OBJ 5.2: 'proxychains4 curl ifconfig.me' uses proxychains4 to route the curl request through the proxy chain and displays the current public-facing IP address as assigned by the network chain. 'proxychains4 curl ipconfig.me' uses proxychains4 but attempts to access ipconfig.me, which is not a valid service for checking your public IP address. Therefore, the command would fail due to an invalid domain name. 'curl ifconfig.me' will display your public-facing IP address, but it won't use proxychains to route the request through any proxy chain. It will show your IP as seen directly by the target server, which might be your actual IP address or the one assigned by your ISP, not the IP assigned by the proxy chain. Running 'curl ipconfig.me' would most likely result in a "could not resolve host" error as it is not the correct syntax to be used. OBJ. 5.2

Directory enumeration is correct because the tester is discovering hidden or unlinked files and directories using automated requests. Service discovery is incorrect because it identifies network services. Share enumeration is incorrect because it targets network file shares such as SMB. Protocol enumeration is incorrect because it identifies supported communication protocols rather than web content. OBJ. 2.2 

Integer overflows and other integer manipulation vulnerabilities frequently result in buffer overflows. An integer overflow occurs when an arithmetic operation results in a large number to be stored in the space allocated for it. Integers are stored in 32 bits on the x86 architecture; therefore, if an integer operation results in a number greater than 0xffffffff, an integer overflow occurs, as was the case in this example. SQL injection is an attack that injects a database query into the input data directed at a server by accessing the application's client-side. Password spraying is a type of brute force attack in which multiple user accounts are tested with a dictionary of common passwords. Impersonation is the act of pretending to be another person or system for fraud. OBJ. 4.1 

Since your company owns the website, you can require the developer to implement a bug/code fix to prevent the form from allowing the AUTOCOMPLETE function to work on this website. The code change to perform is quite simple, simply adding "autocomplete=off" to the code's first line. The resulting code would be <form action="authenticate.php” autocomplete="off"> OBJ. 4.5

Faulty input validation is correct because XSS, SQL injection, and XML injection all exploit applications that fail to properly validate, sanitize, or parameterize user-supplied input before processing it. When input is not properly constrained, attackers can inject malicious scripts or commands that alter application behavior. Output encoding is incorrect because it is a defensive control used to mitigate XSS rather than a root cause of injection vulnerabilities. File inclusions is incorrect because it refers to Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks, which are distinct from general injection flaws. Directory traversals is incorrect because it involves unauthorized file path manipulation rather than improper handling of input data within application logic. OBJ. 4.5

Use NSE with an HTTP-focused script is correct because the Nmap Scripting Engine (NSE) allows the tester to run specialized scripts designed to detect known vulnerabilities in specific services such as HTTP, providing an efficient and automated method for targeted vulnerability validation. Perform a brute-force attack with Nmap is incorrect because brute forcing is used for credential attacks and does not directly identify service-specific vulnerabilities. Connect using Netcat for manual testing is incorrect because while it allows interaction with the service, it is not efficient or automated for identifying known vulnerabilities. Run a default Nmap scan only is incorrect because it will identify open ports and services but does not perform in-depth vulnerability detection without using additional scripting capabilities like NSE. OBJ. 4.2

The bash command entered by the penetration tester on the target server is used to redirect input and output to establish a connection back to a listener. Therefore, the penetration tester must first set up a listener on their machine. This can be done using netcat to listen on port 31337 (nc -nlvp 31337).

The bash command redirects the standard output (stdout) to a TCP socket connected to the IP address (192.168.1.53) over port 31337. Then, the standard input (stdin) is redirected to the standard output. Since Bash treats TCP sockets created in this way as a bidirectional connection, it allows the penetration tester to gain remote access to the server by creating a reverse shell.

To maintain persistence, the server could be configured (for example, using a scheduled task such as crontab) to execute this Bash command at regular intervals. OBJ.5.1

OBJ 5.2: SSH tunneling is an effective method for lateral movement, especially when trying to reach systems on a segmented network. The command ssh -L 3306:192.168.10.10:3306 [email protected] creates a local SSH tunnel, forwarding traffic from Hugh's local machine (port 3306) through the compromised web server at 192.168.1.5 to the database server at 192.168.10.10. This allows him to access the database over the tunnel. nc -zv checks if a port is open but doesn’t establish a relay, ssh [email protected] simply connects to the target without tunneling, and ps exec is a remote execution tool not suited for tunneling traffic. OBJ. 5.2

OBJ 3.3 - Evie is using badge cloning to replicate the employee’s RFID signal and gain unauthorized access. By capturing the badge’s frequency, she can duplicate it and bypass security systems designed to prevent unauthorized entry. OBJ. 3.3

Maltego is correct because it provides graphical link analysis that maps relationships between entities such as domains, IP addresses, and people, making it ideal for identifying attack paths. SpiderFoot is incorrect because it automates OSINT collection but does not focus on visual relationship mapping. Censys.io is incorrect because it provides searchable internet-wide scan data rather than relationship visualization. WHOIS is incorrect because it provides registration details but not correlation or visualization. OBJ. 2.4