Q1
Walk me through how you would perform an LDAP injection attack against an Active Directory environment. What tools would you use, and how would you validate your findings?
Why they ask this:* They're assessing your understanding of directory service vulnerabilities, hands-on tool proficiency (like ldapsearch, Burp Suite), and ability to demonstrate real attack chains that are common in enterprise environments.
Q2
Explain the differences between black-box, white-box, and gray-box penetration testing approaches. When would you recommend each methodology, and how does it affect your reconnaissance and exploitation strategy?
Why they ask this:* They want to verify you understand engagement scope limitations, can adapt your methodology based on client requirements, and know how information asymmetry impacts your testing approach and timeline.
Q3
Describe your process for identifying and exploiting a server-side template injection (SSTI) vulnerability. What are the key indicators, and how would you escalate this to remote code execution?
Why they ask this:* They're testing your knowledge of modern web application vulnerabilities, understanding of template engines, ability to escalate findings, and hands-on exploitation experience with frameworks like Jinja2 or Freemarker.
Q4
You discover a Windows service running with SYSTEM privileges that has an unquoted service path vulnerability. Walk through how you would exploit this for privilege escalation and explain why this vulnerability exists.