Sample HTB CPTS CPTS Practice Questions
Q: Which Nmap flag performs a SYN scan (half-open scan)?
A: nmap -sS — The -sS flag performs a TCP SYN scan. It sends a SYN packet and analyzes the response without completing the three-way handshake, making it faster and stealthier than a full connect scan (-sT).
Q: Which SQL injection payload tests for a basic authentication bypass?
A: ' OR 1=1-- - — ' OR 1=1-- - is a classic SQL injection payload that makes the WHERE clause always true by appending OR 1=1. The -- - comments out the rest of the query, bypassing login checks.
Q: In Metasploit, which command selects an exploit module for use?
A: use exploit/path/module — The 'use' command in Metasploit selects an exploit module by its path (e.g., use exploit/windows/smb/ms17_010_eternalblue). After selecting, configure options with 'set' and launch with 'run'.
Q: Which tool collects Active Directory relationships and attack paths, visualizing them as a graph?
A: BloodHound — BloodHound maps Active Directory relationships using graph theory to reveal attack paths to Domain Admin. It visualizes trust relationships, group memberships, ACLs, and session data.
Q: On Linux, which command finds all files with the SUID bit set?
A: find / -perm -u=s -type f 2>/dev/null — 'find / -perm -u=s -type f 2>/dev/null' searches the entire filesystem for files with the SUID bit. SUID binaries execute with the owner's privileges (often root), making misconfigurations exploitable.
Q: What are the standard phases of a penetration testing methodology?
A: Pre-engagement, Reconnaissance, Enumeration, Exploitation, Post-Exploitation, Reporting — A structured pentest follows: Pre-engagement (scoping, rules), Reconnaissance (passive info gathering), Enumeration (active scanning), Exploitation (gaining access), Post-Exploitation (pivoting, data), and Reporting.
Q: You need to identify live hosts on a /24 subnet without port scanning. Which Nmap command achieves this?
A: nmap -sn 10.10.10.0/24 — The -sn flag performs host discovery (ping scan) without port scanning. -Pn skips host discovery, -sV does version detection, and -O does OS detection — all involve port scanning.
Q: Which Nmap option enables OS detection, version detection, script scanning, and traceroute in a single flag?
A: -A — The -A flag enables aggressive scan options: OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) all in one.
Q: Which tool is commonly used to fuzz for hidden web directories and files using a wordlist?
A: ffuf — ffuf (Fuzz Faster U Fool) is a fast web fuzzer used to discover hidden directories, files, and parameters by substituting wordlist entries into URL patterns.
Q: Which ffuf command correctly fuzzes for virtual hosts on a target web server?
A: ffuf -u http://target/ -w vhosts.txt -H 'Host: FUZZ.target.com' — Virtual host fuzzing with ffuf uses the -H flag to inject wordlist entries into the Host header. The FUZZ keyword in the Host header tests different subdomains against the same IP.