CompTIA PenTest+ (v3) Free Sample Questions

The most effective escalation path is to abuse the anonymously accessible Kubelet API. The /run endpoint of this API can be used to execute commands within pods or even create new pods on the worker node. By sending a crafted POST request via the SSRF vulnerability to http:// :10250/run/ / / , the tester can execute commands. To achieve full node compromise, the tester can instruct the Kubelet to create a new, privileged pod with the host's root filesystem mounted (e.g., using hostPath). This allows the tester to escape the container sandbox and gain a root shell directly on the worker node. This technique is highly effective as it abuses a common Kubernetes misconfiguration (anonymous Kubelet auth) and doesn't rely on less reliable kernel exploits or limited IAM permissions.

The tester is attempting an adversarial evasion attack. This type of attack involves creating a malicious input (an adversarial example) by making small, often imperceptible, perturbations to a legitimate input. The goal is to cause a deployed and trained machine learning model to misclassify it during the inference phase. In this scenario, the tester would modify the image of the unauthorized person in a specific way to trick the AI model into classifying it as an authorized employee. This is a black-box attack, as the tester interacts with the model's API to observe outputs and iteratively craft the malicious input without needing access to the model's internal workings. Data poisoning occurs during training, while model inversion and membership inference aim to extract information about the model or its data.

Software Composition Analysis (SCA) is the specific methodology designed to identify and manage vulnerabilities in third-party and open-source components. SCA tools scan an application's dependencies (e.g., from package.json, requirements.txt, or container layers) and compare them against a database of known vulnerabilities (CVEs). This allows the CI/CD pipeline to automatically detect and flag insecure dependencies. SAST analyzes first-party source code for coding flaws, DAST tests the running application from the outside, and IAST works at runtime, but only SCA focuses specifically on the security of the software supply chain and third-party libraries.

Since script-src allows 'self', any script loaded from the application's own origin is trusted. A JSONP endpoint on the same domain that reflects user input in a callback function (e.g., /api/jsonp?callback=alert(1)) can be abused to execute arbitrary JavaScript. The injected payload would be , which is permitted by the CSP.

The CSP explicitly trusts scripts from https://trusted.cdn.com. If any JavaScript library hosted on this CDN has a vulnerability (such as an insecure callback, DOM-based XSS sink, or a gadget for prototype pollution), it can be used as a vector to execute arbitrary code. The attacker's payload would call the vulnerable function from the trusted library.

Discovering an active compromise by a real threat actor changes the engagement from a test to a live incident. The consultant's primary responsibility is to immediately stop all testing activities to avoid interfering with forensic evidence or alerting the attacker. The next step is to contact the client via the designated emergency escalation path, which should be defined in the rules of engagement. This allows the client to initiate their incident response plan immediately. Continuing the test or attempting containment could corrupt evidence and is outside the scope of a standard penetration test.

An unquoted service path vulnerability is only exploitable if the user has write permissions in one of the directories in the path. The service path C:\Program Files\Custom App\service.exe will cause Windows to look for C:\Program.exe, then C:\Program Files\Custom.exe, and finally the correct path. The MOST critical validation step is to check if the current user (or a low-privileged user) can write a malicious executable into C:\ or C:\Program Files\. The icacls command is used to check the Access Control Lists (ACLs) on these folders. If write permissions exist, the tester can place a malicious Custom.exe in C:\Program Files\ to achieve privilege escalation when the service restarts. Without write permissions, the vulnerability is not exploitable.