Free Preparation Discussions
MENU
CompTIA PT0-003 Exam - Topic 3 Question 28 Discussion
Topic #: 3
During a security assessment, a penetration tester uses a tool to capture plaintext log-in credentials on the communication between a user and an authentication system. The tester wants to use this information for further unauthorized access. Which of the following tools is the tester using?
Wireshark is a network packet analyzer used to capture and analyze network traffic in real-time. During a penetration test, it is often used to inspect unencrypted communication to extract sensitive information like plaintext login credentials. Here's how it works:
Packet Capturing:Wireshark captures the network packets transmitted over a network interface. If a user logs in through an insecure communication protocol (e.g., HTTP, FTP, or Telnet), the credentials are transmitted in plaintext.
Traffic Filtering:Using filters (e.g., http, tcp.port == 21), the tester narrows down the relevant traffic to locate the login request and response packets.
Sensitive Data Extraction:Analyzing the captured packets reveals plaintext credentials in the data payload, such as in HTTP POST requests.
Exploit the Information:After extracting the plaintext credentials, the tester can attempt unauthorized access to resources using these credentials.
CompTIA Pentest+ Reference:
Domain 1.0 (Planning and Scoping)
Domain 2.0 (Information Gathering and Vulnerability Identification)
Wireshark Usage Guide
Tyra
2 months agoChanel
2 months agoLeota
2 months agoLai
2 months agoGilbert
3 months agoBo
3 months agoLauna
3 months agoCaitlin
4 months agoLeonor
4 months agoRyan
4 months agoDanica
4 months agoCherry
4 months agoCarmelina
5 months agoTerrilyn
5 months agoColette
5 months agoJoni
5 months agoLorean
1 month agoShonda
2 months agoEvangelina
2 months agoMargarita
3 months agoEzekiel
6 months agoLeonie
5 months agoLawana
5 months ago