nerdexam
GIAC

GPEN · Question #484

You have been contracted to penetration test an e-mail server for a client that wants to know for sure if the sendmail service is vulnerable to any known attacks. You have permission to run any type o

The correct answer is C. Run all sendmail exploits that will not crash the server and see if you cancompromise the. When fully authorized to penetration test a service, the most valid approach is active exploitation testing while avoiding tests that would cause a denial of service.

Vulnerability Discovery & Scanning

Question

You have been contracted to penetration test an e-mail server for a client that wants to know for sure if the sendmail service is vulnerable to any known attacks. You have permission to run any type of test, how will you proceed to give the client the most valid answer?

Options

  • ARun all known sendmail exploits against the server and see if you can compromisethe service,
  • BRun a banner grabbing vulnerability checker to determine the sendmail version andpatch
  • CRun all sendmail exploits that will not crash the server and see if you cancompromise the
  • DLog into the e-mail and determine the sendmail version and patch level, then lookup and

How the community answered

(51 responses)
  • A
    4% (2)
  • B
    8% (4)
  • C
    73% (37)
  • D
    16% (8)

Why each option

When fully authorized to penetration test a service, the most valid approach is active exploitation testing while avoiding tests that would cause a denial of service.

ARun all known sendmail exploits against the server and see if you can compromisethe service,

Running all known exploits without restriction risks crashing the server, causing an unintended denial of service that violates standard penetration testing practice of minimizing unnecessary operational impact.

BRun a banner grabbing vulnerability checker to determine the sendmail version andpatch

Banner grabbing and version identification is passive reconnaissance only - it does not actively confirm whether a vulnerability is exploitable in this specific environment and patch state.

CRun all sendmail exploits that will not crash the server and see if you cancompromise theCorrect

Running all sendmail exploits that will not crash the server provides direct, empirical evidence of exploitability without causing an unintended service outage. This approach gives the client a definitive answer - whether the service can actually be compromised in practice - rather than an indirect inference based on version data alone. Excluding crash-inducing tests preserves availability while still delivering the most thorough and legally defensible penetration test results.

DLog into the e-mail and determine the sendmail version and patch level, then lookup and

Looking up the version and researching known vulnerabilities is passive analysis and does not actively verify exploitability, which is what the client explicitly contracted for.

Concept tested: Active exploitation methodology in authorized penetration testing

Source: https://owasp.org/www-project-web-security-testing-guide/latest/3-The_OWASP_Testing_Framework/1-Penetration_Testing_Methodologies

Topics

#exploit validation#sendmail#service vulnerability testing#safe exploitation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice