Free LPT (Master) sample questions

Correct answer: Algorithm Confusion (Key Confusion) Attack

This is a classic Algorithm Confusion attack. The attacker changes the algorithm from RS256 (Asymmetric) to HS256 (Symmetric) and signs the token with the public key. If the server is vulnerable, it will use its public key (which it treats as the secret key for HS256) to verify the signature, allowing the attacker to forge valid tokens.

Correct answer: { __schema { types { name kind fields { name } } } }

This is a standard GraphQL introspection query. It requests the `__schema` meta-field, which exposes the entire schema definition, including types, fields, queries, and mutations, allowing the tester to map the API surface.

Correct answer: Blind XXE using Out-of-Band (OOB) exfiltration via an external DTD

Since the application does not reflect the entity in the response (Blind XXE), the attacker must use an Out-of-Band (OOB) technique. This involves defining a parameter entity that references an external DTD on an attacker-controlled server. This external DTD then triggers a request back to the attacker's server, appending the content of the target file (e.g., /etc/passwd) to the URL query string.

Correct answers: Time-based payloads (e.g., `WAITFOR DELAY '0:0:10'`); Boolean-based inference (e.g., `AND 1=1` vs `AND 1=0`)

Time-based injection relies on pausing the database execution. If the application takes 10 seconds to respond, the injection is successful.

Boolean-based blind SQLi involves sending true/false conditions. Even without data output, the application might respond differently (e.g., different HTTP content length, missing image, or 'Welcome' message) for a True condition versus a False one.

Correct answer: Use Chisel in reverse mode. Run `chisel server -p 8000 --reverse` on your attack box and `chisel client :8000 R:socks` on the target.

Chisel is a fast TCP/UDP tunnel over HTTP. Since the target is in a DMZ (likely behind a firewall blocking inbound), a reverse connection is preferred. Running the server on the attacker machine and the client on the compromised host to initiate a reverse SOCKS proxy is the most robust method. It encapsulates traffic over HTTP/WebSockets, often bypassing firewall rules.

Correct answer: TCP ACK Scan (-sA)

A TCP ACK scan sends a packet with only the ACK flag set. Stateless firewalls or simple packet filters that block SYN packets (to prevent connection initiation) might allow ACK packets through if they assume they belong to an established connection. If the packet reaches the target host, the host will respond with an RST packet because there is no actual connection context, thus revealing the host is alive.