Click the exhibit button. Given the Nikto vulnerability scan output shown in the exhibit, which of the following exploitation techniques might be used to exploit the target system? (Select TWO)

The correct answer is A. Arbitrary code execution B. Session hijacking. XST can be used to get cookies. Cookies can be used for session hijacking. "XST scripts exploit ActiveX, Flash, or any other controls that allow executing an HTTP TRACE request. The HTTP TRACE response includes all the HTTP headers including authentication data and HTTP cookie…

Attacks and Exploits

Question

Exhibit

Options

AArbitrary code execution
BSession hijacking
CSQL injection
DLogin credential brute-forcing
ECross-site request forgery

How the community answered

(39 responses)

A
82% (32)
C
5% (2)
D
10% (4)
E
3% (1)

Explanation

XST can be used to get cookies. Cookies can be used for session hijacking. "XST scripts exploit ActiveX, Flash, or any other controls that allow executing an HTTP TRACE request. The HTTP TRACE response includes all the HTTP headers including authentication data and HTTP cookie contents, which are then available to the script. In combination with cross domain access flaws in web browsers, the exploit is able to collect the cached credentials of any web site, including those utilizing SSL. " https://en.wikipedia.org/wiki/Cross-site_tracing

Topics

#Nikto#Vulnerability Scanning#Exploitation Techniques#Web Security

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice