nerdexam
CompTIA

PT0-001 · Question #160

Joe, a penetration tester, was able to exploit a web application behind a firewall He is trying to get a reverse shell back to his machine but the firewall blocks the outgoing traffic Ports for…

The correct answer is A. HTTP. HTTP (port 80) and HTTPS (port 443) are almost universally permitted outbound through corporate firewalls, giving reverse shell traffic the highest probability of bypassing perimeter controls.

Post-exploitation and lateral movement

Question

Joe, a penetration tester, was able to exploit a web application behind a firewall He is trying to get a reverse shell back to his machine but the firewall blocks the outgoing traffic Ports for which of the following should the security consultant use to have the HIGHEST chance to bypass the firewall?

Options

  • AHTTP
  • BSMTP
  • CFTP
  • DDNS

How the community answered

(14 responses)
  • A
    71% (10)
  • B
    7% (1)
  • C
    14% (2)
  • D
    7% (1)

Why each option

HTTP (port 80) and HTTPS (port 443) are almost universally permitted outbound through corporate firewalls, giving reverse shell traffic the highest probability of bypassing perimeter controls.

AHTTPCorrect

Firewalls must allow outbound HTTP and HTTPS to support normal web browsing, so these ports are rarely blocked. A penetration tester can tunnel a reverse shell over port 80 or 443 so that the traffic blends with legitimate web traffic, making it the most reliable method to establish a callback connection through a restrictive firewall.

BSMTP

SMTP (port 25) is routinely blocked outbound on corporate networks specifically to prevent unauthorized email relay and spam, making it a poor choice for bypass.

CFTP

FTP (port 21) is widely considered a legacy insecure protocol and is commonly restricted or blocked at corporate firewalls.

DDNS

DNS (port 53) can theoretically be used for tunneling but is often rate-limited, inspected with deep packet inspection, or proxied through internal resolvers, making it less reliable than HTTP for an interactive reverse shell.

Concept tested: Firewall egress bypass for reverse shell connections

Source: https://owasp.org/www-project-testing-guide/

Topics

#reverse shell#egress filtering#firewall evasion#HTTP tunneling

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-001 Practice