QUESTION 107
You are pen testing a system and want to use Metasploit 3.X to open a listening port on the system so you can access it via a netcat shell. Which stager would you use to have the system listen on TCP port 50000?

QUESTION 108
Which of the following are countermeasures to prevent unauthorized database access attacks?
Each correct answer represents a complete solution. Choose all that apply.

QUESTION 109
You are pen testing a Windows system remotely via a raw netcat shell. You want to get a listing of all the local users in the administrators group, what command would you use?

QUESTION 110
Which of the following is the feature that separates the use of Rainbow Tables from other applications such as Cain or John the Ripper?

QUESTION 111
Analyze the command output below. Given this information, which is the appropriate next step for the tester?
Starting Nmap4.53 (hnp://insecure.org I at2010-09-30 19:13 EDT interesting ports on 192.163.116.101:
PORT STATE SERVICE
130/tcp filtered cisco-fna
131/tcp filtered cisco-tna
132/tcp filtered cisco-sys
133/tcp filtered statsrv
134/tcp filtered Ingres-net
135/tcp filtered msrpc
136/tcp filtered profile
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp open netbios-ssn
140/tcp filtered emfis-data
MAC Address: 00:30:1&:B8:14:8B (Shuttle)
warning: OSS can results may be unreliable because we could not find at least l open and l closed port Device type, general purpose Running: Microsoft Windows XP OS details: Microsoft Windows XP SP2 Network Distance : 1 hop Nmap done: I IP address (I host up) scanned in l .263 seconds

QUESTION 112
Which of the following is a method of gathering user names from a Linux system?

QUESTION 113
Which of the following can be used as a countermeasure to the rainbow password attack?

QUESTION 114
You run the following bash script in Linux:
for i in ‘cat hostlist.txt’ ;do nc -q 2 -v $i 80 < request.txt done where, hostlist.txt file contains the list of IP addresses and request.txt is the output file.
Which of the following tasks do you want to perform by running this script?

QUESTION 115
Identify the network activity shown below;

QUESTION 116
Which of the following is a WEP weakness that makes it easy to Inject arbitrary clear text packets onto a WEP network?

QUESTION 117
Which of the following options holds the strongest password?

QUESTION 118
Which of the following is the frequency range to tune IEEE 802.11a network?

QUESTION 119
Which of the following is the most common method for an attacker to spoof email?

QUESTION 120
You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing.
Recently, your company has assigned you a project to test the security of the we-aresecure. com Web site. For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless whether the ports are open or close. Sometimes, IPID is being incremented by more than one value. What may be the reason?

QUESTION 121
You have compromised a Windows XP system and Injected the Meterpreter payload into the lsass process. While looking over the system you notice that there is a popular password management program on the system. When you attempt to access the file that contains the password you find it is locked. Further investigation reveals that it is locked by the passmgr process. How can you use the Meterpreter to get access to this file?

QUESTION 122
You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing.
Recently, your company has assigned you a project to test the security of the we-aresecure. com network.
Now, when you have finished your penetration testing, you find that the weare- secure.com server is highly vulnerable to SNMP enumeration. You advise the we-are-secure Inc. to turn off SNMP; however, this is not possible as the company is using various SNMP services on its remote nodes. What other step can you suggest to remove SNMP vulnerability?
Each correct answer represents a complete solution. Choose two.

QUESTION 123
While performing a code audit, you discover a SQL injection vulnerability assuming the following vulnerable query, what user input could be injected to make the query true and return data?
select * from widgets where name = ‘[user-input]’;

QUESTION 124
Which of the following layers of TCP/IP model is used to move packets between the Internet Layer interfaces of two different hosts on the same link?

QUESTION 125
A penetration tester used a client-side browser exploit from metasploit to get an unprivileged shell prompt on the target Windows desktop. The penetration tester then tried using the getsystem command to perform a local privilege escalation which failed. Which of the following could resolve the problem?

QUESTION 126
Which of the following tools can be used by a user to hide his identity?
Each correct answer represents a complete solution. Choose all that apply.

QUESTION 127
Which of the following tools can be used to perform brute force attack on a remote database?
Each correct answer represents a complete solution. Choose all that apply.

QUESTION 128
When attempting to crack a password using Rainbow Tables, what is the output of the reduction function?