Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

CNPen Certified Network Pentester (CNPen)

  • The SecOps Group
  • 4 free sample questions

About this exam

CNPen is the The SecOps Group exam Certified Network Pentester (CNPen). Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
CNPen
Vendor
The SecOps Group
Practice questions
Not available yet
Free sample questions
4
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for CNPen.

Question 1 (choose 4)

You want to extract the technologies used by a target website. Explain how to do this using Wappalyzer
and WhatWeb.

  1. Option A:
    Install WhatWeb:
    sudo apt install whatweb
  2. Option B:
    Scan a target website:
    whatweb -v targetdomain.com
  3. Option C:
    Install Wappalyzer browser extension or use CLI:
    wappalyzer https://targetdomain.com
  4. Option D:
    Identify backend frameworks, CMS, and JavaScript libraries.
    Cross-check version numbers and search for known vulnerabilities.
Show answer and explanation

Correct answer: A, B, C, D

To extract the technologies used by a target website, you can use tools like WhatWeb and Wappalyzer. First, install WhatWeb on a Linux system using the command sudo apt install whatweb, then run a scan on the target website using whatweb -v targetdomain.com, which will reveal details such as the web server, CMS, programming languages, and other technologies used. Next, you can use Wappalyzer either as a browser extension or via its CLI by running wappalyzer https://targetdomain.com, which helps identify backend frameworks, CMS platforms, analytics tools, and JavaScript libraries. After gathering the results from both tools, you can cross-check the detected technologies, including version numbers, to validate accuracy and potentially identify known vulnerabilities associated with those versions.

Question 2 (choose 5)

You need to gather subdomains of a target domain without using brute force. Explain how to use crt.sh
and Sublist3r to extract subdomains efficiently

  1. Option A:
    Use crt.sh to list SSL certificates with subdomains:
    curl -s "https://crt.sh/?q=%.targetdomain.com&output=json" | jq .
  2. Option B:
    Use Sublist3r to gather subdomains from public sources:
    sublist3r -d targetdomain.com -o subdomains.txt
  3. Option C:
    Combine results with amass:
    amass enum -passive -d targetdomain.com
  4. Option D:
    Cross-check findings using nslookup and dig.
  5. Option E:
    Test live subdomains using httprobe:
    cat subdomains.txt | httprobe
Show answer and explanation

Correct answer: A, B, C, D, E

To efficiently gather subdomains of a target domain without brute-forcing, you can rely on passive reconnaissance tools like crt.sh and Sublist3r. First, crt.sh can be used to extract subdomains from public SSL certificate logs by querying https://crt.sh/?q=%.targetdomain.com&output=json using a command like curl -s "https://crt.sh/?q=%.targetdomain.com&output=json" | jq ., which returns all domain names found in certificate transparency records. This helps uncover hidden or forgotten subdomains that were issued SSL certificates. Next, Sublist3r can be used to gather subdomains from multiple public sources such as search engines and DNS databases by running sublist3r -d targetdomain.com -o subdomains.txt, which compiles a list of discovered subdomains into a file. These results can then be combined and validated using other passive tools like Amass or DNS resolution tools such as nslookup and dig to confirm active entries, and finally tested for responsiveness using tools like httprobe.
See all 4 free sample questions