Quiz sobre Ferramentas de Segurança

What does the Nikto tool do?

• Checks for vulnerabilities in databases

• Checks web servers for known vulnerabilities

• Performs brute force attacks

• Exploits vulnerabilities in operating systems

Which Nmap command is used to detect the operating system running on a machine?

• nmap -sV

• nmap -O

• nmap -A

• nmap -sn

Which Wfuzz command can be used to perform a brute-force on subdomains?

• wfuzz -z list http://example.com/FUZZ

• wfuzz -z file,subdomains.txt http://FUZZ.example.com

• wfuzz -c -w subdomains.txt http://FUZZ.example.com

• wfuzz -z list,users.txt http://example.com/FUZZ

Which Gobuster mode is used to force the discovery of subdomains?

• dir

• dns

• vhost

• url

What is the exploit commonly used to exploit the vulnerability in vsftpd 2.3.4, a version known to have a backdoor?

• exploit/unix/ftp/vsftpd_234_backdoor

• exploit/unix/webapp/joomla_php_upload

• exploit/windows/smb/ms08_067_netapi

• exploit/multi/http/tomcat_mgr_deploy

What type of information can be obtained with the basic Nikto command nikto -h http://example.com?

• Vulnerabilities in local applications

• Information about vulnerabilities in web servers

• Enumerate directories and hidden files

• Perform brute-force of credentials

How can Nmap be used to check the versions of services running on a machine?

• nmap -O

• nmap -sS

• nmap -sV

• nmap -Pn

Which option in Wfuzz should be used to ignore HTTP status code 404 during a brute-force of directories?

• --exclude

• --hide 404

• --hc 404

• --sc 404

The command gobuster dir -u http://example.com -w /path/to/wordlist.txt is used to:

• Brute-force subdomains

• Brute-force usernames and passwords

• Brute-force directories and files on a web server

• Enumerate TCP ports

When exploring a remote code execution (RCE) vulnerability in a web application, what is the first thing an attacker usually tries to do after gaining initial access to the system?

• Explore more external vulnerabilities

• Escalate privileges and gain full control of the system

• Download sensitive files

• Change permissions for all users