option lists all tables in the specified database but does not extract data.

Option D: sqlmap -u www.example.com/?id=1 --schema --current-user --current-db

The --schema option provides the database schema information, and --current-user and --current-db provide information about the current user and database but do not dump data.

References from Pentest:

Writeup HTB: Demonstrates using sqlmap to dump data from specific tables to retrieve sensitive information, including password hashes​​.

Luke HTB: Shows the process of exploiting SQL injection to extract user credentials and hashes by dumping specific columns from the database​​.

=================