A penetration tester is conducting a penetration test and discovers a vulnerability on a web server that is owned by the client. Exploiting the vulnerability allows the tester to open a reverse…

Question

Exhibit

Options

• AClose the reverse shell the tester is using.
• BNote this finding for inclusion in the final report.
• CInvestigate the high numbered port connections.
• DContact the client immediately.

• A
  4% (2)
• B
  11% (5)
• C
  82% (37)
• D
  2% (1)

Explanation

During post-exploitation enumeration for privilege escalation (e.g., running 'netstat' or 'ss'), discovering unusual high-numbered port connections is a significant finding. High-numbered ports with active connections can indicate backdoors, existing unauthorized access, tunneling activity, or other malicious processes left by a prior attacker. A penetration tester's responsibility is to thoroughly document and understand the full attack surface - investigating these connections could reveal a more critical finding, such as an active compromise that predates the engagement. Closing the reverse shell (A) would terminate the session prematurely before gathering all findings. Simply noting it for the report (B) without investigating skips a potentially critical finding. Contacting the client immediately (D) would be appropriate only if imminent danger or an active breach is confirmed - investigation should come first to provide the client with accurate information.

No community discussion yet for this question.