GPEN · Question #389
Which of the following best describes a client side exploit?
The correct answer is C. Attack of a service listening on a client system. A client-side exploit targets a vulnerable application or service running on an end-user workstation rather than a server, exploiting weaknesses in locally running software.
Question
Which of the following best describes a client side exploit?
Options
- AAttack of a client application that retrieves content from the network
- BAttack that escalates user privileged to root or administrator
- CAttack of a service listening on a client system
- DAttack on the physical machine
How the community answered
(50 responses)- A10% (5)
- B4% (2)
- C84% (42)
- D2% (1)
Why each option
A client-side exploit targets a vulnerable application or service running on an end-user workstation rather than a server, exploiting weaknesses in locally running software.
Retrieving content from the network is normal client behavior, not itself an exploit; the vulnerability lies in how the client processes that content, not in the retrieval action.
Privilege escalation to root or administrator is a post-exploitation technique used after initial access has already been gained, not a definition of a client-side exploit.
Client-side exploits attack software listening or processing data on the client endpoint, such as a browser, media player, or local service accepting connections. The attacker crafts malicious content or a network interaction that exploits a vulnerability in that client-side software, gaining access to the user's machine.
Attacking the physical machine refers to hardware-level or physical access attacks, which are unrelated to software-based client-side exploits.
Concept tested: Client-side exploit definition and attack surface
Source: https://www.offensive-security.com/metasploit-unleashed/client-side-exploits/
Topics
Community Discussion
No community discussion yet for this question.