A penetration tester identifies the following findings during an external vulnerability scan: Which of the following attack strategies should be prioritized from the scan results above?
A.
Obsolete software may contain exploitable components.
B.
Weak password management practices may be employed.
C.
Cryptographically weak protocols may be intercepted.
D.
Web server configurations may reveal sensitive information.
PenTest+ Practice Tests Book - SYBEX
D. - Port 21 is for TCP and FTP and is used as a control port. Port 80 is for TCP and HTTP and is used for transferring web pages. Port 443 is used for TCP, HTTPS, and is HTTP over TLS/SSL and is for encrypted transmission. In this scenario, all the ports that the penetration tester has discovered have to do with the Web. So, the answer for this question would be that sensitive information may be revealed on the web servers since those were the ports indicated during the vulnerability scan.
A. >>> https://vigilance.fr/vulnerability/Apache-httpd-mod-rewrite-open-redirect-31923
"An attacker can deceive the user of Apache httpd mod_rewrite, in order to redirect him to a malicious site."
Remediation
Upgrade to the latest version of Apache. This issue was fixed in Apache httpd 2.4.41.
So, thinking about this.
C can be ruled out ... you are EXTERNAL ... so under normal circumstancen now way to intercep traffic.
So translating the Rest to the Real world:
First thing i would do is goging for
A. Oboslet Software ...
Maybe there is an Apache exploit out there that gives me RCE.
This would be the shortest attach path.
you could also try to go for weak FTP User Passwords ... but that give you only access to the data of that User.
An Apache exploit would give you access to all.
D. Also is not usefull ... in the Vul. Listing thers no indication that thers a wrong configuration.
Seaching for Exposed config would help finding vulnerabilitys ..
But if A. is allready successfull i don't need to find any other vulnerabillitys.
I agree with this analysis. A seems to be the logical follow-up action. If I see an old Apache server version, you can be sure I'll check for an exploit to some RCE... If it's D, then whoever designed the question/answer on this one has zero industry experience.
D - Explanation: Port 21 is for TCP and FTP and is used as a control port. Port 80 is for TCP and HTTP and is used for transferring web pages. Port 443 is used for TCP, HTTPS, and is HTTP over TLS/SSL and is for encrypted transmission. In this scenario, all the ports that the penetration tester has discovered have to do with the Web. So, the answer for this question would be that sensitive information may be revealed on the web servers since those were the ports indicated during the vulnerability scan.
It's A, note it says on an EXTERNAL vulnerability scan.
Ok so HTTP and FTP traffic happens without encryption but how exactly are you intercepting legit user traffic from outside the network?
Lots of out-dated items here: Old Windows Server, old Apache, mod_rewrite, lots to potentially exploit.
Definitely C or D... but I could see an argument for both. But since this is a web server, and it is "configured" to send traffic with weak cleartext protocols, I would choose D.
Apache mod_rewrite vulnerability cve-2006-3747
https://www.drupal.org/forum/general/news-and-announcements/2006-08-11/apache-mod_rewrite-vulnerability-cve-2006-3747
CVSS v2 Base Score: 7.6 HIGH
I'd go for A due to they mention mod_rewrite enabled. But who knows, depending on how many drinks the comptia guy had when writing this question, then it'd be D.
Maybe: Cryptographically weak protocols may be intercepted?
Note that Winodows 2012 is has port 21 open. Port 21 is usually for FTP. FTP passes information, including passwords, in clear text. Also, FTP is *not* a web protocol. FTP has been around long before the web.
Port 21 is known to be easily exploitable: "Port 21 - FTP: This exploit is pretty simple; you go into the metasploitable framework, choose the vsftpd_234 backdoor exploit, set the target IP, and run the exploit. This backdoor gives us root access to the Metasploitable machine."
https://akvilekiskis.com/work/metasploitable/index.html
i think it's D. I initially thought of C as well, but looking at the Vulnerability column, it just says Windows Server 2012 host found, then port 21, what's the connection, right? Might be FA.
Maybe A. Obsolete software may contain exploitable components?
Obsolete, unsupported, software is always a concern.
According to the scan, there is obsolete software. For example there are several unsupported versions of Apache found. Also SSLv3 can be a problem.
upvoted 2 times
...
This section is not available anymore. Please use the main Exam Page.PT0-001 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
mr_robot
Highly Voted 5Â years, 1Â month agomiabe
Most Recent 2Â years, 10Â months agourisoft
3Â years, 7Â months agoMrRiver
3Â years, 8Â months agodumdada
3Â years, 6Â months agoamericaman80
4Â years agodyers
4Â years agoTheThreatGuy
4Â years, 4Â months agoufovictim
4Â years, 3Â months agoBrokenBandicoot
4Â years, 5Â months agobyrne
4Â years, 6Â months ago[Removed]
4Â years, 9Â months agoD1960
5Â years agoD1960
5Â years agof66
4Â years, 8Â months agotester27
3Â years, 11Â months agoD1960
5Â years, 1Â month ago