nerdexam
GIAC

GPEN · Question #433

You have been contracted to perform a black box pen test against the Internet facing servers for a company. They want to know, with a high level of confidence, if their servers are vulnerable to…

The correct answer is B. Use a vulnerability or port scanner to find listening services and then try to exploitthose. Actively exploiting discovered vulnerabilities confirms they are real and reachable, producing the lowest false positive rate in a penetration test report.

Penetration Testing Foundations & Reconnaissance

Question

You have been contracted to perform a black box pen test against the Internet facing servers for a company. They want to know, with a high level of confidence, if their servers are vulnerable to external attacks. Your contract states that you can use all tools available to you to pen test the systems. What course of action would you use to generate a report with the lowest false positive rate?

Options

  • AUse a port scanner to find open service ports and generate a report listing allvulnerabilities
  • BUse a vulnerability or port scanner to find listening services and then try to exploitthose
  • CUse a vulnerability scanner to generate a report of vulnerable services.
  • DLog into the system and record the patch levels of each service then generate areport that

How the community answered

(21 responses)
  • A
    14% (3)
  • B
    76% (16)
  • C
    5% (1)
  • D
    5% (1)

Why each option

Actively exploiting discovered vulnerabilities confirms they are real and reachable, producing the lowest false positive rate in a penetration test report.

AUse a port scanner to find open service ports and generate a report listing allvulnerabilities

Port scanners identify open ports but do not assess or confirm exploitability, so a report based solely on them will contain a high number of false positives.

BUse a vulnerability or port scanner to find listening services and then try to exploitthoseCorrect

Scanners detect potential vulnerabilities based on version signatures and banner data, which can flag issues that compensating controls or patches already address, creating false positives. By following discovery with actual exploitation attempts, only vulnerabilities that are genuinely exploitable are confirmed and reported, directly minimizing false positives and giving the highest assurance to the client.

CUse a vulnerability scanner to generate a report of vulnerable services.

Vulnerability scanner reports reflect signature matches, not confirmed exploitation, leaving false positives from unverified findings in the output.

DLog into the system and record the patch levels of each service then generate areport that

Reviewing patch levels requires local authenticated access, which is incompatible with an external black box engagement, and patch data alone does not confirm whether a vulnerability is actually exploitable.

Concept tested: Minimizing false positives through active exploitation verification

Source: https://owasp.org/www-project-web-security-testing-guide/

Topics

#penetration testing methodology#false positives#vulnerability validation#black box testing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice