GIAC GPEN Exam Dumps & Practice Test Questions

Question 1:

How does adding multiple salts to a password set affect the usefulness of precomputed Rainbow Tables in cracking passwords?

A. Salts increase the cracking time by requiring more tables to be calculated.
B. Salts double the total size of the rainbow table database.
C. Salts can be easily reversed or removed to reveal unsalted hashes.
D. Salts have minimal impact because they can be dynamically calculated with tools like Ophcrack.

Correct Answer: A

Explanation:

Salts are random values added to passwords before hashing to ensure that even identical passwords produce unique hash outputs. This mechanism is a fundamental defense against attacks such as those utilizing precomputed Rainbow Tables. Rainbow Tables store a vast number of hash-to-password mappings, allowing attackers to quickly reverse hashes to their original passwords—but this works only if the hashes are unsalted.

When salts are applied, every password is combined with a unique salt before hashing, meaning the same password will have a different hash for each salt value. Consequently, attackers cannot rely on a single Rainbow Table to crack multiple passwords; instead, they must compute or store separate tables for every possible salt value. This exponentially increases the computational effort and storage requirements.

Option A correctly states that salts increase the time and complexity of cracking passwords because attackers need to generate or reference multiple tables, one for each salt. This is the best answer, as it reflects the real-world impact of salts on password cracking.

Option B is incorrect because the size of the Rainbow Tables does not merely double with salts. Instead, it increases by the number of unique salts, which can be extremely large, far exceeding a simple doubling.

Option C is a misconception. Salts are not embedded in the hash but combined during hashing; they cannot be reversed or removed to obtain unsalted hashes. The attacker must know the salt to perform hash comparisons.

Option D is false. Tools like Ophcrack are designed for unsalted hashes or weak salts. Salts significantly hamper the effectiveness of such tools because every hash requires separate cracking effort.

In summary, adding salts greatly complicates and slows down attacks that rely on Rainbow Tables, making Option A the correct choice.

Question 2:

What does the privacy bit set in the 802.11 wireless frame header signify?

A. The wireless network’s SSID is hidden (SSID cloaking).
B. Some form of encryption is being used on the network.
C. A wireless access point (WAP) is in operation.
D. Protected Extensible Authentication Protocol (PEAP) is in use.

Correct Answer: B

Explanation:

The 802.11 wireless protocol includes a frame header containing various flags and indicators that provide information about the state and characteristics of the wireless transmission. One such flag is the privacy bit. When this bit is set, it is an indicator that some type of encryption is active on the wireless network.

Encryption is a critical security feature used to protect wireless data from eavesdropping or unauthorized access. Common encryption methods include WEP (Wired Equivalent Privacy), WPA (Wi-Fi Protected Access), and WPA2. Setting the privacy bit in the frame header lets receiving devices and monitoring tools know that the transmitted data is protected, helping to ensure confidentiality.

Looking at the other options:

Option A (SSID cloaking) refers to hiding the network name so it does not appear in scans. This is unrelated to the privacy bit, which does not indicate whether the SSID is broadcast or hidden.

Option C (WAP usage) simply means that a wireless access point is being used. The privacy bit does not indicate the presence of a device; rather, it signals encryption status.

Option D (PEAP usage) refers to an authentication protocol used in enterprise Wi-Fi security, typically layered on top of encryption but not indicated by the privacy bit itself.

Therefore, the privacy bit directly signals that some encryption protocol is protecting the wireless traffic, making Option B the correct answer. This bit’s presence enhances network security awareness by indicating that transmitted data is encrypted and less vulnerable to interception.

Question 3:

Based on the command output shown (not displayed here), what conclusion can the tester draw directly from the information?

A It reveals usernames associated with the domain tesrdomain.com
B Directory browsing is enabled on the web server
C The presence of vulnerable Adobe software versions
D The file naming scheme used for public documents

Correct Answer: B

Explanation:

When analyzing command outputs related to web servers or network reconnaissance, it is important to identify what kind of information can be directly inferred. Although the exact command output is not provided here, the options hint at common interpretations of typical output scenarios.

Option A suggests the output displays domain usernames. Usually, domain usernames would be revealed through specific queries, such as LDAP or Active Directory enumeration tools. Unless the output explicitly lists user accounts, this option is unlikely to be correct because most general server or directory listings do not expose usernames.

Option B concerns directory browsing or indexing being enabled. This is a common feature of web servers that, when enabled, allows users to view a list of files and folders within a directory if there is no default index file (like index.html). When directory indexing is turned on, web server responses often include file and folder names in a readable list, which testers can easily detect. This is frequently observed in command outputs showing directory structures or HTTP responses indicating folder contents, thus making it the most reasonable inference from such outputs.

Option C relates to discovering vulnerable Adobe software versions. This kind of detail typically comes from dedicated vulnerability scanners or software version enumeration tools rather than generic command outputs. Unless the output explicitly mentions software version numbers or vulnerability data, this option is unlikely.

Option D refers to naming conventions for public documents. While file names may be visible in directory listings, deducing a naming standard requires more context and specific pattern recognition. Simple file lists don’t automatically imply a naming convention.

Given these points, directory indexing allowed on the web server (Option B) is the best-supported conclusion, as directory listings commonly appear in outputs when indexing is enabled, allowing users to browse the server's folder contents. Hence, B is the correct choice.

Question 4:

Which Metasploit VNC inject stager enables the victim machine to listen on a specified port chosen by the attacker, allowing VNC communication initiated by the attacker?

A Vncinject/find.lag
B Vncinject/reverse.tcp
C Vncinject/reverse-http
D Vncinject/bind.tcp

Correct Answer: D

Explanation:

The Metasploit framework offers various VNC inject stagers to facilitate remote desktop control over a compromised system. Each stager uses a different networking method to establish communication between the attacker and the victim machine, and understanding these differences is crucial for selecting the correct stager for a given scenario.

Option A, Vncinject/find.lag, is not a recognized or standard Metasploit stager. It does not correspond to any known VNC communication technique in the framework, so this option can be discarded outright.

Option B, Vncinject/reverse.tcp, works by having the victim machine initiate a TCP connection back to the attacker’s machine. This is useful in environments where inbound connections to the victim are blocked or filtered. However, this method relies on the victim "calling back" to the attacker rather than listening on a port. It is not suited for scenarios where the attacker wants to connect to a victim machine that listens on a specific port.

Option C, Vncinject/reverse-http, functions similarly to reverse.tcp but uses HTTP to bypass firewalls or proxies that block TCP connections. Like reverse.tcp, the victim initiates the connection to the attacker, so it does not allow the victim to listen for incoming connections.

Option D, Vncinject/bind.tcp, is the correct choice. This stager causes the victim machine to "bind" or listen on a TCP port that the attacker specifies. Once the victim is listening, the attacker can initiate a connection to this port, establishing VNC control. This method is typically used when the attacker can connect directly to the victim machine's listening port, making it ideal for environments without strict outbound filtering.

Thus, Vncinject/bind.tcp is the appropriate stager for enabling the victim to listen on a chosen port and for the attacker to initiate VNC communications, confirming D as the correct answer.

Question 5:

When remotely connected to a Windows system through a basic netcat shell, which command allows you to quickly navigate to the folder where the Windows operating system is installed?

A cd systemroot
B cd-
C cd /systemroot/
D cd %systemroot%

Correct Answer: D

Explanation:

When you gain remote access to a Windows machine using a simple shell like netcat, you are typically limited to command-line interaction via the Windows Command Prompt (CMD). In this environment, environment variables play a key role in simplifying navigation. One such variable is %systemroot%, which points directly to the folder where Windows is installed—usually C:\Windows.

To move into this directory swiftly, the correct command is cd %systemroot%. This tells the command interpreter to change the current directory to the value stored in the systemroot environment variable, effectively taking you to the Windows system directory.

Let’s examine why the other options are incorrect:

• A (cd systemroot): This treats “systemroot” as a literal directory name, which likely doesn’t exist. Windows requires environment variables to be enclosed in percent signs (%), so this command will fail.

• B (cd-): This syntax is common in Unix/Linux shells, where cd - takes you back to the previous directory. It is not valid in Windows CMD, where this shortcut does not exist.

• C (cd /systemroot/): Windows uses backslashes (\) for directory paths, not forward slashes (/), which are typical in Unix/Linux systems. This command will not work in CMD.

Therefore, D is the right answer because it uses the proper Windows environment variable format and correctly changes to the system directory regardless of its actual location on the disk. This method is essential when working remotely with limited shell tools, as it leverages built-in variables for efficient navigation.

Question 6:

Which command correctly merges Unix passwd and shadow copy files into a format compatible with John the Ripper for password cracking?

A /Un shadow passwd copy shadowcopy > johnfile
B /Unshadow passwdcopy shadowcopy > johnfile
C /Unshadow shadowcopy passwdcopy > johnfile
D /Unshadow passwdcopy shadowcopy > johnfile

Correct Answer: D

Explanation:

John the Ripper (JtR) is a widely used tool designed to crack password hashes on Unix-based systems. To analyze password hashes correctly, John requires a unified input file containing user account data combined from two specific files: the passwd file and the shadow file.

The passwd file lists users and some associated metadata, but modern Unix systems often store password hashes in the shadow file to increase security by restricting access. To enable John the Ripper to process these hashes, the two files must be merged properly.

This is where the /unshadow utility comes in. The /unshadow command takes two arguments: first the passwd file, then the shadow file. It outputs a merged file that contains user data and their hashed passwords in a format John the Ripper understands.

The general syntax is:
/unshadow <passwd file> <shadow file> > <output file>

Let’s review the provided options:

• A: This command is syntactically incorrect because it improperly separates "unshadow" into two words and misorders the file arguments.

• B: This command uses the correct syntax but the filenames passwdcopy and shadowcopy might be placeholders or incorrect depending on context. However, if those are the actual filenames, this could be right.

• C: This reverses the file order, which will cause the command to fail or produce incorrect output. The passwd file must come before the shadow file.

• D: This is the correct and properly structured command if passwdcopy and shadowcopy are the actual filenames used. It follows the required order and syntax perfectly.

In conclusion, option D is the accurate command to prepare Unix password data for John the Ripper, ensuring the tool can effectively perform its password cracking functions.

Question 7:

Which of the following outcomes can sometimes occur with certain SQL injection vulnerabilities that impact the operating system of the server hosting the database?

A Retrieval of database schema information
B Execution of shell commands on the server
C Modification of data records
D Querying of database content

Correct Answer: B

Explanation:

SQL injection vulnerabilities arise when an attacker exploits weaknesses in how an application constructs SQL queries, allowing malicious code injection. Typically, SQL injection is known for unauthorized data access or data manipulation, but in some cases, it can also enable attackers to execute commands directly on the server’s underlying operating system, which is far more dangerous.

Let’s review each option:

• Retrieval of database schema information is a common effect of SQL injection. Attackers can access metadata like table names, columns, and relationships within the database, but this is limited to the database layer itself and does not involve the server’s OS.

• Execution of shell commands on the server is a more severe consequence seen in some SQL injection vulnerabilities, especially when the database software provides interfaces to run OS commands. For instance, Microsoft SQL Server’s xp_cmdshell or MySQL’s system() function can be exploited if input is not properly sanitized. This allows attackers to run arbitrary commands on the server, potentially gaining full system control, escalating privileges, or causing significant damage. This bridges the gap from database compromise to full system compromise.

• Modification of data records (inserting, updating, deleting) is a typical impact of SQL injection, but it is restricted to the data within the database and does not directly compromise the OS.

• Querying of database content simply means reading data, which is the core consequence of many SQL injection flaws but remains within the database domain only.

In summary, the most critical and potentially damaging effect related to the underlying server OS is shell command execution, as it allows attackers to operate beyond the database and manipulate the entire server environment, which can lead to a complete security breach.

Question 8:

In the process of establishing a wireless (IEEE 802.11) connection, who initiates the authentication challenge?

A The client challenges the access point
B The access point challenges the client
C No challenge is issued during connection
D Both client and access point issue mutual challenges

Correct Answer: B

Explanation:

When a wireless connection is formed under the IEEE 802.11 standard, the security mechanism usually involves an authentication handshake to verify the identity of the connecting device. The challenge-response process is a fundamental part of this authentication, ensuring that unauthorized devices cannot access the network.

Typically, the access point (AP) issues a challenge to the client device during the initial authentication phase. This means the client requests access, and the AP responds with a challenge that requires the client to prove its identity, usually by providing a correct password, certificate, or other credentials. This one-way challenge initiated by the access point is essential for maintaining secure wireless connections in WPA or WPA2 environments.

Here’s how it works in more detail:

1. The client sends a connection request to the AP.

2. The AP sends a challenge to the client, such as a nonce or encrypted data.

3. The client responds correctly, proving its legitimacy.

4. Upon successful response, the AP grants access, and a secure session begins.

Reviewing other options:

• If the client challenged the AP (option A), it would reverse the standard process. This is incorrect because authentication protocols place the AP as the authenticator, not the challenger.

• The idea that no challenges occur (option C) is incorrect because challenges are necessary to ensure only authorized clients connect.

• Mutual challenges (option D) are not typical in standard IEEE 802.11 authentication. While further mutual verification can occur later, the initial challenge is one-way from the AP to the client.

Therefore, the correct answer is that the access point challenges the client, which reflects the common authentication flow in wireless networking.

Question 9:

While performing a UDP scan on a remote machine running a web server and analyzing the traffic with a sniffer, you observe that the target sends an ICMP Port Unreachable message only once every second. 

Which operating system is this behavior most likely associated with?

A Linux
B Windows
C OpenBSD
D Mac OS X

Correct answer: C

Explanation:

When conducting a UDP scan against a remote system, the type and timing of the responses can often reveal the target’s operating system due to characteristic network behavior patterns. In this case, the key observation is that the target responds with ICMP Port Unreachable messages at a steady rate of once per second.

ICMP Port Unreachable messages are sent when a system receives UDP packets addressed to closed or non-listening ports. The frequency of these messages can be an important clue. Linux and Mac OS X typically respond quickly and may not impose strict rate limiting on ICMP responses. Their response patterns are more immediate and can vary based on network conditions and configuration.

Windows systems tend to show more irregular response timings for ICMP messages. They do not usually respond at fixed intervals but rather in a more sporadic manner depending on internal network stack behavior.

OpenBSD is well known for its strong focus on network security and defensive measures. It enforces rate limiting on certain types of ICMP messages, including the Port Unreachable response, to mitigate potential denial-of-service (DoS) attacks and reduce the risk of network scanning abuse. The consistent, exactly one-second interval between ICMP responses is a signature trait of OpenBSD’s security design.

This rate limiting helps prevent flooding the network with excessive ICMP responses and reduces the likelihood of the system being overwhelmed during scans or attacks. Because of this specific behavior, seeing ICMP Port Unreachable messages returned exactly once per second during a UDP scan is a strong indicator that the target machine is running OpenBSD.

Therefore, based on the characteristic timing and type of ICMP responses, the target is most likely running OpenBSD (option C).

Question 10:

About how many data packets are typically required to successfully carry out an FMS attack against a WEP-secured wireless network?

A 250,000
B 20,000
C 10,000,000
D 1 (with a weak IV)

Correct answer: A

Explanation:

The FMS attack—named after Fluhrer, Mantin, and Shamir—is a cryptanalysis technique that targets vulnerabilities in the Wired Equivalent Privacy (WEP) protocol, which was an early wireless encryption standard. Although WEP has been largely deprecated due to its weaknesses, understanding the FMS attack highlights why WEP is insecure.

WEP encryption combines a secret key with an Initialization Vector (IV), which is sent in plaintext. The IV is a short value that is reused frequently due to its limited size, which exposes patterns that attackers can exploit. The FMS attack leverages the weaknesses in the IV generation and key scheduling algorithm, allowing attackers to recover the encryption key by collecting enough encrypted packets.

The critical factor in the FMS attack is the number of packets collected containing weak or reused IVs. The attacker needs to gather enough packets so that statistical methods can reliably deduce the key bytes.

Looking at the options:
A 250,000 packets is the generally accepted threshold to successfully execute the FMS attack. This volume is sufficient to gather enough weak IVs for statistical analysis, giving a high probability of recovering the WEP key. Practical attack tools often aim to capture around this number of packets.

B 20,000 packets is generally too low. While some packets may contain useful weak IVs, this quantity is insufficient for reliably cracking the key, as the statistical model requires a larger dataset.

C 10,000,000 packets is excessive and unnecessary. The FMS attack does not require millions of packets; around a quarter million packets are typically enough, so this estimate is far beyond what is needed.

D One single packet with a weak IV is an extremely rare case. Though theoretically possible if the IV is exceptionally weak, this is not practical in real-world scenarios because the attack depends on gathering many packets to analyze.

In summary, the FMS attack generally requires capturing approximately 250,000 packets to gather enough weak IVs for successful key recovery, making A the correct answer.