A penetration tester runs the following command and obtains the output shown: After preparing the penetration test report, the penetration tester runs the following commands: rm -f…

The correct answer is D. To delete hashes and any recovered passwords. The penetration tester ran the following commands: 1. rm -f 127.0.0.1.unshadow: This removes the file containing unshadowed password hashes that were used for cracking. 2. rm -f .john/john.pot: This deletes the "pot file," which stores recovered passwords from the cracking…

Engagement management

Question

A penetration tester runs the following command and obtains the output shown:

After preparing the penetration test report, the penetration tester runs the following commands:

rm -f 127.0.0.1.unshadow rm -f .john/john.pot Which of the following best explains why the penetration tester ran the last two commands?

Options

ATo remove tester-created credentials
BTo update John's database of cracked hashes
CTo prevent john from recracking the same hashes
DTo delete hashes and any recovered passwords

How the community answered

(30 responses)

A
7% (2)
B
3% (1)
C
10% (3)
D
80% (24)

Explanation

The penetration tester ran the following commands: 1. rm -f 127.0.0.1.unshadow: This removes the file containing unshadowed password hashes that were used for cracking. 2. rm -f .john/john.pot: This deletes the "pot file," which stores recovered passwords from the cracking session. These commands are executed to ensure that sensitive data, such as password hashes and cracked passwords, is securely removed from the system after completing the penetration test. This is critical for maintaining client confidentiality and adhering to best practices for secure handling of sensitive information.

Topics

#Post-engagement cleanup#Data sanitization#John the Ripper#Penetration testing ethics

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice