nerdexam
CompTIA

PT0-002 · Question #503

A penetration tester runs an Nmap scan and obtains the following output: Which of the following should the penetration tester run next to explore this host further?

The correct answer is B. BloodHound. Given that the Nmap scan output suggests an Active Directory environment, BloodHound would be the most effective next step for mapping relationships and potential privilege escalation paths.

Reconnaissance and enumeration

Question

A penetration tester runs an Nmap scan and obtains the following output:

Which of the following should the penetration tester run next to explore this host further?

Exhibit

PT0-002 question #503 exhibit

Options

  • AOpenVAS
  • BBloodHound
  • CDirBuster
  • DNikto

How the community answered

(31 responses)
  • A
    3% (1)
  • B
    81% (25)
  • C
    6% (2)
  • D
    10% (3)

Why each option

Given that the Nmap scan output suggests an Active Directory environment, BloodHound would be the most effective next step for mapping relationships and potential privilege escalation paths.

AOpenVAS

OpenVAS is a comprehensive vulnerability scanner, which is generally used for broad vulnerability assessments rather than specific post-Nmap enumeration of AD attack paths.

BBloodHoundCorrect

BloodHound is an advanced tool specifically designed for Active Directory environments to map relationships between users, computers, and groups, revealing potential attack paths for privilege escalation. If the Nmap scan hinted at an AD environment (e.g., ports 389, 445, 88 open), BloodHound would be critical for further exploration.

CDirBuster

DirBuster is a tool used for brute-forcing directories and files on web servers and would not be relevant for exploring an Active Directory host revealed by Nmap.

DNikto

Nikto is a web server scanner focused on identifying vulnerabilities and misconfigurations in web applications, which is not applicable for general host exploration or Active Directory enumeration.

Concept tested: Active Directory enumeration tools

Source: https://github.com/BloodHoundAD/BloodHound

Topics

#Active Directory#Enumeration#Reconnaissance#Penetration Testing Tools

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice