Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Ethical hacking · Question Set
Post-Exploitation & Pivoting interview questions for placements and exams.
Questions
15
Included in this set
Subject
Ethical hacking
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Ethical hacking.
Slow down and learn where you are. Confirm the host is in scope, note user, hostname, OS, network, and controls. This keeps the test safe and guides next steps.
whoami && hostname && ipconfig /all # Windows whoami && hostname && ip a # Linux
For complete preparation, combine this set with full subject-wise practice for Ethical hacking. You can also explore other subjects and sets from the links below.
Show that escalation is possible using the smallest, reversible action. Do not chase full control if a light proof already demonstrates risk.
Proof file: echo POC_ONLY > /tmp/READ_ME_POC
Credentials are sensitive. Minimize viewing, store proofs securely, and limit any use to agreed test accounts or steps in scope.
evidence.log: time, source, redacted_credential_hash, scope_id
After a foothold, attackers pivot to new systems to reach targets. Ethical tests simulate this step with permissions and approvals in place.
Map paths: host A → share on host B → service token → host C
A pivot lets you access subnets not directly reachable from your machine. Use approved, low-impact tunnels and keep bandwidth small.
ssh -L 8080:10.0.2.10:80 tester@pivot # local port-forward
Built-in commands like PowerShell, WMIC, net, bash, or curl can help you enumerate with less friction. Use them ethically and only as scoped.
Windows: whoami; ipconfig; net use Linux: id; ip r; ss -tuna
Proof should be minimal. Redact sensitive fields, store securely, and coordinate with owners. Massive copies increase risk and are unnecessary.
SELECT id, LEFT(email,3)||'**' AS redacted FROM customers LIMIT 3
Return systems to their original state. Validate with the owner. Document what was removed and provide verification steps.
userdel pentest; rm /tmp/POC_; revoke test key; stop forwarding
Confirm identity and host details. List users, groups, scheduled tasks, running services, and listening ports. Check patch level and installed software. Look for misconfigurations like writable service paths or weak permissions. Keep commands read-only when possible and avoid heavy scripts. Take notes with timestamps so others can replay your steps.
Windows: whoami /all; systeminfo; tasklist; netstat -abno Linux: id; uname -a; ps aux; ss -tuna; crontab -l
Pick a low-impact, reversible method that is already approved, such as creating a disabled test user or a scheduled task that writes a harmless marker file. Document every step, set a short lifetime, and remove it during the same window. The goal is to help defenders validate detections, not to hide access.
Windows demo: schtasks /Create /SC ONCE /TN POC_Task /TR "cmd /c echo POC> C:\POC.txt" /ST 23:00 Cleanup: schtasks /Delete /TN POC_Task /F; del C:\POC.txt
Use the agreed channel. Share intent before big steps. Provide timestamps, hostnames, and expected impact. If anything looks unstable, stop and alert the owner. After each milestone, summarize findings, proof, and suggested fixes in plain language. Clear, timely notes help operations stay confident and responsive.
Update format: time, host, action, expected effect, rollback, status
Good proof is short and verifiable. It shows exactly how to reproduce, why it matters, and how to clean up. It avoids sensitive data when possible and keeps the focus on risk and fix.
Report block: Steps 1–3 → Evidence (redacted) → Impact → Remediation → Validation
Tag artifacts clearly, keep timestamps, and remove them at the end. Never weaken defenses. Good OPSEC is about traceability and minimal footprint.
touch /tmp/POC_<ticket_id>; rm /tmp/POC_<ticket_id> # on close
First, map routes and confirm the database and subnet are in scope. Choose a simple, reversible tunnel like SSH local or SOCKS through the foothold. Limit ports and bandwidth. Authenticate with a test account. Log start and stop times. When done, close the tunnel and confirm no processes are left behind. Share exact commands and evidence so the owner can verify.
ssh -N -L 5432:10.0.2.25:5432 tester@foothold # then connect to localhost:5432
Focus on configuration and risk signals, not secrets. Check for exposed shares, weak local admin reuse, and service accounts with high privileges. Review LSA protections, credential guard settings, and RDP restrictions. If a live dump is approved, use vetted enterprise tooling with masking and collect the smallest possible proof. Share remediation like unique local admin passwords and tiered admin accounts.
whoami /groups; net localgroup administrators; reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa