Common attack techniques and exploitation methods across network, application, and wireless targets tested on the CompTIA PenTest+ exam.
39 cards · basic cards · AI-written, checked twice. Edit anything.
- What is social engineering in a penetration test?
Show answer
The manipulation of human psychology to bypass security controls or extract sensitive information.- Define phishing.
Show answer
An attack sending fraudulent emails or messages posing as legitimate sources to harvest credentials or install malware.- What is spear phishing?
Show answer
A targeted phishing attack personalized with victim-specific details to increase success rates.- What is whaling?
Show answer
A spear phishing attack targeting high-value targets such as executives or senior management.- Define pretexting.
Show answer
Creating a fabricated scenario or false identity to trick someone into divulging confidential information.- What is baiting in social engineering?
Show answer
Leaving a tempting item like a USB drive or offering something desirable to entice a victim into compromising security.- Define tailgating.
Show answer
Following an authorized person through a secured access point without using credentials, also called piggybacking.- What is dumpster diving?
Show answer
Searching through discarded materials like trash to find sensitive information or credentials.- Define shoulder surfing.
Show answer
Observing someone's screen or keyboard from behind to steal passwords or sensitive data.- What is a SQL injection attack?
Show answer
Inserting malicious SQL code into input fields to manipulate database queries and access or modify data.- Define Cross-Site Scripting (XSS).
Show answer
Injecting malicious scripts into web pages viewed by other users to steal session cookies or perform actions on their behalf.- What is Cross-Site Request Forgery (CSRF)?
Show answer
Tricking an authenticated user into performing unwanted actions on a web application without their knowledge.- What is a buffer overflow attack?
Show answer
Writing data beyond the allocated buffer boundary to overwrite adjacent memory and potentially execute arbitrary code.- Define a Man-in-the-Middle (MITM) attack.
Show answer
Intercepting communications between two parties to eavesdrop or modify data in transit without detection.- What is a replay attack?
Show answer
Capturing and resubmitting valid network packets to gain unauthorized access or perform unauthorized transactions.
FlashKeepers