nerdexam
GIAC

GPEN · Question #418

Analyze the screenshot below. What type of vulnerability is being attacked?

The correct answer is B. Internet Explorer. This question identifies a browser-based vulnerability attack targeting Internet Explorer, which has a long history of client-side exploits leveraged by attackers.

Exploitation & Post-Exploitation Techniques

Question

Analyze the screenshot below. What type of vulnerability is being attacked?

Exhibit

GPEN question #418 exhibit

Options

  • AWindows Server service
  • BInternet Explorer
  • CWindows Powershell
  • DLocal Security Authority

How the community answered

(50 responses)
  • A
    4% (2)
  • B
    72% (36)
  • C
    8% (4)
  • D
    16% (8)

Why each option

This question identifies a browser-based vulnerability attack targeting Internet Explorer, which has a long history of client-side exploits leveraged by attackers.

AWindows Server service

Windows Server service vulnerabilities involve network-level attacks targeting services like SMB or RPC, not client-side browser exploitation.

BInternet ExplorerCorrect

Internet Explorer has been the target of numerous client-side vulnerabilities exploitable through malicious web pages, drive-by downloads, and crafted HTML content. Its rendering engine, ActiveX subsystem, and scripting engine have all been weaponized in exploit frameworks like Metasploit. A screenshot of such an attack would typically show a browser-based payload delivery targeting an IE-specific CVE.

CWindows Powershell

PowerShell is typically abused post-exploitation for lateral movement and persistence, not as an initial client-side attack vector.

DLocal Security Authority

The Local Security Authority is targeted during credential harvesting after initial access is gained, not during a browser-based initial exploitation stage.

Concept tested: Client-side browser vulnerability exploitation via IE

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051

Topics

#browser exploitation#Internet Explorer#client-side vulnerability#Metasploit

Community Discussion

No community discussion yet for this question.

Full GPEN Practice