Common attack techniques and exploitation methods across network, application, and wireless targets tested on the CompTIA PenTest+ exam.
39 cards · basic cards · AI-written, checked twice. Edit anything.
- What is social engineering in a penetration test?
- The manipulation of human psychology to bypass security controls or extract sensitive information.
- Define phishing.
- An attack sending fraudulent emails or messages posing as legitimate sources to harvest credentials or install malware.
- What is spear phishing?
- A targeted phishing attack personalised with victim-specific details to increase success rates.
- What is whaling?
- A spear phishing attack targeting high-value targets such as executives or senior management.
- Define pretexting.
- Creating a fabricated scenario or false identity to trick someone into divulging confidential information.
- What is baiting in social engineering?
- Leaving a tempting item like a USB drive or offering something desirable to entice a victim into compromising security.
- Define tailgating.
- Following an authorised person through a secured access point without using credentials, also called piggybacking.
- What is dumpster diving?
- Searching through discarded materials like trash to find sensitive information or credentials.
- Define shoulder surfing.
- Observing someone's screen or keyboard from behind to steal passwords or sensitive data.
- What is a SQL injection attack?
- Inserting malicious SQL code into input fields to manipulate database queries and access or modify data.
- Define Cross-Site Scripting (XSS).
- Injecting malicious scripts into web pages viewed by other users to steal session cookies or perform actions on their behalf.
- What is Cross-Site Request Forgery (CSRF)?
- Tricking an authenticated user into performing unwanted actions on a web application without their knowledge.
- What is a buffer overflow attack?
- Writing data beyond the allocated buffer boundary to overwrite adjacent memory and potentially execute arbitrary code.
- Define a Man-in-the-Middle (MITM) attack.
- Intercepting communications between two parties to eavesdrop or modify data in transit without detection.
- What is a replay attack?
- Capturing and resubmitting valid network packets to gain unauthorised access or perform unauthorised transactions.